December 2023 - U-Boot

Re: ACPI on Raspberry Pi
by Simon Glass 27 Dec '23

27 Dec '23

+U-Boot Mailing List as the attempt to send did not seem to arrive? On Mon, Nov 27, 2023 at 4:51 PM Ba Gia Bao PHAN <bagiabao.phan(a)st.com> wrote: > > Dear Sir, > > I am trainee at STMicroelectronics France, and I am doing project "Setting up a boot chain ACPI" for STM32MPU. The objective of my project is to replace the Device Tree by ACPI in STM32MPU. > > As my research on the Internet, specifically this website https://lore.kernel.org/all/20211201160315.2203099-1-sjg@chromium.org/T/ , it seems that you have succeeded in configuring ACPI on Raspberry Pi. I don't know exactly whether it worked or not and how it worked. Can you explain me? > > Thank you very much if you could take a moment to reply to my email. > > Sincerely, > Phan Ba Gia Bao > > ST Restricted

1 0

[PATCH v3 0/4] cmd: bootefi: refactor the code for bootmgr
by AKASHI Takahiro 27 Dec '23

27 Dec '23

This patch set is motivated by the discussion[1] regarding CONFIG_BOOTEFI_BOOTMGR option. # It has been partially merged in -next branch. So this version (v3) # contains only the remaining commits. At the end, bootefi.c will be decomposed into two parts, one for providing the command itself and one for implementing helper functions. EFI_LOADER will now be available without CONFIG_CMDLINE or specifically CONFIG_CMD_BOOTEFI if invoked via bootmeth/bootstd. Then, EFI_LOADER library side will be further split into two options for fine-grain control: CONFIG_EFI_BINARY_EXEC: execute UEFI binaries which are to be explicitly loaded by U-Boot's load commands/functions or other methods (like a jtag debugger?) It supports bootmeth_efi as well as "bootefi <addr>|hello"(/"bootm"?). CONFIG_EFI_BOOTMGR: provide EFI boot manger functionality It supports bootmeth_efi_mgr as well as "bootefi bootmgr". As such, We will no longer need CONFIG_EFI_BINARY_EXEC if we want to only make use of the UEFI boot manger for booting a next stage OS. Prerequisite ============ This patch set is based on top of Tom's latest "next" branch. Tests ===== * run UT efi_selftest on sandbox locally * run test_efi_bootmgr on sandbox locally Unfortunately, I could not submit a pull request for CI test. Changes ======= v3 (Dec 18, 2023) * rebased onto Tom's latest next branch * remove already-merged commits v2 (Nov 21, 2023) * rebased onto Tom's next branch * remove already merged commits * revise commit messages * add patch #5 which was split from ex-patch#5 RFC (Oct 26, 2023) [1] https://lists.denx.de/pipermail/u-boot/2023-October/534598.html AKASHI Takahiro (4): efi_loader: split unrelated code from efi_bootmgr.c efi_loader: rename BOOTEFI_BOOTMGR to EFI_BOOTMGR net: tftp: remove explicit efi configuration dependency fs: remove explicit efi configuration dependency boot/Kconfig | 4 +- boot/Makefile | 2 +- cmd/Kconfig | 10 +- cmd/efidebug.c | 4 +- fs/fs.c | 7 +- include/efi_loader.h | 28 +- lib/efi_loader/Kconfig | 11 +- lib/efi_loader/Makefile | 2 +- lib/efi_loader/efi_bootmgr.c | 493 ------------------------------ lib/efi_loader/efi_device_path.c | 3 +- lib/efi_loader/efi_helper.c | 499 ++++++++++++++++++++++++++++++- net/tftp.c | 10 +- test/boot/bootflow.c | 2 +- 13 files changed, 544 insertions(+), 531 deletions(-) -- 2.34.1

5 26

[PATCH] arm: apple: Disable SMBIOS again
by Mark Kettenis 26 Dec '23

26 Dec '23

Apple machines do not have memory below 4G. Since U-Boot does not support the SMBIOS 3 header structures this means we can't support SMBIOS on these machines. Unfortunately the refactoring of the SMBIOS code this cycle accidentally enabled it again. Fixes: 53fab13a7b1 ("efi: Use the installed SMBIOS tables") Signed-off-by: Mark Kettenis <kettenis(a)openbsd.org> --- configs/apple_m1_defconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/configs/apple_m1_defconfig b/configs/apple_m1_defconfig index d58a9030db..b868d0e319 100644 --- a/configs/apple_m1_defconfig +++ b/configs/apple_m1_defconfig @@ -21,5 +21,5 @@ CONFIG_USB_KEYBOARD=y CONFIG_SYS_WHITE_ON_BLACK=y CONFIG_NO_FB_CLEAR=y CONFIG_VIDEO_SIMPLE=y -# CONFIG_GENERATE_SMBIOS_TABLE is not set +# CONFIG_SMBIOS is not set CONFIG_LMB_MAX_REGIONS=64 -- 2.43.0

5 4

[PATCH v1] spi: npcm_pspi: Fix the wrong clock divider calculation
by Jim Liu 26 Dec '23

26 Dec '23

Fix the wrong clock divider calculation. Signed-off-by: Jim Liu <JJLIU0(a)nuvoton.com> --- drivers/spi/npcm_pspi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/spi/npcm_pspi.c b/drivers/spi/npcm_pspi.c index 37bab70967..eb14185273 100644 --- a/drivers/spi/npcm_pspi.c +++ b/drivers/spi/npcm_pspi.c @@ -144,7 +144,7 @@ static int npcm_pspi_set_speed(struct udevice *bus, uint speed) if (speed > priv->max_hz) speed = priv->max_hz; - divisor = DIV_ROUND_CLOSEST(apb_clock, (2 * speed) - 1); + divisor = DIV_ROUND_CLOSEST(apb_clock, (2 * speed)) - 1; if (divisor > MAX_DIV) divisor = MAX_DIV; -- 2.25.1

2 1

[PATCH v9 0/8] spi-nor: Add parallel and stacked memories support
by Venkatesh Yadav Abbarapu 26 Dec '23

26 Dec '23

This series adds support for Xilinx qspi parallel and stacked memeories. In parallel mode, the current implementation assumes that a maximum of two flashes are connected. The QSPI controller splits the data evenly between both the flashes so, both the flashes that are connected in parallel mode should be identical. During each operation SPI-NOR sets 0th bit for CS0 & 1st bit for CS1 in nor->flags. In stacked mode the current implementation assumes that a maximum of two flashes are connected and both the flashes are of same make but can differ in sizes. So, except the sizes all other flash parameters of both the flashes are identical. Spi-nor will pass on the appropriate flash select flag to low level driver, and it will select pass all the data to that particular flash. Write operation in parallel mode are performed in page size * 2 chunks as each write operation results in writing both the flashes. For doubling the address space each operation is performed at addr/2 flash offset, where addr is the address specified by the user. Similarly for read and erase operations it will read from both flashes, so size and offset are divided by 2 and send to flash. Changes in v2: - Fixed the compilation issues. Changes in v3: - Fixed the CI issues. Changes in v4: - Removed the dio,dummy_bytes variables from zynq_qspi driver. - Fix the compilation issue by including the DM_SPI config. Changes in v5: - Fixed the issue reported by buildman. Changes in v6: - Fixed the issues reported while running the sandbox test cases. Changes in v7: - Fixed the issues reported while running these da850evm_defconfig, imx28_xea_defconfig configs. - Fixed the issue when DM_SPI config is disabled. - Fixed the issue while running the sandbox_noinst_defconfig with spl ./spl/u-boot-spl -d arch/sandbox/dts/test.dtb jedec_spi_nor spi.bin@0: has no valid 'reg' property (-12) jedec_spi_nor spi.bin@1: has no valid 'reg' property (-12) ### ERROR ### Please RESET the board ### Changes in v8: - Fixed the compilation issue with imx28_xea_defconfig. - Fixed the SPL size issue with the axm and taurus defconfigs. - Rebased the patches on top of next branch. Changes in v9: - Updated the commit log why SPL_FIT is being enabled. Ashok Reddy Soma (4): mtd: spi-nor: Add parallel and stacked memories support mtd: spi-nor: Add parallel memories support for read_sr and read_fsr mtd: spi-nor: Add parallel and stacked memories support in read_bar and write_bar spi: spi-uclass: Read chipselect and restrict capabilities Venkatesh Yadav Abbarapu (4): spi: zynqmp_gqspi: Add parallel memories support in GQSPI driver spi: zynq_qspi: Add parallel memories support in QSPI driver config: xea: Enable the SPL_FIT config option axm/taurus: Disable the SPL_SPI config board/siemens/taurus/taurus.c | 4 +- configs/axm_defconfig | 7 +- configs/imx28_xea_defconfig | 2 +- configs/taurus_defconfig | 7 +- drivers/mtd/spi/sandbox.c | 2 +- drivers/mtd/spi/spi-nor-core.c | 398 ++++++++++++++++++++++++++++----- drivers/spi/altera_spi.c | 4 +- drivers/spi/atcspi200_spi.c | 2 +- drivers/spi/ath79_spi.c | 2 +- drivers/spi/atmel_spi.c | 6 +- drivers/spi/bcm63xx_hsspi.c | 42 ++-- drivers/spi/bcm63xx_spi.c | 6 +- drivers/spi/bcmbca_hsspi.c | 34 +-- drivers/spi/cf_spi.c | 6 +- drivers/spi/davinci_spi.c | 8 +- drivers/spi/fsl_dspi.c | 18 +- drivers/spi/fsl_espi.c | 4 +- drivers/spi/fsl_qspi.c | 4 +- drivers/spi/gxp_spi.c | 2 +- drivers/spi/mpc8xx_spi.c | 4 +- drivers/spi/mpc8xxx_spi.c | 10 +- drivers/spi/mscc_bb_spi.c | 4 +- drivers/spi/mxc_spi.c | 6 +- drivers/spi/npcm_fiu_spi.c | 14 +- drivers/spi/nxp_fspi.c | 2 +- drivers/spi/octeon_spi.c | 2 +- drivers/spi/omap3_spi.c | 4 +- drivers/spi/pic32_spi.c | 2 +- drivers/spi/rk_spi.c | 4 +- drivers/spi/rockchip_sfc.c | 2 +- drivers/spi/spi-aspeed-smc.c | 28 +-- drivers/spi/spi-mxic.c | 6 +- drivers/spi/spi-qup.c | 4 +- drivers/spi/spi-sifive.c | 6 +- drivers/spi/spi-sn-f-ospi.c | 2 +- drivers/spi/spi-sunxi.c | 6 +- drivers/spi/spi-synquacer.c | 4 +- drivers/spi/spi-uclass.c | 33 ++- drivers/spi/stm32_qspi.c | 2 +- drivers/spi/stm32_spi.c | 4 +- drivers/spi/ti_qspi.c | 14 +- drivers/spi/xilinx_spi.c | 6 +- drivers/spi/zynq_qspi.c | 119 ++++++++-- drivers/spi/zynq_spi.c | 6 +- drivers/spi/zynqmp_gqspi.c | 141 ++++++++++-- include/linux/mtd/spi-nor.h | 12 + include/spi.h | 23 +- lib/acpi/acpi_device.c | 2 +- 48 files changed, 790 insertions(+), 240 deletions(-) -- 2.25.1

2 10

Fwd: [scr1564375] your CVE ID requests
by sploitem 26 Dec '23

26 Dec '23

---------- Forwarded message --------- От: <cve-request(a)mitre.org> Date: вт, 19 дек. 2023 г. в 20:39 Subject: Re: [scr1564375] your CVE ID requests To: <sploitem(a)gmail.com> Cc: <cve-request(a)mitre.org> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 > [Suggested description] > Integer underflow in ipv6 net component when processing incoming packets. udp->udp_len is not verified before substruction leading to large number in len parameter (unsigned int). This can lead to DoS or code execution. > > ------------------------------------------ > > [Vulnerability Type] > Integer Overflow > > ------------------------------------------ > > [Vendor of Product] > U-Boot > > ------------------------------------------ > > [Affected Product Code Base] > U-boot - <= v2024.01-rc3 > > ------------------------------------------ > > [Affected Component] > u-boot/net/net6.c > > ------------------------------------------ > > [Attack Type] > Remote > > ------------------------------------------ > > [Impact Code execution] > true > > ------------------------------------------ > > [Impact Denial of Service] > true > > ------------------------------------------ > > [Attack Vectors] > Crafted ipv6 udp packet. > > ------------------------------------------ > > [Reference] > https://github.com/u-boot/u-boot/blob/master/net/net6.c#L442C18-L442C18 > > ------------------------------------------ > > [Discoverer] > sploitem This request did not receive a CVE ID assignment as CVEs are not assigned to Release Candidate (rc) versions of products. - -- CVE Assignment Team M/S M300, 202 Burlington Road, Bedford, MA 01730 USA [ A PGP key is available for encrypted communications at https://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCAAGBQJlgdSnAAoJENiPHH3233OGtbYQAKDjsoR/MIuN6txsUarIqDx9 KzoNx5MR0Ze+HIyZ3vBV1+eUJcnHfStLDaIMRNGR7497+A474X54vn8OVRTqgh+W CPQiTqx2PpJTYikxBAUrbh6uzwFHlb+iv7Dt2mqyZ4Eg+sX8X507YfyyIsWr6Npw VYiXSt53Sy9hQDski7H+Nl3keO3km5G29MdavcvNiAwH0g/a9f+NtRvQvi68X+n7 4nWRa2bzH3zChvOVJ0TRvua9ptwU+svM4wjL9vloEMO8sDO3CyFIoiGhyhseERcT Zv/NpPdqpqlKwRcvY6vW/GMGU6pVhwpIer9jrX4yolviN1d92/J9sIfJXchl5yNh fUnX0NYlBbBKH1Hy/ttOXuOBPeNgFv1VpryJvjyOxmTIpOZUhm1iiehzEGA2pFdO FUHAKmfrugVTr8Gp3HL/tQ3MN08nB64LHkowD+j0+XGN1EEIurWSnwRwdXmEn26Y MSkGbXzT0GiibnkhwpdRxcZW4p33NC+idNBZtb4K8TIcdUdh2P4ZzeyTMYmxMKgp WVHxxKvLEom+E17SAb996Wesia4+gRo+2wK4cXCtnEn7nqz59y1mqBf1uALeTDLG D2/9N3nqGYZEu8WeMjSNYPmUvLMHKvffj9Z81+dBSq/IngZMYuXr6m+UGTce66N1 jmb+4NApCJi3mhF4dUK6 =T698 -----END PGP SIGNATURE-----

2 1

[PATHv2 0/9] net fixes prior lwip
by Maxim Uvarov 26 Dec '23

26 Dec '23

Add small net fixes prior lwip patches. v2: - rebase on the top of master tree with descriptions fixes suggested in review comments. Maxim Uvarov (9): test_net: print out net list net: sandbox: fix NULL pointer derefences net/smc911x: fix return from smc911x_send sandbox: eth-raw-os: successful return code is 0 driver/net/rtl8139: remove debug print mach-socfpga: do not overlap defines with lwip bcm_ns3: use device specific naming for variables omap3: use device specific naming for mem_init Makefile: add dtbs to clean Makefile | 3 ++- arch/arm/include/asm/arch-omap3/mem.h | 2 +- arch/arm/mach-omap2/omap3/board.c | 2 +- arch/arm/mach-omap2/omap3/emif4.c | 4 ++-- arch/arm/mach-omap2/omap3/sdrc.c | 6 +++--- arch/arm/mach-socfpga/include/mach/handoff_soc64.h | 6 ------ arch/arm/mach-socfpga/wrap_handoff_soc64.c | 9 +++++++++ arch/sandbox/cpu/eth-raw-os.c | 2 +- drivers/net/rtl8139.c | 2 +- drivers/net/sandbox.c | 3 +++ drivers/net/smc911x.c | 2 +- include/configs/bcm_ns3.h | 6 +++--- test/py/tests/test_net.py | 2 ++ 13 files changed, 29 insertions(+), 20 deletions(-) -- 2.30.2

4 23

CVE-2019-14194 patch bypass
by sploit em 26 Dec '23

26 Dec '23

Hello. I was analyzing CVE-2019-14194 and I think the patch can be bypassed. patch <https://source.denx.de/u-boot/u-boot/-/commit/aa207cf3a6d68f39d64cd29057a4f…> In nfs_read_reply, rlen is signed int. So we can make it less than zero. The value less than zero can bypass the check at line 756. This will lead to overflow due that assign has an unsigned int len parameter. For example -1 will become 0xffffffff. [image: nfs_read_reply_cve_2019_14194.png] I've constructed some code to prove this. [image: nfs_read_reply_cve_2019_14194_bypass.png] [image: nfs_read_reply_cve_2019_14194_3.png] Thanks.

2 1

[PATCH v8 0/8] spi-nor: Add parallel and stacked memories support
by Venkatesh Yadav Abbarapu 26 Dec '23

26 Dec '23

This series adds support for Xilinx qspi parallel and stacked memeories. In parallel mode, the current implementation assumes that a maximum of two flashes are connected. The QSPI controller splits the data evenly between both the flashes so, both the flashes that are connected in parallel mode should be identical. During each operation SPI-NOR sets 0th bit for CS0 & 1st bit for CS1 in nor->flags. In stacked mode the current implementation assumes that a maximum of two flashes are connected and both the flashes are of same make but can differ in sizes. So, except the sizes all other flash parameters of both the flashes are identical. Spi-nor will pass on the appropriate flash select flag to low level driver, and it will select pass all the data to that particular flash. Write operation in parallel mode are performed in page size * 2 chunks as each write operation results in writing both the flashes. For doubling the address space each operation is performed at addr/2 flash offset, where addr is the address specified by the user. Similarly for read and erase operations it will read from both flashes, so size and offset are divided by 2 and send to flash. Changes in v2: - Fixed the compilation issues. Changes in v3: - Fixed the CI issues. Changes in v4: - Removed the dio,dummy_bytes variables from zynq_qspi driver. - Fix the compilation issue by including the DM_SPI config. Changes in v5: - Fixed the issue reported by buildman. Changes in v6: - Fixed the issues reported while running the sandbox test cases. Changes in v7: - Fixed the issues reported while running these da850evm_defconfig, imx28_xea_defconfig configs. - Fixed the issue when DM_SPI config is disabled. - Fixed the issue while running the sandbox_noinst_defconfig with spl ./spl/u-boot-spl -d arch/sandbox/dts/test.dtb jedec_spi_nor spi.bin@0: has no valid 'reg' property (-12) jedec_spi_nor spi.bin@1: has no valid 'reg' property (-12) ### ERROR ### Please RESET the board ### Changes in v8: - Fixed the compilation issue with imx28_xea_defconfig. - Fixed the SPL size issue with the axm and taurus defconfigs. - Rebased the patches on top of next branch. Ashok Reddy Soma (4): mtd: spi-nor: Add parallel and stacked memories support mtd: spi-nor: Add parallel memories support for read_sr and read_fsr mtd: spi-nor: Add parallel and stacked memories support in read_bar and write_bar spi: spi-uclass: Read chipselect and restrict capabilities Venkatesh Yadav Abbarapu (4): spi: zynqmp_gqspi: Add parallel memories support in GQSPI driver spi: zynq_qspi: Add parallel memories support in QSPI driver config: xea: Enable the SPL_FIT config option axm/taurus: Disable the SPL_SPI config board/siemens/taurus/taurus.c | 4 +- configs/axm_defconfig | 7 +- configs/imx28_xea_defconfig | 2 +- configs/taurus_defconfig | 7 +- drivers/mtd/spi/sandbox.c | 2 +- drivers/mtd/spi/spi-nor-core.c | 398 ++++++++++++++++++++++++++++----- drivers/spi/altera_spi.c | 4 +- drivers/spi/atcspi200_spi.c | 2 +- drivers/spi/ath79_spi.c | 2 +- drivers/spi/atmel_spi.c | 6 +- drivers/spi/bcm63xx_hsspi.c | 42 ++-- drivers/spi/bcm63xx_spi.c | 6 +- drivers/spi/bcmbca_hsspi.c | 34 +-- drivers/spi/cf_spi.c | 6 +- drivers/spi/davinci_spi.c | 8 +- drivers/spi/fsl_dspi.c | 18 +- drivers/spi/fsl_espi.c | 4 +- drivers/spi/fsl_qspi.c | 4 +- drivers/spi/gxp_spi.c | 2 +- drivers/spi/mpc8xx_spi.c | 4 +- drivers/spi/mpc8xxx_spi.c | 10 +- drivers/spi/mscc_bb_spi.c | 4 +- drivers/spi/mxc_spi.c | 6 +- drivers/spi/npcm_fiu_spi.c | 14 +- drivers/spi/nxp_fspi.c | 2 +- drivers/spi/octeon_spi.c | 2 +- drivers/spi/omap3_spi.c | 4 +- drivers/spi/pic32_spi.c | 2 +- drivers/spi/rk_spi.c | 4 +- drivers/spi/rockchip_sfc.c | 2 +- drivers/spi/spi-aspeed-smc.c | 28 +-- drivers/spi/spi-mxic.c | 6 +- drivers/spi/spi-qup.c | 4 +- drivers/spi/spi-sifive.c | 6 +- drivers/spi/spi-sn-f-ospi.c | 2 +- drivers/spi/spi-sunxi.c | 6 +- drivers/spi/spi-synquacer.c | 4 +- drivers/spi/spi-uclass.c | 33 ++- drivers/spi/stm32_qspi.c | 2 +- drivers/spi/stm32_spi.c | 4 +- drivers/spi/ti_qspi.c | 14 +- drivers/spi/xilinx_spi.c | 6 +- drivers/spi/zynq_qspi.c | 119 ++++++++-- drivers/spi/zynq_spi.c | 6 +- drivers/spi/zynqmp_gqspi.c | 141 ++++++++++-- include/linux/mtd/spi-nor.h | 12 + include/spi.h | 23 +- lib/acpi/acpi_device.c | 2 +- 48 files changed, 790 insertions(+), 240 deletions(-) -- 2.25.1

2 9

[PATCH v2 1/1] lib: smbios: verify_checksum() is duplicate
by Heinrich Schuchardt 26 Dec '23

26 Dec '23

The function verify_checksum() duplicates what table_compute_checksum() does. Replace it. table_compute_checksum() is always compiled. Fixes: 415eab0655a8 ("smbios: add parsing API") Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt(a)canonical.com> Reviewed-by: Simon Glass <sjg(a)chromium.org> --- v2: mention that table_compute_checksum() is always compiled --- lib/smbios-parser.c | 18 ++---------------- 1 file changed, 2 insertions(+), 16 deletions(-) diff --git a/lib/smbios-parser.c b/lib/smbios-parser.c index b578c30840..110670343d 100644 --- a/lib/smbios-parser.c +++ b/lib/smbios-parser.c @@ -5,23 +5,9 @@ #define LOG_CATEGORY LOGC_BOOT +#include <tables_csum.h> #include <smbios.h> -static inline int verify_checksum(const struct smbios_entry *e) -{ - /* - * Checksums for SMBIOS tables are calculated to have a value, so that - * the sum over all bytes yields zero (using unsigned 8 bit arithmetic). - */ - u8 *byte = (u8 *)e; - u8 sum = 0; - - for (int i = 0; i < e->length; i++) - sum += byte[i]; - - return sum; -} - const struct smbios_entry *smbios_entry(u64 address, u32 size) { const struct smbios_entry *entry = (struct smbios_entry *)(uintptr_t)address; @@ -32,7 +18,7 @@ const struct smbios_entry *smbios_entry(u64 address, u32 size) if (memcmp(entry->anchor, "_SM_", 4)) return NULL; - if (verify_checksum(entry)) + if (table_compute_checksum(entry, entry->length)) return NULL; return entry; -- 2.43.0

1 0