June 2022 - U-Boot

Open Source Firmware Conference 2022
by Christian Walter 02 Jun '22

02 Jun '22

** *Dear u-boot community,* * the OSFC is the biggest open-source firmware conference worldwide made by and for developers. After two years we can finally meet in person again. This year's OSFC will take place in Gothenburg, Sweden from September 19th - 21th. We will have a two day conference, followed by a one-day hackathon where we can hack together on hardware and firmware. Currently the Call for Participation is open, and I’d like to invite everyone in this community to submit talks and present new innovations, updates or problem talks. Additionally, you can already buy early bird tickets, so feel free to check out the homepage https://www.osfc.io <https://www.osfc.io>for more information. As u-boot is one of our supported projects, and is already shown on the homepage, we would love to see some u-boot talks on this years conference! Thank you! Chris * -- *Christian Walter* *Head of Firmware Development / Cyber Security * 9elements GmbH, Kortumstraße 19-21, 44787 Bochum, Germany Email: christian.walter(a)9elements.com Phone: _+49 234 68 94 188 <tel:+492346894188>_ Mobile: _+49 176 70845047 <tel:+4917670845047>_ Sitz der Gesellschaft: Bochum Handelsregister: Amtsgericht Bochum, HRB 17519 Geschäftsführung: Sebastian Deutsch, Eray Basar Datenschutzhinweise nach Art. 13 DSGVO <https://9elements.com/privacy>

1 0

Re: [PATCH 15/20] ax25-ae350: Move CONFIG_SYS_FDT_BASE to Kconfig
by Rick Chen 02 Jun '22

02 Jun '22

> From: Tom Rini <trini(a)konsulko.com> > Sent: Monday, May 30, 2022 12:55 AM > To: u-boot(a)lists.denx.de > Cc: Rick Jian-Zhi Chen(陳建志) <rick(a)andestech.com> > Subject: [PATCH 15/20] ax25-ae350: Move CONFIG_SYS_FDT_BASE to Kconfig > > The address where the device tree will be passed in to U-Boot at is now moved to the Kconfig file. If this is user configurable, it needs to be exposed rather than hidden, and should probably be renamed as well. > > Cc: Rick Chen <rick(a)andestech.com> > Signed-off-by: Tom Rini <trini(a)konsulko.com> > --- > board/AndesTech/ax25-ae350/Kconfig | 4 ++++ > include/configs/ax25-ae350.h | 3 --- > 2 files changed, 4 insertions(+), 3 deletions(-) Reviewed-by: Rick Chen <rick(a)andestech.com>

1 0

Out of bounds write vulnerability in the sqfs_readdir() function
by Jincheng Wang 01 Jun '22

01 Jun '22

Hello u-boot list, I found the sqfs_readdir() function is vulnerable to Out-of-Bound write, which will cause arbitrary code execution. ``` int sqfs_readdir(struct fs_dir_stream *fs_dirs, struct fs_dirent **dentp) { ...... /* Set entry name */ strncpy(dent->name, dirs->entry->name, dirs->entry->name_size + 1); dent->name[dirs->entry->name_size + 1] = '\0'; offset = dirs->entry->name_size + 1 + SQFS_ENTRY_BASE_LENGTH; dirs->entry_count--; ....... } struct squashfs_dir_stream { struct fs_dir_stream fs_dirs; struct fs_dirent dentp; size_t size; int entry_count; struct squashfs_directory_header *dir_header; struct squashfs_directory_entry *entry; ...... }; static int sqfs_search_dir(struct squashfs_dir_stream *dirs, char **token_list, int token_count, u32 *m_list, int m_count) { ...... while (!sqfs_readdir(dirsp, &dent)) { ret = strcmp(dent->name, token_list[j]); if (!ret) break; free(dirs->entry); dirs->entry = NULL; } ...... } ``` The sqfs_readdir() function use strncpy to set entry name, while the type of dirs->entry->name_size is defined as "u16" in the struct squashfs_directory_entry and dent->name is defined as "char[256]" in the struct fs_dirent. We can overwrite *dirs_header and *entry in the struct squashfs_dir_stream, so that we can use the sqfs_search_dir() function to free a fake chunk which causes arbitrary code execution. You can see the Poc in the attachment. host bind 0 test4.sqfs ls host 0 /dirs

2 1

[PATCH 1/3] lib: sha1: Add support for hardware specific sha1_process
by Loic Poulain 01 Jun '22

01 Jun '22

Mark sha1_process as weak to allow hardware specific implementation. Add parameter to support for multiple blocks processing. Signed-off-by: Loic Poulain <loic.poulain(a)linaro.org> --- lib/sha1.c | 26 +++++++++++++++++++------- 1 file changed, 19 insertions(+), 7 deletions(-) diff --git a/lib/sha1.c b/lib/sha1.c index 8154e1e..e5e42bc 100644 --- a/lib/sha1.c +++ b/lib/sha1.c @@ -25,6 +25,8 @@ #include <watchdog.h> #include <u-boot/sha1.h> +#include <linux/compiler_attributes.h> + const uint8_t sha1_der_prefix[SHA1_DER_LEN] = { 0x30, 0x21, 0x30, 0x09, 0x06, 0x05, 0x2b, 0x0e, 0x03, 0x02, 0x1a, 0x05, 0x00, 0x04, 0x14 @@ -65,7 +67,7 @@ void sha1_starts (sha1_context * ctx) ctx->state[4] = 0xC3D2E1F0; } -static void sha1_process(sha1_context *ctx, const unsigned char data[64]) +static void __maybe_unused sha1_process_one(sha1_context *ctx, const unsigned char data[64]) { unsigned long temp, W[16], A, B, C, D, E; @@ -219,6 +221,18 @@ static void sha1_process(sha1_context *ctx, const unsigned char data[64]) ctx->state[4] += E; } +__weak void sha1_process(sha1_context *ctx, const unsigned char *data, + unsigned int blocks) +{ + if (!blocks) + return; + + while (blocks--) { + sha1_process_one(ctx, data); + data += 64; + } +} + /* * SHA-1 process buffer */ @@ -242,17 +256,15 @@ void sha1_update(sha1_context *ctx, const unsigned char *input, if (left && ilen >= fill) { memcpy ((void *) (ctx->buffer + left), (void *) input, fill); - sha1_process (ctx, ctx->buffer); + sha1_process(ctx, ctx->buffer, 1); input += fill; ilen -= fill; left = 0; } - while (ilen >= 64) { - sha1_process (ctx, input); - input += 64; - ilen -= 64; - } + sha1_process(ctx, input, ilen / 64); + input += ilen / 64 * 64; + ilen = ilen % 64; if (ilen > 0) { memcpy ((void *) (ctx->buffer + left), (void *) input, ilen); -- 2.7.4

1 2

[PATCH] arm: socfpga: spl: To notify SDM when SPL pass control to U-Boot
by dinesh.maniyam＠intel.com 01 Jun '22

01 Jun '22

From: Dinesh Maniyam <dinesh.maniyam(a)intel.com> Prior SPL pass control to U-Boot, SPL will send a mailbox command "HPS_STAGE_NOTIFY" to notify Secure Device Manager (SDM) on HPS SW transition. The purpose is for debug as user can query SDM on HPS error details when HPS enters a warm reset due to error such as watchdog. Signed-off-by: Dinesh Maniyam <dinesh.maniyam(a)intel.com> --- arch/arm/mach-socfpga/spl_s10.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/arch/arm/mach-socfpga/spl_s10.c b/arch/arm/mach-socfpga/spl_s10.c index c20e87cdbe..9bfd1a0f6a 100644 --- a/arch/arm/mach-socfpga/spl_s10.c +++ b/arch/arm/mach-socfpga/spl_s10.c @@ -92,3 +92,9 @@ void board_init_f(ulong dummy) mbox_qspi_open(); #endif } + +/* board specific function prior loading SSBL / U-Boot */ +void spl_board_prepare_for_boot(void) +{ + mbox_hps_stage_notify(HPS_EXECUTION_STATE_SSBL); +} -- 2.26.2

2 1

[PATCH 0/3] EFI: Miscellaneous capsule update fixes
by Sughosh Ganu 01 Jun '22

01 Jun '22

The following set of patches fix separate issues relating to the capsule update code. The first patch moves the setting of the descriptor_count parameter to the GetImageInfo function after assertion of a non zero image descriptor buffer. The second patch enables capsule update to proceed even when the OsIndications variable is not set with EFI_IGNORE_OSINDICATIONS config enabled. The third patch updates the capsule update documentation to highlight the 64 bit value of OsIndications that needs to be set. Sughosh Ganu (3): EFI: Populate descriptor_count value only when image_info_size is not zero EFI: Do not read OsIndications variable if EFI_IGNORE_OSINDICATIONS is enabled EFI: Update the documentation to reflect the correct value of OsIndications doc/develop/uefi/uefi.rst | 2 +- lib/efi_loader/efi_capsule.c | 5 +++-- lib/efi_loader/efi_firmware.c | 5 ++--- 3 files changed, 6 insertions(+), 6 deletions(-) -- 2.25.1

3 9

[PATCH] arm:socfpga:soc64: To notify SDM when U-Boot pass control to Linux
by dinesh.maniyam＠intel.com 01 Jun '22

01 Jun '22

From: Dinesh Maniyam <dinesh.maniyam(a)intel.com> Prior U-Boot pass control to Linux, U-Boot will send a mailbox command "HPS_STAGE_NOTIFY" to notify Secure Device Manager (SDM) on HPS SW transition. Signed-off-by: Chin Liang See <chin.liang.see(a)intel.com> Signed-off-by: Dinesh Maniyam <dinesh.maniyam(a)intel.com> --- arch/arm/mach-socfpga/misc_soc64.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/arch/arm/mach-socfpga/misc_soc64.c b/arch/arm/mach-socfpga/misc_soc64.c index 2acdfad07b..3148eb46a5 100644 --- a/arch/arm/mach-socfpga/misc_soc64.c +++ b/arch/arm/mach-socfpga/misc_soc64.c @@ -89,3 +89,8 @@ void do_bridge_reset(int enable, unsigned int mask) socfpga_bridges_reset(enable); } + +void arch_preboot_os(void) +{ + mbox_hps_stage_notify(HPS_EXECUTION_STATE_OS); +} \ No newline at end of file -- 2.26.2

2 2

[PATCH] arm: socfpga: mailbox: Add mailbox command for HPS execution notifcation
by dinesh.maniyam＠intel.com 01 Jun '22

01 Jun '22

From: Dinesh Maniyam <dinesh.maniyam(a)intel.com> Add a new mailbox command "HPS_STAGE_NOTIFY" to notify Secure Device Manager (SDM) on the stage of HPS code execution. In general, there are three main code execution stages: First Stage Boot Loader (FSBL) which is U-Boot SPL, Second Stage Boot Loader (SSBL) which is U-Boot, and the Operating System which is Linux. Signed-off-by: Dinesh Maniyam <dinesh.maniyam(a)intel.com> --- arch/arm/mach-socfpga/include/mach/mailbox_s10.h | 7 +++++++ arch/arm/mach-socfpga/mailbox_s10.c | 6 ++++++ 2 files changed, 13 insertions(+) diff --git a/arch/arm/mach-socfpga/include/mach/mailbox_s10.h b/arch/arm/mach-socfpga/include/mach/mailbox_s10.h index fbaf11597e..50fe6393f9 100644 --- a/arch/arm/mach-socfpga/include/mach/mailbox_s10.h +++ b/arch/arm/mach-socfpga/include/mach/mailbox_s10.h @@ -123,6 +123,7 @@ enum ALT_SDM_MBOX_RESP_CODE { #define MBOX_QSPI_CLOSE 51 #define MBOX_QSPI_DIRECT 59 #define MBOX_REBOOT_HPS 71 +#define MBOX_HPS_STAGE_NOTIFY 93 /* Mailbox registers */ #define MBOX_CIN 0 /* command valid offset */ @@ -166,6 +167,11 @@ enum ALT_SDM_MBOX_RESP_CODE { #define RCF_SOFTFUNC_STATUS_SEU_ERROR BIT(3) #define RCF_PIN_STATUS_NSTATUS BIT(31) +/* Defines for HPS_STAGE_NOTIFY */ +#define HPS_EXECUTION_STATE_FSBL 0 +#define HPS_EXECUTION_STATE_SSBL 1 +#define HPS_EXECUTION_STATE_OS 2 + int mbox_send_cmd(u8 id, u32 cmd, u8 is_indirect, u32 len, u32 *arg, u8 urgent, u32 *resp_buf_len, u32 *resp_buf); int mbox_send_cmd_psci(u8 id, u32 cmd, u8 is_indirect, u32 len, u32 *arg, @@ -182,6 +188,7 @@ int mbox_qspi_open(void); #endif int mbox_reset_cold(void); +int mbox_hps_stage_notify(u32 execution_stage); int mbox_get_fpga_config_status(u32 cmd); int mbox_get_fpga_config_status_psci(u32 cmd); #endif /* _MAILBOX_S10_H_ */ diff --git a/arch/arm/mach-socfpga/mailbox_s10.c b/arch/arm/mach-socfpga/mailbox_s10.c index 101af23855..99f78c7c32 100644 --- a/arch/arm/mach-socfpga/mailbox_s10.c +++ b/arch/arm/mach-socfpga/mailbox_s10.c @@ -479,6 +479,12 @@ int __secure mbox_send_cmd_psci(u8 id, u32 cmd, u8 is_indirect, u32 len, urgent, resp_buf_len, resp_buf); } +int mbox_hps_stage_notify(u32 execution_stage) +{ + return mbox_send_cmd(MBOX_ID_UBOOT, MBOX_HPS_STAGE_NOTIFY, + MBOX_CMD_DIRECT, 1, &execution_stage, 0, 0, NULL); +} + int mbox_send_cmd_only(u8 id, u32 cmd, u8 is_indirect, u32 len, u32 *arg) { return mbox_send_cmd_only_common(id, cmd, is_indirect, len, arg); -- 2.26.2

2 1

efi_firmware_raw_get_image_info and efi_firmware_fit_get_image_info
by Heinrich Schuchardt 01 Jun '22

01 Jun '22

Hello Sughosh, I can't see any difference between efi_firmware_raw_get_image_info() and efi_firmware_fit_get_image_info(). Shouldn't we replace them by a single function to avoid maintaining duplicate code? Best regards Heinrich

2 1

[PATCH] fpga: intel_sdm_mb: Add checking for INTEL_SIP_SMC_STATUS_BUSY (1)
by dinesh.maniyam＠intel.com 01 Jun '22

01 Jun '22

From: Dinesh Maniyam <dinesh.maniyam(a)intel.com> Status busy means transfer is accepted but SDM does not have more freed buffer. It is not an error. Continue process the data if receive OK and BUSY status. Signed-off-by: Ley Foon Tan <ley.foon.tan(a)intel.com> Signed-off-by: Dinesh Maniyam <dinesh.maniyam(a)intel.com> --- drivers/fpga/intel_sdm_mb.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/fpga/intel_sdm_mb.c b/drivers/fpga/intel_sdm_mb.c index f5fd9a14c2..5e0b2777e0 100644 --- a/drivers/fpga/intel_sdm_mb.c +++ b/drivers/fpga/intel_sdm_mb.c @@ -70,7 +70,8 @@ static int send_bitstream(const void *rbf_data, size_t rbf_size) debug("wr_ret = %d, rbf_data = %p, buf_size = %08lx\n", wr_ret, rbf_data, buf_size); - if (wr_ret) + if (wr_ret != INTEL_SIP_SMC_STATUS_OK && + wr_ret != INTEL_SIP_SMC_STATUS_BUSY) continue; rbf_size -= buf_size; -- 2.26.2

3 5