June 2022 - U-Boot

[BUG] RockPro64 not booting since 3ae64582fb
by Aleksei 05 Jun '22

05 Jun '22

Hi U-boot developers, I'm booting RockPro64 by writing compiled u-boot-rockchip.bin to SD card offset 64 as described in doc/board/rockchip/rockchip.rst. There is a USB flash drive plugged into USB2 port containing ext4 filesystem with extlinux/exlinux.conf and a kernel+initrd images. This setup boots fine on 02ce99ec91 but not on the next 3ae64582fb. It gets stuck on "Booting using the fdt blob at 0x1f000000". Let me know if I can help debug this. I have a "daily driver" RockPro64 v2.1, can pull from git repos/branches or apply patches to source tree - whichever you prefer. Best regards, Aleksei, U-boot user

4 5

[PATCH 1/1 v1] CVE-2022-30767: unbounded memcpy with a failed length check
by gerbert 04 Jun '22

04 Jun '22

This patch tries to fix a CVE-2019-14196 fix In if-condition, where NFSV2_FLAG is checked, memcpy call is performed to transfer a reply data of NFS_FHSIZE size. Since the data field in struct rpc_t structure has the size of (1024 / 4) + 26 = 282, while NFS_FHSIZE is only 32, it won't lead to out-of-bounds write (considering the size of data array won't change in the future). So the memcpy call will copy exactly NFS_FHSIZE (32) bytes from (rpc_pkt.u.reply.data + 1). Signed-off-by: gerbert <gerbert(a)users.noreply.github.com> --- net/nfs.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/net/nfs.c b/net/nfs.c index 9152ab742e..98943dde5e 100644 --- a/net/nfs.c +++ b/net/nfs.c @@ -566,8 +566,6 @@ static int nfs_lookup_reply(uchar *pkt, unsigned len) } if (supported_nfs_versions & NFSV2_FLAG) { - if (((uchar *)&(rpc_pkt.u.reply.data[0]) - (uchar *)(&rpc_pkt) + NFS_FHSIZE) > len) - return -NFS_RPC_DROP; memcpy(filefh, rpc_pkt.u.reply.data + 1, NFS_FHSIZE); } else { /* NFSV3_FLAG */ filefh3_length = ntohl(rpc_pkt.u.reply.data[1]); -- 2.32.0

1 0

[PATCH 1/1] CVE-2022-30767: unbounded memcpy with a failed length check
by gerbert 04 Jun '22

04 Jun '22

This patch tries to fix a CVE-2019-14196 fix In if-condition, where NFSV2_FLAG is checked, memcpy call is performed to transfer a reply data of NFS_FHSIZE size. Since the data field in struct rpc_t structure has the size of (1024 / 4) + 26 = 282, while NFS_FHSIZE is only 32, it won't lead to out-of-bounds write (considering the size of data array won't change in the future). What concerns if-condition for NFSV3_FLAG, since filefh3_length is signed integer, it may carry negative values which may lead to memcpy failure, so in this case we need to introduce not only boundary check (filefh3_length > NFS3_FHSIZE), which exists, but also make sure that filefh3_length is not negative. Signed-off-by: gerbert <gerbert(a)users.noreply.github.com> --- net/nfs.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/net/nfs.c b/net/nfs.c index 9152ab742e..5186130ea9 100644 --- a/net/nfs.c +++ b/net/nfs.c @@ -566,13 +566,13 @@ static int nfs_lookup_reply(uchar *pkt, unsigned len) } if (supported_nfs_versions & NFSV2_FLAG) { - if (((uchar *)&(rpc_pkt.u.reply.data[0]) - (uchar *)(&rpc_pkt) + NFS_FHSIZE) > len) - return -NFS_RPC_DROP; memcpy(filefh, rpc_pkt.u.reply.data + 1, NFS_FHSIZE); } else { /* NFSV3_FLAG */ filefh3_length = ntohl(rpc_pkt.u.reply.data[1]); + if (filefh3_length < 0) + return -NFS_RPC_DROP; if (filefh3_length > NFS3_FHSIZE) - filefh3_length = NFS3_FHSIZE; + filefh3_length = NFS3_FHSIZE; memcpy(filefh, rpc_pkt.u.reply.data + 2, filefh3_length); } -- 2.32.0

2 2

[PATCH] phy: dp83867: add dp83867_{read,write}_mmd helpers
by Rasmus Villemoes 04 Jun '22

04 Jun '22

Since the phy_{read,write}_mmd functions are static inlines using other static inline functions, they cause code using them to explode. Defining local wrappers cuts the size of the generated code by 50%: $ size drivers/net/phy/dp83867.o.{before,after} text data bss dec hex filename 4873 112 0 4985 1379 drivers/net/phy/dp83867.o.before 2413 112 0 2525 9dd drivers/net/phy/dp83867.o.after Of course, most of that improvement could also be had by making the phy_*_mmd functions out-of-line, and they probably should be, but this still has the advantage of avoiding passing the DP83867_DEVADDR argument at all call sites, which allows lines to be unwrapped (and probably also gives a little .text reduction by itself). Signed-off-by: Rasmus Villemoes <rasmus.villemoes(a)prevas.dk> --- drivers/net/phy/dp83867.c | 52 +++++++++++++++++++-------------------- 1 file changed, 25 insertions(+), 27 deletions(-) diff --git a/drivers/net/phy/dp83867.c b/drivers/net/phy/dp83867.c index 3d862636b6..766457dfd2 100644 --- a/drivers/net/phy/dp83867.c +++ b/drivers/net/phy/dp83867.c @@ -126,20 +126,30 @@ struct dp83867_private { bool sgmii_ref_clk_en; }; +static int dp83867_read_mmd(struct phy_device *phydev, int regnum) +{ + return phy_read_mmd(phydev, DP83867_DEVADDR, regnum); +} + +static int dp83867_write_mmd(struct phy_device *phydev, int regnum, u16 val) +{ + return phy_write_mmd(phydev, DP83867_DEVADDR, regnum, val); +} + static int dp83867_config_port_mirroring(struct phy_device *phydev) { struct dp83867_private *dp83867 = (struct dp83867_private *)phydev->priv; u16 val; - val = phy_read_mmd(phydev, DP83867_DEVADDR, DP83867_CFG4); + val = dp83867_read_mmd(phydev, DP83867_CFG4); if (dp83867->port_mirroring == DP83867_PORT_MIRRORING_EN) val |= DP83867_CFG4_PORT_MIRROR_EN; else val &= ~DP83867_CFG4_PORT_MIRROR_EN; - phy_write_mmd(phydev, DP83867_DEVADDR, DP83867_CFG4, val); + dp83867_write_mmd(phydev, DP83867_CFG4, val); return 0; } @@ -191,8 +201,7 @@ static int dp83867_of_init(struct phy_device *phydev) * mode, but rgmii should have meant no delay. Warn existing users. */ if (phydev->interface == PHY_INTERFACE_MODE_RGMII) { - u16 val = phy_read_mmd(phydev, DP83867_DEVADDR, - DP83867_STRAP_STS2); + u16 val = dp83867_read_mmd(phydev, DP83867_STRAP_STS2); u16 txskew = (val & DP83867_STRAP_STS2_CLK_SKEW_TX_MASK) >> DP83867_STRAP_STS2_CLK_SKEW_TX_SHIFT; u16 rxskew = (val & DP83867_STRAP_STS2_CLK_SKEW_RX_MASK) >> @@ -282,11 +291,9 @@ static int dp83867_config(struct phy_device *phydev) /* Mode 1 or 2 workaround */ if (dp83867->rxctrl_strap_quirk) { - val = phy_read_mmd(phydev, DP83867_DEVADDR, - DP83867_CFG4); + val = dp83867_read_mmd(phydev, DP83867_CFG4); val &= ~BIT(7); - phy_write_mmd(phydev, DP83867_DEVADDR, - DP83867_CFG4, val); + dp83867_write_mmd(phydev, DP83867_CFG4, val); } if (phy_interface_is_rgmii(phydev)) { @@ -312,15 +319,14 @@ static int dp83867_config(struct phy_device *phydev) * register's bit 11 (marked as RESERVED). */ - bs = phy_read_mmd(phydev, DP83867_DEVADDR, DP83867_STRAP_STS1); + bs = dp83867_read_mmd(phydev, DP83867_STRAP_STS1); if (bs & DP83867_STRAP_STS1_RESERVED) val &= ~DP83867_PHYCR_RESERVED_MASK; ret = phy_write(phydev, MDIO_DEVAD_NONE, MII_DP83867_PHYCTRL, val); - val = phy_read_mmd(phydev, DP83867_DEVADDR, - DP83867_RGMIICTL); + val = dp83867_read_mmd(phydev, DP83867_RGMIICTL); val &= ~(DP83867_RGMII_TX_CLK_DELAY_EN | DP83867_RGMII_RX_CLK_DELAY_EN); @@ -334,20 +340,18 @@ static int dp83867_config(struct phy_device *phydev) if (phydev->interface == PHY_INTERFACE_MODE_RGMII_RXID) val |= DP83867_RGMII_RX_CLK_DELAY_EN; - phy_write_mmd(phydev, DP83867_DEVADDR, DP83867_RGMIICTL, val); + dp83867_write_mmd(phydev, DP83867_RGMIICTL, val); delay = (dp83867->rx_id_delay | (dp83867->tx_id_delay << DP83867_RGMII_TX_CLK_DELAY_SHIFT)); - phy_write_mmd(phydev, DP83867_DEVADDR, - DP83867_RGMIIDCTL, delay); + dp83867_write_mmd(phydev, DP83867_RGMIIDCTL, delay); } if (phy_interface_is_sgmii(phydev)) { if (dp83867->sgmii_ref_clk_en) - phy_write_mmd(phydev, DP83867_DEVADDR, DP83867_SGMIICTL, - DP83867_SGMII_TYPE); + dp83867_write_mmd(phydev, DP83867_SGMIICTL, DP83867_SGMII_TYPE); phy_write(phydev, MDIO_DEVAD_NONE, MII_BMCR, (BMCR_ANENABLE | BMCR_FULLDPLX | BMCR_SPEED1000)); @@ -361,8 +365,7 @@ static int dp83867_config(struct phy_device *phydev) MII_DP83867_CFG2_SPEEDOPT_INTLOW); phy_write(phydev, MDIO_DEVAD_NONE, MII_DP83867_CFG2, cfg2); - phy_write_mmd(phydev, DP83867_DEVADDR, - DP83867_RGMIICTL, 0x0); + dp83867_write_mmd(phydev, DP83867_RGMIICTL, 0x0); phy_write(phydev, MDIO_DEVAD_NONE, MII_DP83867_PHYCTRL, DP83867_PHYCTRL_SGMIIEN | @@ -374,14 +377,11 @@ static int dp83867_config(struct phy_device *phydev) } if (dp83867->io_impedance >= 0) { - val = phy_read_mmd(phydev, - DP83867_DEVADDR, - DP83867_IO_MUX_CFG); + val = dp83867_read_mmd(phydev, DP83867_IO_MUX_CFG); val &= ~DP83867_IO_MUX_CFG_IO_IMPEDANCE_CTRL; val |= dp83867->io_impedance & DP83867_IO_MUX_CFG_IO_IMPEDANCE_CTRL; - phy_write_mmd(phydev, DP83867_DEVADDR, - DP83867_IO_MUX_CFG, val); + dp83867_write_mmd(phydev, DP83867_IO_MUX_CFG, val); } if (dp83867->port_mirroring != DP83867_PORT_MIRRORING_KEEP) @@ -389,8 +389,7 @@ static int dp83867_config(struct phy_device *phydev) /* Clock output selection if muxing property is set */ if (dp83867->set_clk_output) { - val = phy_read_mmd(phydev, DP83867_DEVADDR, - DP83867_IO_MUX_CFG); + val = dp83867_read_mmd(phydev, DP83867_IO_MUX_CFG); if (dp83867->clk_output_sel == DP83867_CLK_O_SEL_OFF) { val |= DP83867_IO_MUX_CFG_CLK_O_DISABLE; @@ -400,8 +399,7 @@ static int dp83867_config(struct phy_device *phydev) val |= dp83867->clk_output_sel << DP83867_IO_MUX_CFG_CLK_O_SEL_SHIFT; } - phy_write_mmd(phydev, DP83867_DEVADDR, - DP83867_IO_MUX_CFG, val); + dp83867_write_mmd(phydev, DP83867_IO_MUX_CFG, val); } genphy_config_aneg(phydev); -- 2.31.1

3 4

[PATCH 0/5] Add support for FLexSPI Boot for i.MX8m
by Mamta Shukla 04 Jun '22

04 Jun '22

This series of patch adds support for generating FlexSPI Header file and booting from QSPI on i.MX8m. Mamta Shukla (5): tools: mkimage: Add support to generate FlexSPI Header for i.MX8m dts: imx8mm-uboot: Add support to pack FlexSPI Header using binman configs: Add config for enabling FSPI boot option for i.MX8m board: freescale: Add QSPI Boot support in spl for i.MX8m configs: imx8mm: Define CONFIG_SYS_UBOOT_BASE for i.MX8m arch/arm/dts/imx8mm-u-boot.dtsi | 22 +++- .../imx8mm_evk/imximage-8mm-lpddr4-fspi.cfg | 9 ++ board/freescale/imx8mm_evk/spl.c | 2 + configs/imx8mm_evk_fspi_defconfig | 116 ++++++++++++++++++ include/configs/imx8mm_evk.h | 7 +- include/imximage.h | 38 ++++++ tools/Kconfig | 59 +++++++++ tools/imx8mimage.c | 75 ++++++++++- 8 files changed, 322 insertions(+), 6 deletions(-) create mode 100644 board/freescale/imx8mm_evk/imximage-8mm-lpddr4-fspi.cfg create mode 100644 configs/imx8mm_evk_fspi_defconfig -- 2.25.1

2 9

[PATCH v2] net: Check for the minimum IP fragmented datagram size
by Fabio Estevam 04 Jun '22

04 Jun '22

From: Fabio Estevam <festevam(a)denx.de> Nicolas Bidron and Nicolas Guigo reported the two bugs below: " ----------BUG 1---------- In compiled versions of U-Boot that define CONFIG_IP_DEFRAG, a value of `ip->ip_len` (IP packet header's Total Length) higher than `IP_HDR_SIZE` and strictly lower than `IP_HDR_SIZE+8` will lead to a value for `len` comprised between `0` and `7`. This will ultimately result in a truncated division by `8` resulting value of `0` forcing the hole metadata and fragment to point to the same location. The subsequent memcopy will overwrite the hole metadata with the fragment data. Through a second fragment, this can be exploited to write to an arbitrary offset controlled by that overwritten hole metadata value. This bug is only exploitable locally as it requires crafting two packets the first of which would most likely be dropped through routing due to its unexpectedly low Total Length. However, this bug can potentially be exploited to root linux based embedded devices locally. ```C static struct ip_udp_hdr *__net_defragment(struct ip_udp_hdr *ip, int *lenp) { static uchar pkt_buff[IP_PKTSIZE] __aligned(PKTALIGN); static u16 first_hole, total_len; struct hole *payload, *thisfrag, *h, *newh; struct ip_udp_hdr *localip = (struct ip_udp_hdr *)pkt_buff; uchar *indata = (uchar *)ip; int offset8, start, len, done = 0; u16 ip_off = ntohs(ip->ip_off); /* payload starts after IP header, this fragment is in there */ payload = (struct hole *)(pkt_buff + IP_HDR_SIZE); offset8 = (ip_off & IP_OFFS); thisfrag = payload + offset8; start = offset8 * 8; len = ntohs(ip->ip_len) - IP_HDR_SIZE; ``` The last line of the previous excerpt from `u-boot/net/net.c` shows how the attacker can control the value of `len` to be strictly lower than `8` by issuing a packet with `ip_len` between `21` and `27` (`IP_HDR_SIZE` has a value of `20`). Also note that `offset8` here is `0` which leads to `thisfrag = payload`. ```C } else if (h >= thisfrag) { /* overlaps with initial part of the hole: move this hole */ newh = thisfrag + (len / 8); *newh = *h; h = newh; if (h->next_hole) payload[h->next_hole].prev_hole = (h - payload); if (h->prev_hole) payload[h->prev_hole].next_hole = (h - payload); else first_hole = (h - payload); } else { ``` Lower down the same function, execution reaches the above code path. Here, `len / 8` evaluates to `0` leading to `newh = thisfrag`. Also note that `first_hole` here is `0` since `h` and `payload` point to the same location. ```C /* finally copy this fragment and possibly return whole packet */ memcpy((uchar *)thisfrag, indata + IP_HDR_SIZE, len); ``` Finally, in the above excerpt the `memcpy` overwrites the hole metadata since `thisfrag` and `h` both point to the same location. The hole metadata is effectively overwritten with arbitrary data from the fragmented IP packet data. If `len` was crafted to be `6`, `last_byte`, `next_hole`, and `prev_hole` of the `first_hole` can be controlled by the attacker. Finally the arbitrary offset write occurs through a second fragment that only needs to be crafted to write data in the hole pointed to by the previously controlled hole metadata (`next_hole`) from the first packet. ### Recommendation Handle cases where `len` is strictly lower than 8 by preventing the overwrite of the hole metadata during the memcpy of the fragment. This could be achieved by either: * Moving the location where the hole metadata is stored when `len` is lower than `8`. * Or outright rejecting fragmented IP datagram with a Total Length (`ip_len`) lower than 28 bytes which is the minimum valid fragmented IP datagram size (as defined as the minimum fragment of 8 octets in the IP Specification Document: [RFC791](https://datatracker.ietf.org/doc/html/rfc791) page 25). ----------BUG 2---------- In compiled versions of U-Boot that define CONFIG_IP_DEFRAG, a value of `ip->ip_len` (IP packet header's Total Length) lower than `IP_HDR_SIZE` will lead to a negative value for `len` which will ultimately result in a buffer overflow during the subsequent `memcpy` that uses `len` as it's `count` parameter. This bug is only exploitable on local ethernet as it requires crafting an invalid packet to include an unexpected `ip_len` value in the IP UDP header that's lower than the minimum accepted Total Length of a packet (21 as defined in the IP Specification Document: [RFC791](https://datatracker.ietf.org/doc/html/rfc791)). Such packet would in all likelihood be dropped while being routed to its final destination through most routing equipment and as such requires the attacker to be in a local position in order to be exploited. ```C static struct ip_udp_hdr *__net_defragment(struct ip_udp_hdr *ip, int *lenp) { static uchar pkt_buff[IP_PKTSIZE] __aligned(PKTALIGN); static u16 first_hole, total_len; struct hole *payload, *thisfrag, *h, *newh; struct ip_udp_hdr *localip = (struct ip_udp_hdr *)pkt_buff; uchar *indata = (uchar *)ip; int offset8, start, len, done = 0; u16 ip_off = ntohs(ip->ip_off); /* payload starts after IP header, this fragment is in there */ payload = (struct hole *)(pkt_buff + IP_HDR_SIZE); offset8 = (ip_off & IP_OFFS); thisfrag = payload + offset8; start = offset8 * 8; len = ntohs(ip->ip_len) - IP_HDR_SIZE; ``` The last line of the previous excerpt from `u-boot/net/net.c` shows where the underflow to a negative `len` value occurs if `ip_len` is set to a value strictly lower than 20 (`IP_HDR_SIZE` being 20). Also note that in the above excerpt the `pkt_buff` buffer has a size of `CONFIG_NET_MAXDEFRAG` which defaults to 16 KB but can range from 1KB to 64 KB depending on configurations. ```C /* finally copy this fragment and possibly return whole packet */ memcpy((uchar *)thisfrag, indata + IP_HDR_SIZE, len); ``` In the above excerpt the `memcpy` overflows the destination by attempting to make a copy of nearly 4 gigabytes in a buffer that's designed to hold `CONFIG_NET_MAXDEFRAG` bytes at most which leads to a DoS. ### Recommendation Stop processing of the packet if `ip_len` is lower than 21 (as defined by the minimum length of a data carrying datagram in the IP Specification Document: [RFC791](https://datatracker.ietf.org/doc/html/rfc791) page 34)." Add a check for ip_len lesser than 28 and stop processing the packet in this case. Such a check covers the two reported bugs. Reported-by: Nicolas Bidron <nicolas.bidron(a)nccgroup.com> Signed-off-by: Fabio Estevam <festevam(a)denx.de> --- Changes since v1: - Define IP_MIN_FRAG_DATAGRAM_SIZE as (IP_HDR_SIZE + 8) instead of hardcoding it. include/net.h | 2 ++ net/net.c | 3 +++ 2 files changed, 5 insertions(+) diff --git a/include/net.h b/include/net.h index 675bf4171b17..8933b976fa07 100644 --- a/include/net.h +++ b/include/net.h @@ -391,6 +391,8 @@ struct ip_hdr { #define IP_HDR_SIZE (sizeof(struct ip_hdr)) +#define IP_MIN_FRAG_DATAGRAM_SIZE (IP_HDR_SIZE + 8) + /* * Internet Protocol (IP) + UDP header. */ diff --git a/net/net.c b/net/net.c index 034a5d6e67c0..81905f631592 100644 --- a/net/net.c +++ b/net/net.c @@ -907,6 +907,9 @@ static struct ip_udp_hdr *__net_defragment(struct ip_udp_hdr *ip, int *lenp) int offset8, start, len, done = 0; u16 ip_off = ntohs(ip->ip_off); + if (ip->ip_len < IP_MIN_FRAG_DATAGRAM_SIZE) + return NULL; + /* payload starts after IP header, this fragment is in there */ payload = (struct hole *)(pkt_buff + IP_HDR_SIZE); offset8 = (ip_off & IP_OFFS); -- 2.25.1

4 4

[PATCH] powerpc: mpc85xx: Fix compilation with CONFIG_WDT
by Pali Rohár 04 Jun '22

04 Jun '22

When CONFIG_WDT is enabled then non-DM watchdog code cannot be used due to conflicting functions like watchdog_reset(). So disable compilation of mpc85xx watchdog_reset() function when CONFIG_WDT is enabled. Signed-off-by: Pali Rohár <pali(a)kernel.org> --- arch/powerpc/cpu/mpc85xx/cpu.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/arch/powerpc/cpu/mpc85xx/cpu.c b/arch/powerpc/cpu/mpc85xx/cpu.c index 261f79e40585..226a26ba320a 100644 --- a/arch/powerpc/cpu/mpc85xx/cpu.c +++ b/arch/powerpc/cpu/mpc85xx/cpu.c @@ -348,6 +348,7 @@ __weak unsigned long get_tbclk(void) } +#ifndef CONFIG_WDT #if defined(CONFIG_WATCHDOG) #define WATCHDOG_MASK (TCR_WP(63) | TCR_WRC(3) | TCR_WIE) void @@ -376,6 +377,7 @@ watchdog_reset(void) enable_interrupts(); } #endif /* CONFIG_WATCHDOG */ +#endif /* * Initializes on-chip MMC controllers. -- 2.20.1

1 1

[PATCH 1/2] test/py: efi_capsule: repair image authentication test
by Vincent Stehlé 04 Jun '22

04 Jun '22

Repair the python tests for authenticated EFI capsules, which can be run with sandbox_defconfig plus CONFIG_EFI_CAPSULE_AUTHENTICATE=y. - Account for the reset changes done by commit 3e6f81000672 ("efi_loader: test/py: Reset system after capsule update on disk"). - Fix the capsule GUID typo introduced by commit 2e9c3c6965ba ("test: capsule: Modify the capsule tests to use GUID values for sandbox"). Signed-off-by: Vincent Stehlé <vincent.stehle(a)arm.com> Cc: Heinrich Schuchardt <xypron.glpk(a)gmx.de> --- test/py/tests/test_efi_capsule/conftest.py | 4 ++-- .../tests/test_efi_capsule/test_capsule_firmware_signed.py | 6 +++--- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/test/py/tests/test_efi_capsule/conftest.py b/test/py/tests/test_efi_capsule/conftest.py index d757415c881..5a8826a5a6b 100644 --- a/test/py/tests/test_efi_capsule/conftest.py +++ b/test/py/tests/test_efi_capsule/conftest.py @@ -101,7 +101,7 @@ def efi_capsule_data(request, u_boot_config): check_call('cd %s; ' '%s/tools/mkeficapsule --index 1 --monotonic-count 1 ' '--private-key SIGNER.key --certificate SIGNER.crt ' - '--guid 09D7DF52-0720-4710-91D1-08469B7FE9C8 ' + '--guid 09D7CF52-0720-4710-91D1-08469B7FE9C8 ' 'u-boot.bin.new Test11' % (data_dir, u_boot_config.build_dir), shell=True) @@ -110,7 +110,7 @@ def efi_capsule_data(request, u_boot_config): '%s/tools/mkeficapsule --index 1 --monotonic-count 1 ' '--private-key SIGNER2.key ' '--certificate SIGNER2.crt ' - '--guid 09D7DF52-0720-4710-91D1-08469B7FE9C8 ' + '--guid 09D7CF52-0720-4710-91D1-08469B7FE9C8 ' 'u-boot.bin.new Test12' % (data_dir, u_boot_config.build_dir), shell=True) diff --git a/test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py b/test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py index 593b032e901..a0b6a1ac86f 100644 --- a/test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py +++ b/test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py @@ -85,7 +85,7 @@ class TestEfiCapsuleFirmwareSigned(object): # need to run uefi command to initiate capsule handling output = u_boot_console.run_command( - 'env print -e Capsule0000') + 'env print -e Capsule0000', wait_for_reboot = True) output = u_boot_console.run_command_list([ 'host bind 0 %s' % disk_img, @@ -160,7 +160,7 @@ class TestEfiCapsuleFirmwareSigned(object): # need to run uefi command to initiate capsule handling output = u_boot_console.run_command( - 'env print -e Capsule0000') + 'env print -e Capsule0000', wait_for_reboot = True) # deleted any way output = u_boot_console.run_command_list([ @@ -237,7 +237,7 @@ class TestEfiCapsuleFirmwareSigned(object): # need to run uefi command to initiate capsule handling output = u_boot_console.run_command( - 'env print -e Capsule0000') + 'env print -e Capsule0000', wait_for_reboot = True) # deleted any way output = u_boot_console.run_command_list([ -- 2.35.1

3 3

[PATCH v1] rockchip: mkimage: add rockchip nand support
by Johan Jonker 04 Jun '22

04 Jun '22

The Rockchip boot ROM requires a particular file format for booting from NAND: * It starts with 512-byte, rc4 encoded header and is aligned to NAND page size. * Then 2KB pieces of spl and tpl data aligned to the NAND page size in a * fixed pattern with empty pages. Size of spl and tpl must be aligned to 2KB. Empty NAND pages not in use need 0xFF padding to increase NAND durability. Main output here is aimed at for example MTD that only writes whole pages. The pattern and the padding needed depends on the chip and the application that loads. (This format is not fit for BOOTROM mode) As input file a 4 byte pre-padded tpl/spl file is expected. These bytes are replaced by ASCII characters for example "RK30". For NAND two extra mkimage input argument types are available: Direct: -X [pagesize, lsb_mode] Obtain arguments by chip ID and a lookup table: -X [id0:id1:id2:id3:id4:id5] As extra SD card images can be made by setting the page size to 2048 and mode 0. Compared to rksd.c the output pads extra 0xFF to the unused sections 1,2,3 of the header which replaces 0x00 by rkcommon_vrec_header() memset. Example usage for NAND with page size 16384 and pattern mode 2: # "SDTNQGAMA 64G 3.3V 8-bit" ./mkimage -n rk3066 -T rknand -d u-boot-tpl.bin:u-boot-spl.bin -X 16384,2 out Example usage for NAND with chip id "ad:de:94:da:74:c4": # "H27UCG8T2ATR-BC 64G 3.3V 8-bit" ./mkimage -n rk3066 -T rknand -d u-boot-tpl.bin:u-boot-spl.bin -X ad:de:94:da:74:c4 out Example usage for SD card image with page size 2048 and pattern mode 0: # "SD CARD" ./mkimage -n rk3188 -T rknand -d u-boot-tpl.bin:u-boot-spl.bin -X 2048,0 out Signed-off-by: Johan Jonker <jbx6244(a)gmail.com> --- boot/image.c | 1 + include/image.h | 1 + tools/Makefile | 2 +- tools/imagetool.h | 1 + tools/mkimage.c | 8 +- tools/rknand.c | 432 ++++++++++++++++++++++++++++++++++++++++++++++ 6 files changed, 442 insertions(+), 3 deletions(-) create mode 100644 tools/rknand.c diff --git a/boot/image.c b/boot/image.c index 5dcb55ba..5a4e98a5 100644 --- a/boot/image.c +++ b/boot/image.c @@ -164,6 +164,7 @@ static const table_entry_t uimage_type[] = { { IH_TYPE_X86_SETUP, "x86_setup", "x86 setup.bin", }, { IH_TYPE_LPC32XXIMAGE, "lpc32xximage", "LPC32XX Boot Image", }, { IH_TYPE_RKIMAGE, "rkimage", "Rockchip Boot Image" }, + { IH_TYPE_RKNAND, "rknand", "Rockchip NAND Boot Image" }, { IH_TYPE_RKSD, "rksd", "Rockchip SD Boot Image" }, { IH_TYPE_RKSPI, "rkspi", "Rockchip SPI Boot Image" }, { IH_TYPE_VYBRIDIMAGE, "vybridimage", "Vybrid Boot Image", }, diff --git a/include/image.h b/include/image.h index e4c6a50b..01963ba7 100644 --- a/include/image.h +++ b/include/image.h @@ -211,6 +211,7 @@ enum { IH_TYPE_LPC32XXIMAGE, /* x86 setup.bin Image */ IH_TYPE_LOADABLE, /* A list of typeless images */ IH_TYPE_RKIMAGE, /* Rockchip Boot Image */ + IH_TYPE_RKNAND, /* Rockchip NAND Boot Image */ IH_TYPE_RKSD, /* Rockchip SD card */ IH_TYPE_RKSPI, /* Rockchip SPI image */ IH_TYPE_ZYNQIMAGE, /* Xilinx Zynq Boot Image */ diff --git a/tools/Makefile b/tools/Makefile index 9f233966..b79a0745 100644 --- a/tools/Makefile +++ b/tools/Makefile @@ -99,7 +99,7 @@ LIBCRYPTO_OBJS-$(CONFIG_TOOLS_LIBCRYPTO) := \ lib/fdt-libcrypto.o \ sunxi_toc0.o -ROCKCHIP_OBS = lib/rc4.o rkcommon.o rkimage.o rksd.o rkspi.o +ROCKCHIP_OBS = lib/rc4.o rkcommon.o rkimage.o rknand.o rksd.o rkspi.o # common objs for dumpimage and mkimage dumpimage-mkimage-objs := aisimage.o \ diff --git a/tools/imagetool.h b/tools/imagetool.h index 05dd94d1..805ddf5b 100644 --- a/tools/imagetool.h +++ b/tools/imagetool.h @@ -90,6 +90,7 @@ struct image_tool_params { const char *engine_id; /* Engine to use for signing */ bool reset_timestamp; /* Reset the timestamp on an existing image */ struct image_summary summary; /* results of signing process */ + char *extraparams; /* Extra parameters for img creation (-X) */ }; /* diff --git a/tools/mkimage.c b/tools/mkimage.c index be58e565..d54f727b 100644 --- a/tools/mkimage.c +++ b/tools/mkimage.c @@ -156,7 +156,7 @@ static void process_args(int argc, char **argv) int opt; while ((opt = getopt(argc, argv, - "a:A:b:B:c:C:d:D:e:Ef:FG:k:i:K:ln:N:p:o:O:rR:qstT:vVx")) != -1) { + "a:A:b:B:c:C:d:D:e:Ef:FG:k:i:K:ln:N:p:o:O:rR:qstT:vVxX:")) != -1) { switch (opt) { case 'a': params.addr = strtoull(optarg, &ptr, 16); @@ -310,6 +310,9 @@ static void process_args(int argc, char **argv) case 'x': params.xflag++; break; + case 'X': + params.extraparams = optarg; + break; default: usage("Invalid option"); } @@ -636,7 +639,8 @@ int main(int argc, char **argv) if (ret) return ret; } else if ((params.type == IH_TYPE_RKSD) || - (params.type == IH_TYPE_RKSPI)) { + (params.type == IH_TYPE_RKSPI) || + (params.type == IH_TYPE_RKNAND)) { /* Rockchip has special Image format */ int ret; diff --git a/tools/rknand.c b/tools/rknand.c new file mode 100644 index 00000000..6214006e --- /dev/null +++ b/tools/rknand.c @@ -0,0 +1,432 @@ +// SPDX-License-Identifier: GPL-2.0+ +/* + * Copyright (C) 2022 Johan Jonker <jbx6244(a)gmail.com> + */ + +#include "imagetool.h" +#include <image.h> +#include <rc4.h> +#include "mkimage.h" +#include "rkcommon.h" + +#define DIV_ROUND_UP(n, d) (((n) + (d) - 1) / (d)) + +enum { + RKNAND_SECT_LEN = RK_BLK_SIZE * 4, +}; + +struct rknand_info { + unsigned int pagesize; + unsigned int lsb_mode; + uint16_t page_table[512]; +}; + +struct rknand_info ninfo; + +struct NandParaInfo { + uint8_t id_bytes; + uint8_t nand_id[6]; + uint8_t vendor; + uint8_t die_per_chip; + uint8_t sec_per_page; + uint16_t page_per_blk; + uint8_t cell; + uint8_t plane_per_die; + uint16_t blk_per_plane; + uint16_t operation_opt; + uint8_t lsb_mode; + uint8_t read_retry_mode; + uint8_t ecc_bits; + uint8_t access_freq; + uint8_t opt_mode; + uint8_t die_gap; + uint8_t bad_block_mode; + uint8_t multi_plane_mode; + uint8_t slc_mode; + uint8_t reserved[5]; +}; + +struct NandParaInfo NandFlashParaTbl[86] = { + {6, {0x2c, 0x64, 0x44, 0x4b, 0xa9, 0x00}, 4, 1, 16, 256, 2, 2, 2048, 0x01df, 3, 17, 40, 32, 1, 0, 1, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0x2c, 0x44, 0x44, 0x4b, 0xa9, 0x00}, 4, 1, 16, 256, 2, 2, 1064, 0x01df, 3, 17, 40, 32, 1, 0, 1, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0x2c, 0x68, 0x04, 0x4a, 0xa9, 0x00}, 4, 1, 8, 256, 2, 2, 2048, 0x011f, 1, 0, 24, 32, 1, 0, 1, 0, 0, {0, 0, 0, 0, 0}}, + {5, {0x2c, 0x88, 0x04, 0x4b, 0xa9, 0x00}, 4, 1, 16, 256, 2, 2, 2048, 0x011f, 1, 0, 24, 32, 1, 0, 1, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0x2c, 0xa8, 0x05, 0xcb, 0xa9, 0x00}, 4, 2, 16, 256, 2, 2, 2048, 0x011f, 1, 0, 24, 32, 1, 0, 1, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0x2c, 0x68, 0x04, 0x46, 0x89, 0x00}, 4, 1, 8, 256, 2, 2, 2048, 0x011f, 1, 0, 24, 32, 1, 0, 1, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0x2c, 0x48, 0x04, 0x4a, 0xa5, 0x00}, 4, 1, 8, 256, 2, 2, 1024, 0x011f, 1, 0, 24, 32, 1, 0, 1, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0x2c, 0x84, 0x64, 0x3c, 0xa5, 0x00}, 4, 1, 32, 512, 2, 2, 1024, 0x01df, 3, 17, 40, 32, 1, 0, 1, 0, 0, {0, 0, 0, 0, 0}}, + {5, {0x2c, 0x84, 0x64, 0x54, 0xa9, 0x00}, 4, 1, 32, 512, 2, 2, 1024, 0x01df, 4, 18, 60, 32, 1, 0, 1, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0x2c, 0xd7, 0x94, 0x3e, 0x84, 0x00}, 4, 1, 8, 128, 2, 2, 4096, 0x0117, 1, 0, 24, 32, 1, 0, 1, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0x2c, 0x48, 0x04, 0x46, 0x85, 0x00}, 4, 1, 8, 256, 2, 2, 1024, 0x011f, 1, 0, 24, 32, 1, 0, 1, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0x2c, 0x88, 0x05, 0xc6, 0x89, 0x00}, 4, 2, 8, 256, 2, 2, 2048, 0x011f, 1, 0, 24, 32, 1, 0, 1, 0, 0, {0, 0, 0, 0, 0}}, + {5, {0x2c, 0x88, 0x24, 0x4b, 0xa9, 0x00}, 4, 1, 16, 256, 2, 2, 2048, 0x011f, 1, 0, 24, 32, 1, 0, 1, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0x2c, 0x68, 0x00, 0x27, 0xa9, 0x00}, 4, 1, 16, 128, 1, 2, 2048, 0x011f, 0, 0, 24, 32, 1, 0, 1, 0, 0, {0, 0, 0, 0, 0}}, + {5, {0x2c, 0x64, 0x64, 0x56, 0xa5, 0x00}, 4, 1, 24, 512, 2, 2, 700, 0x01df, 4, 18, 60, 32, 1, 0, 1, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0x2c, 0x84, 0xc5, 0x4b, 0xa9, 0x00}, 4, 2, 16, 256, 2, 2, 2048, 0x01df, 3, 17, 40, 32, 1, 0, 1, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0x2c, 0xd5, 0xd1, 0xa6, 0x68, 0x00}, 4, 2, 8, 64, 1, 2, 2048, 0x0117, 0, 0, 24, 32, 1, 0, 1, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0x2c, 0xdc, 0x90, 0xa6, 0x54, 0x00}, 4, 1, 8, 64, 1, 2, 1024, 0x0117, 0, 0, 24, 32, 1, 0, 1, 0, 0, {0, 0, 0, 0, 0}}, + {5, {0x2c, 0x64, 0x64, 0x54, 0xa4, 0x00}, 4, 1, 32, 512, 2, 1, 1024, 0x01df, 4, 18, 60, 32, 1, 0, 1, 0, 0, {0, 0, 0, 0, 0}}, + {5, {0x2c, 0x84, 0x44, 0x32, 0xaa, 0x00}, 4, 1, 32, 512, 2, 1, 2184, 0x05c7, 5, 19, 60, 32, 1, 0, 1, 0, 1, {0, 0, 0, 0, 0}}, + {5, {0x2c, 0x64, 0x44, 0x32, 0xa5, 0x00}, 4, 1, 32, 512, 2, 1, 1048, 0x05c7, 5, 19, 60, 32, 1, 0, 1, 0, 1, {0, 0, 0, 0, 0}}, + {5, {0x2c, 0x64, 0x64, 0x3c, 0xa5, 0x00}, 4, 1, 32, 512, 2, 1, 1044, 0x01df, 3, 17, 40, 32, 1, 0, 1, 0, 0, {0, 0, 0, 0, 0}}, + {5, {0x2c, 0x84, 0x44, 0x32, 0xaa, 0x00}, 4, 1, 32, 512, 2, 1, 2184, 0x05c7, 5, 19, 60, 32, 1, 0, 4, 0, 1, {0, 0, 0, 0, 0}}, + {5, {0x2c, 0x84, 0x44, 0x34, 0xaa, 0x00}, 4, 1, 32, 512, 2, 1, 2184, 0x05c7, 5, 19, 60, 32, 1, 0, 4, 0, 1, {0, 0, 0, 0, 0}}, + {5, {0x2c, 0x84, 0xc4, 0x34, 0xaa, 0x00}, 4, 1, 32, 512, 2, 1, 2184, 0x05c7, 5, 19, 60, 32, 1, 0, 1, 0, 1, {0, 0, 0, 0, 0}}, + {5, {0x2c, 0x84, 0x44, 0x34, 0xa4, 0x00}, 4, 1, 32, 512, 2, 1, 2184, 0x05c7, 5, 19, 60, 32, 1, 0, 1, 0, 1, {0, 0, 0, 0, 0}}, + {5, {0x2c, 0x84, 0x64, 0x3c, 0xa9, 0x00}, 4, 1, 32, 512, 2, 2, 1024, 0x01df, 3, 17, 40, 32, 1, 0, 1, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0x2c, 0xa4, 0x64, 0x32, 0xaa, 0x04}, 4, 1, 32, 1024, 2, 1, 2192, 0x05c7, 10, 19, 60, 32, 1, 0, 4, 0, 1, {0, 0, 0, 0, 0}}, + {6, {0xad, 0xde, 0x94, 0xd2, 0x04, 0x43}, 2, 1, 16, 256, 2, 2, 2048, 0x01d9, 1, 1, 24, 32, 4, 0, 3, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0xad, 0xd7, 0x94, 0xda, 0x74, 0xc3}, 2, 1, 16, 256, 2, 2, 1024, 0x01d9, 1, 2, 40, 32, 4, 0, 3, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0xad, 0xd7, 0x94, 0x91, 0x60, 0x44}, 2, 1, 16, 256, 2, 2, 1046, 0x01d9, 1, 3, 40, 32, 4, 1, 3, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0xad, 0xde, 0x94, 0xda, 0x74, 0xc4}, 2, 1, 16, 256, 2, 2, 2090, 0x01d9, 1, 4, 40, 32, 4, 1, 3, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0xad, 0xde, 0x94, 0xeb, 0x74, 0x44}, 2, 1, 32, 256, 2, 2, 1066, 0x01d9, 1, 7, 40, 32, 4, 1, 3, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0xad, 0xd5, 0x94, 0xda, 0x74, 0xc4}, 2, 1, 16, 256, 2, 2, 530, 0x01d9, 1, 3, 40, 32, 4, 1, 3, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0xad, 0xd7, 0x94, 0x9a, 0x74, 0x42}, 2, 1, 16, 256, 2, 2, 1024, 0x0119, 1, 0, 24, 32, 4, 0, 3, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0xad, 0xde, 0x14, 0xa7, 0x42, 0x4a}, 2, 1, 32, 256, 2, 2, 1060, 0x01d9, 2, 5, 40, 32, 4, 1, 3, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0xad, 0xd7, 0x14, 0x9e, 0x34, 0x4a}, 2, 1, 16, 256, 2, 2, 1056, 0x01d9, 2, 5, 40, 32, 4, 1, 3, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0xad, 0xde, 0x94, 0xa7, 0x42, 0x48}, 2, 1, 32, 256, 2, 2, 1060, 0x01d9, 2, 5, 40, 32, 4, 1, 3, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0xad, 0xde, 0x14, 0xab, 0x42, 0x4a}, 2, 1, 32, 256, 2, 2, 1056, 0x01d9, 2, 6, 40, 32, 3, 1, 3, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0xad, 0x3a, 0x14, 0xab, 0x42, 0x4a}, 2, 1, 32, 256, 2, 2, 2092, 0x01d9, 2, 5, 40, 32, 3, 1, 3, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0xad, 0xd5, 0x94, 0x9a, 0x74, 0x42}, 2, 1, 16, 256, 2, 1, 1024, 0x0111, 1, 0, 24, 32, 4, 1, 3, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0xad, 0x3a, 0x14, 0x03, 0x08, 0x50}, 2, 1, 32, 388, 2, 2, 1362, 0x01d9, 9, 8, 40, 32, 3, 1, 3, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0x89, 0x64, 0x44, 0x4b, 0xa9, 0x00}, 7, 1, 16, 256, 2, 2, 2048, 0x01df, 3, 17, 40, 32, 1, 0, 1, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0x89, 0x88, 0x24, 0x4b, 0xa9, 0x84}, 7, 1, 16, 256, 2, 2, 2048, 0x01df, 3, 17, 40, 32, 1, 0, 1, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0x89, 0x88, 0x24, 0x4b, 0xa9, 0x00}, 7, 1, 16, 256, 2, 2, 2048, 0x0117, 1, 0, 24, 32, 1, 0, 1, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0x89, 0x68, 0x24, 0x4a, 0xa9, 0x00}, 7, 1, 8, 256, 2, 2, 2048, 0x0117, 1, 0, 24, 32, 1, 0, 1, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0x89, 0x68, 0x04, 0x4a, 0xa9, 0x00}, 7, 1, 8, 256, 2, 2, 2048, 0x0117, 1, 0, 24, 32, 1, 0, 1, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0x89, 0xd7, 0x94, 0x3e, 0x84, 0x00}, 7, 1, 8, 256, 2, 2, 2048, 0x0117, 1, 0, 24, 32, 1, 0, 1, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0x89, 0x68, 0x04, 0x46, 0xa9, 0x00}, 7, 1, 8, 256, 2, 2, 2048, 0x0117, 1, 0, 24, 32, 1, 0, 1, 0, 0, {0, 0, 0, 0, 0}}, + {5, {0x89, 0x64, 0x64, 0x3c, 0xa1, 0x00}, 7, 1, 32, 512, 2, 1, 1024, 0x01c7, 4, 17, 40, 32, 1, 0, 1, 0, 0, {0, 0, 0, 0, 0}}, + {5, {0x89, 0x84, 0x64, 0x3c, 0xa5, 0x00}, 7, 1, 32, 512, 2, 2, 1024, 0x01c7, 4, 17, 40, 32, 1, 0, 1, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0x89, 0x88, 0x24, 0x3b, 0xa9, 0x00}, 7, 1, 16, 192, 2, 2, 2048, 0x0117, 12, 0, 24, 32, 1, 0, 1, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0x98, 0xd7, 0x84, 0x93, 0x72, 0x57}, 1, 1, 32, 256, 2, 1, 1060, 0x05c1, 2, 33, 40, 32, 2, 1, 1, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0x98, 0xde, 0x84, 0x93, 0x72, 0x57}, 1, 1, 32, 256, 2, 1, 2092, 0x05c1, 2, 33, 40, 32, 2, 1, 1, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0x98, 0x3a, 0x85, 0x93, 0x76, 0x57}, 1, 2, 32, 256, 2, 1, 2092, 0x05e1, 2, 33, 40, 32, 2, 1, 1, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0x98, 0xd5, 0x84, 0x32, 0x72, 0x56}, 1, 1, 16, 128, 2, 1, 2056, 0x05c1, 2, 33, 40, 32, 2, 1, 1, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0x98, 0xd7, 0x94, 0x32, 0x76, 0x56}, 1, 1, 16, 128, 2, 2, 2058, 0x05d1, 2, 33, 40, 32, 2, 1, 1, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0x98, 0xde, 0x94, 0x82, 0x76, 0x56}, 1, 1, 16, 256, 2, 2, 2062, 0x05d1, 1, 33, 40, 32, 2, 1, 1, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0x98, 0xde, 0x94, 0x93, 0x76, 0x50}, 1, 1, 32, 256, 2, 2, 1066, 0x05d9, 2, 34, 40, 32, 3, 1, 1, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0x98, 0x3a, 0x95, 0x93, 0x7a, 0x50}, 1, 2, 32, 256, 2, 2, 1066, 0x05d9, 2, 34, 40, 32, 3, 1, 1, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0x98, 0xd7, 0x94, 0x32, 0x76, 0x55}, 1, 1, 16, 128, 2, 2, 2050, 0x0191, 2, 0, 24, 32, 1, 1, 1, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0x98, 0xde, 0x94, 0x93, 0x76, 0x57}, 1, 1, 32, 256, 2, 2, 1058, 0x05d9, 2, 33, 40, 32, 3, 1, 1, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0x98, 0xd7, 0x84, 0x93, 0x72, 0x50}, 1, 1, 32, 256, 2, 1, 1060, 0x05c1, 2, 34, 40, 32, 3, 1, 1, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0x98, 0xde, 0x94, 0x93, 0x76, 0x51}, 1, 1, 32, 256, 2, 2, 1074, 0x05d9, 2, 35, 40, 32, 3, 1, 4, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0x98, 0x3a, 0x94, 0x93, 0x76, 0x51}, 1, 1, 32, 256, 2, 2, 2106, 0x05d9, 2, 35, 40, 32, 3, 1, 4, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0x98, 0xd7, 0x84, 0x93, 0x72, 0x51}, 1, 1, 32, 256, 2, 1, 1056, 0x05d9, 2, 35, 40, 32, 3, 1, 4, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0x98, 0xde, 0x94, 0x93, 0x76, 0xd1}, 1, 1, 32, 256, 2, 2, 1074, 0x05d9, 2, 35, 40, 32, 3, 1, 4, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0x45, 0xde, 0x94, 0x93, 0x76, 0x57}, 8, 1, 32, 256, 2, 2, 1058, 0x05d9, 2, 66, 40, 32, 3, 1, 1, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0x45, 0xd7, 0x84, 0x93, 0x72, 0x57}, 8, 1, 32, 256, 2, 1, 1060, 0x05c1, 2, 66, 40, 32, 2, 1, 1, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0x45, 0xde, 0xa4, 0x82, 0x76, 0x56}, 8, 1, 16, 256, 2, 2, 2082, 0x01d9, 1, 65, 40, 32, 3, 1, 1, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0x45, 0xde, 0x94, 0x93, 0x76, 0x50}, 8, 1, 32, 256, 2, 2, 1066, 0x05d9, 2, 67, 40, 32, 3, 1, 1, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0x45, 0xd7, 0x84, 0x93, 0x72, 0x50}, 8, 1, 32, 256, 2, 1, 1060, 0x05c1, 2, 67, 40, 32, 3, 1, 1, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0x45, 0xde, 0xa4, 0x82, 0x76, 0xd7}, 8, 1, 16, 256, 2, 2, 2090, 0x04d9, 1, 66, 40, 32, 3, 1, 1, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0x45, 0xde, 0x84, 0x93, 0x72, 0x57}, 8, 1, 32, 256, 2, 1, 2092, 0x05c1, 2, 66, 40, 32, 3, 1, 1, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0x45, 0x3a, 0x94, 0x93, 0x76, 0x51}, 8, 1, 32, 256, 2, 2, 2106, 0x01d9, 2, 68, 40, 32, 3, 1, 4, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0x45, 0xde, 0x94, 0x93, 0x76, 0x51}, 8, 1, 32, 256, 2, 2, 1074, 0x01d9, 2, 68, 40, 32, 3, 1, 4, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0x45, 0x3a, 0xa4, 0x93, 0x7a, 0x50}, 8, 1, 32, 256, 2, 2, 2138, 0x05d9, 2, 0, 40, 32, 3, 1, 1, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0x45, 0xde, 0x94, 0x82, 0x76, 0x56}, 8, 1, 16, 256, 2, 2, 2062, 0x01d9, 1, 0, 40, 32, 3, 1, 1, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0x45, 0xde, 0x94, 0x93, 0x76, 0xd7}, 8, 1, 32, 256, 2, 2, 1058, 0x05d9, 2, 66, 40, 32, 3, 1, 1, 0, 0, {0, 0, 0, 0, 0}}, + {5, {0xec, 0xd7, 0x94, 0x7e, 0x64, 0x44}, 0, 1, 16, 128, 2, 2, 2048, 0x01d9, 2, 49, 60, 36, 3, 0, 3, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0xec, 0xde, 0xd5, 0x7e, 0x68, 0x44}, 0, 2, 16, 128, 2, 2, 2048, 0x01f9, 2, 49, 60, 36, 3, 0, 3, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0xec, 0xd7, 0x94, 0x7a, 0x54, 0x43}, 0, 1, 16, 128, 2, 2, 2076, 0x0199, 2, 0, 40, 36, 3, 1, 3, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0xec, 0xde, 0xd5, 0x7a, 0x58, 0x43}, 0, 2, 16, 128, 2, 2, 2076, 0x01b9, 2, 0, 40, 36, 3, 1, 3, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0xec, 0xd5, 0x94, 0x76, 0x54, 0x43}, 0, 1, 16, 128, 2, 2, 1038, 0x0119, 2, 0, 24, 36, 3, 1, 3, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0xec, 0xd7, 0x14, 0x76, 0x54, 0xc2}, 0, 1, 16, 128, 2, 2, 2076, 0x0491, 2, 0, 24, 40, 3, 1, 3, 0, 0, {0, 0, 0, 0, 0}}, + {6, {0xec, 0xde, 0x94, 0xc3, 0xa4, 0xca}, 0, 1, 32, 792, 2, 1, 688, 0x04c1, 11, 50, 40, 32, 3, 1, 1, 0, 1, {0, 0, 0, 0, 0}}, +}; + +void rknand_build_page_table(uint8_t lsb_mode) +{ + uint32_t counter; + uint32_t counter2; + + switch (lsb_mode) { + case 0: + counter = 0; + do { + uint16_t val = counter; + + ninfo.page_table[counter++] = val; + } while (counter != 512); + break; + case 1: + counter = 0; + do { + uint16_t val = counter; + + if (counter > 3) { + uint16_t offset; + + if (counter & 1) + offset = 3; + else + offset = 2; + val = 2 * counter - offset; + } + ninfo.page_table[counter++] = val; + } while (counter != 512); + break; + case 2: + counter = 0; + do { + uint16_t val = counter; + + if (counter > 1) + val = 2 * counter - 1; + ninfo.page_table[counter++] = val; + } while (counter != 512); + break; + case 3: + counter = 0; + do { + uint16_t val = counter; + + if (counter > 5) { + uint16_t offset; + + if (counter & 1) + offset = 5; + else + offset = 4; + val = 2 * counter - offset; + } + ninfo.page_table[counter++] = val; + } while (counter != 512); + break; + case 4: + counter = 8; + ninfo.page_table[0] = 0; + ninfo.page_table[1] = 1; + ninfo.page_table[2] = 2; + ninfo.page_table[3] = 3; + ninfo.page_table[4] = 4; + ninfo.page_table[5] = 5; + ninfo.page_table[6] = 7; + ninfo.page_table[7] = 8; + do { + uint32_t offset; + uint32_t val; + + if (counter & 1) + offset = 7; + else + offset = 6; + val = 2 * counter - offset; + ninfo.page_table[counter++] = val; + } while (counter != 512); + break; + case 5: + counter = 0; + counter2 = 16; + do { + uint16_t val = counter; + + ninfo.page_table[counter++] = val; + } while (counter != 16); + do { + ninfo.page_table[counter++] = counter2; + counter2 = counter2 + 2; + } while (counter != 512); + break; + case 6: + counter = 0; + counter2 = 0; + do { + uint16_t val = counter; + + if (counter > 5) { + uint16_t offset; + + if (counter & 1) + offset = 12; + else + offset = 10; + val = counter2 - offset; + } + ninfo.page_table[counter++] = val; + counter2 = counter2 + 3; + } while (counter != 512); + break; + case 9: + counter = 3; + counter2 = 3; + ninfo.page_table[0] = 0; + ninfo.page_table[1] = 1; + ninfo.page_table[2] = 2; + do { + ninfo.page_table[counter++] = counter2; + counter2 = counter2 + 2; + } while (counter != 512); + break; + case 10: + counter = 0; + counter2 = 63; + do { + uint16_t val = counter; + + ninfo.page_table[counter++] = val; + } while (counter != 63); + do { + ninfo.page_table[counter++] = counter2; + counter2 = counter2 + 2; + } while (counter != 512); + break; + case 11: + counter = 0; + do { + uint16_t val = counter; + + ninfo.page_table[counter++] = val; + } while (counter != 8); + do { + uint32_t offset; + uint32_t val; + + if (counter & 1) + offset = 7; + else + offset = 6; + val = 2 * counter - offset; + ninfo.page_table[counter++] = val; + } while (counter != 512); + break; + case 12: + counter = 4; + ninfo.page_table[0] = 0; + ninfo.page_table[1] = 1; + ninfo.page_table[2] = 2; + ninfo.page_table[3] = 3; + do { + uint32_t val = counter - 1 + (counter >> 1); + + ninfo.page_table[counter++] = val; + } while (counter != 512); + break; + } +} + +static void rknand_set_header(void *buf, struct stat *sbuf, int ifd, + struct image_tool_params *params) +{ + unsigned int size; + int sector; + void *tmp; + + size = params->orig_file_size; + + rkcommon_set_header(buf, sbuf, ifd, params); + + if (params->vflag) + fprintf(stderr, "Spreading nand image from %u to %u\n", + size, params->file_size); + + tmp = malloc(size); + if (!tmp) + return; + + memcpy(tmp, buf, size); + memset(tmp + RK_BLK_SIZE, 0xFF, RKNAND_SECT_LEN - RK_BLK_SIZE); + memset(buf, 0xFF, params->file_size); + + for (sector = 0; sector < size / RKNAND_SECT_LEN; sector++) { + memcpy(buf + ninfo.page_table[sector] * ninfo.pagesize, + tmp + sector * RKNAND_SECT_LEN, + RKNAND_SECT_LEN); + } + + free(tmp); +} + +static int rknand_check_image_type(uint8_t type) +{ + if (type == IH_TYPE_RKNAND) + return EXIT_SUCCESS; + else + return EXIT_FAILURE; +} + +static int rknand_vrec_header(struct image_tool_params *params, + struct image_type_params *tparams) +{ + unsigned int modes[] = {0, 1, 2, 3, 4, 5, 6, 9, 10, 11, 12}; + unsigned int last_page; + unsigned int sectors; + unsigned int id[6]; + + rkcommon_vrec_header(params, tparams); + + if (sscanf(params->extraparams, "%u,%u", &ninfo.pagesize, &ninfo.lsb_mode) == 2) { + int size = ARRAY_SIZE(modes); + int i; + + if (ninfo.pagesize % RKNAND_SECT_LEN || + ninfo.pagesize < RKNAND_SECT_LEN) { + fprintf(stderr, "%s: Wrong pagesize\n", params->cmdname); + exit(EXIT_FAILURE); + } + + for (i = 0; i < size; i++) { + if (modes[i] == ninfo.lsb_mode) + break; + } + + if (i == size) { + fprintf(stderr, "%s: Wrong lsb_mode\n", params->cmdname); + exit(EXIT_FAILURE); + } + } else if (sscanf(params->extraparams, "%2x:%2x:%2x:%2x:%2x:%2x", + &id[0], &id[1], &id[2], &id[3], &id[4], &id[5]) == 6) { + int size = ARRAY_SIZE(NandFlashParaTbl); + struct NandParaInfo *p; + int i; + + for (i = 0; i < size; i++) { + p = (struct NandParaInfo *)&NandFlashParaTbl[i]; + if (p->nand_id[0] == id[0] && + p->nand_id[1] == id[1] && + p->nand_id[2] == id[2] && + p->nand_id[3] == id[3] && + p->nand_id[4] == id[4] && + p->nand_id[5] == id[5]) { + ninfo.pagesize = p->sec_per_page * RK_BLK_SIZE; + ninfo.lsb_mode = p->lsb_mode; + break; + } + } + + if (i == size) { + fprintf(stderr, "%s: NandParaInfo not found\n", params->cmdname); + exit(EXIT_FAILURE); + } + } else { + exit(EXIT_FAILURE); + } + + rknand_build_page_table(ninfo.lsb_mode); + + sectors = DIV_ROUND_UP(params->file_size, RKNAND_SECT_LEN); + + last_page = ninfo.page_table[sectors - 1]; + + params->file_size = ninfo.pagesize * (last_page + 1); + + return 0; +} + +/* + * rknand parameters + */ +U_BOOT_IMAGE_TYPE( + rknand, + "Rockchip NAND Boot Image support", + 0, + NULL, + rkcommon_check_params, + rkcommon_verify_header, + rkcommon_print_header, + rknand_set_header, + NULL, + rknand_check_image_type, + NULL, + rknand_vrec_header +); -- 2.20.1

1 0

[PATCH] net: enetc: unregister mdiobus
by Michael Walle 03 Jun '22

03 Jun '22

If the device fails to probe - for example, when there is no ethaddr set - then the private data is automatically freed but the mdiobus remains registered. Fixes: 1e354cb39314 ("drivers: net: fsl_enetc: register internal MDIO bus") Signed-off-by: Michael Walle <michael(a)walle.cc> --- This actually causes the kontron sl28 board (variant 2) to oops when no ethaddr is set. It would be good if it still makes it into the next release. That miiphy_get_dev_by_name() hack is actually borrowed from the handling in the driver. It should probably be converted to a proper flag ENETC_IMDIO_REGISTERED or something like that. But that is beyond the scope of this patch. drivers/net/fsl_enetc.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/fsl_enetc.c b/drivers/net/fsl_enetc.c index 9b97a03ccb..cd4c2c29a6 100644 --- a/drivers/net/fsl_enetc.c +++ b/drivers/net/fsl_enetc.c @@ -361,6 +361,9 @@ static int enetc_remove(struct udevice *dev) { struct enetc_priv *priv = dev_get_priv(dev); + if (miiphy_get_dev_by_name(priv->imdio.name)) + mdio_unregister(&priv->imdio); + free(priv->enetc_txbd); free(priv->enetc_rxbd); -- 2.30.2

2 1