From: Gabe Black gabeblack@chromium.org

It may be necessary to know where the TLB area ends as well as where it starts. This allows board code to complete a secure memory erase without destroying the page tables.

Signed-off-by: Gabe Black gabeblack@google.com Signed-off-by: Simon Glass sjg@chromium.org --- Changes in v2: None

arch/arm/include/asm/global_data.h | 1 + arch/arm/lib/board.c | 5 +++-- 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/arch/arm/include/asm/global_data.h b/arch/arm/include/asm/global_data.h index 2b9af93..41a26ed 100644 --- a/arch/arm/include/asm/global_data.h +++ b/arch/arm/include/asm/global_data.h @@ -73,6 +73,7 @@ typedef struct global_data { unsigned long reloc_off; #if !(defined(CONFIG_SYS_ICACHE_OFF) && defined(CONFIG_SYS_DCACHE_OFF)) unsigned long tlb_addr; + unsigned long tlb_size; #endif const void *fdt_blob; /* Our device tree, NULL if none */ void **jt; /* jump table */ diff --git a/arch/arm/lib/board.c b/arch/arm/lib/board.c index 22a4d9c..e03fc6d 100644 --- a/arch/arm/lib/board.c +++ b/arch/arm/lib/board.c @@ -353,13 +353,14 @@ void board_init_f(ulong bootflag)

#if !(defined(CONFIG_SYS_ICACHE_OFF) && defined(CONFIG_SYS_DCACHE_OFF)) /* reserve TLB table */ - addr -= (4096 * 4); + gd->tlb_size = 4096 * 4; + addr -= gd->tlb_size;

/* round down to next 64 kB limit */ addr &= ~(0x10000 - 1);

gd->tlb_addr = addr; - debug("TLB table at: %08lx\n", addr); + debug("TLB table from %08lx to %08lx\n", addr, addr + gd->tlb_size); #endif

/* round down to next 4 kB limit */

This option delays loading of the environment until later, so that only the default environment will be available to U-Boot.

This can address the security risk of untrusted data being used during boot.

Any time you load untrusted data you expose yourself to a bug in the code. The attacker gets to choose the data so can sometimes carefully craft it to exploit a bug. We try to avoid touching user-controlled data during a verified boot unless strictly necessary. Since the default environment is good enough in this case (or you would just change it), this gets around the problem by just not loading the environment.

When CONFIG_DELAY_ENVIRONMENT is defined, it is convenient to have a run-time way of enabling loading of the environment. Add this to the fdt as /config/delay-environment.

Note: This patch depends on http://patchwork.ozlabs.org/patch/194342/

Signed-off-by: Doug Anderson dianders@chromium.org Signed-off-by: Simon Glass sjg@chromium.org --- Changes in v2: - Update commit message to provide more detail

README | 9 +++++++++ arch/arm/lib/board.c | 29 +++++++++++++++++++++++++++-- 2 files changed, 36 insertions(+), 2 deletions(-)

diff --git a/README b/README index b9a3685..d26ce5b 100644 --- a/README +++ b/README @@ -2329,6 +2329,15 @@ CBFS (Coreboot Filesystem) support run-time determined information about the hardware to the environment. These will be named board_name, board_rev.

+ CONFIG_DELAY_ENVIRONMENT + + Normally the environment is loaded when the board is + intialised so that it is available to U-Boot. This inhibits + that so that the environment is not available until + explicitly loaded later by U-Boot code. With CONFIG_OF_CONTROL + this is instead controlled by the value of + /config/load-environment. + - DataFlash Support: CONFIG_HAS_DATAFLASH

diff --git a/arch/arm/lib/board.c b/arch/arm/lib/board.c index 262a3ca..7d1927e 100644 --- a/arch/arm/lib/board.c +++ b/arch/arm/lib/board.c @@ -40,6 +40,7 @@

#include <common.h> #include <command.h> +#include <environment.h> #include <malloc.h> #include <stdio_dev.h> #include <version.h> @@ -476,7 +477,28 @@ static char *failed = "*** failed ***\n"; #endif

/* - ************************************************************************ + * Tell if it's OK to load the environment early in boot. + * + * If CONFIG_OF_CONFIG is defined, we'll check with the FDT to see + * if this is OK (defaulting to saying it's not OK). + * + * NOTE: Loading the environment early can be a bad idea if security is + * important, since no verification is done on the environment. + * + * @return 0 if environment should not be loaded, !=0 if it is ok to load + */ +static int should_load_env(void) +{ +#ifdef CONFIG_OF_CONTROL + return fdtdec_get_config_int(gd->fdt_blob, "load-environment", 0); +#elif defined CONFIG_DELAY_ENVIRONMENT + return 0; +#else + return 1; +#endif +} + +/************************************************************************ * * This is the next part if the initialization sequence: we are now * running from RAM and have a "normal" C environment, i. e. global @@ -583,7 +605,10 @@ void board_init_r(gd_t *id, ulong dest_addr) #endif

/* initialize environment */ - env_relocate(); + if (should_load_env()) + env_relocate(); + else + set_default_env(NULL);

#if defined(CONFIG_CMD_PCI) || defined(CONFIG_PCI) arm_pci_init();

Add a short note about this in the README.

Signed-off-by: Simon Glass sjg@chromium.org --- Changes in v2: - Split out CONFIG_DISPLAY_BOARDINFO README change into separate commit

README | 5 +++++ 1 files changed, 5 insertions(+), 0 deletions(-)

diff --git a/README b/README index d26ce5b..d8bd784 100644 --- a/README +++ b/README @@ -3351,6 +3351,11 @@ use the "saveenv" command to store a valid environment. space for already greatly restricted images, including but not limited to NAND_SPL configurations.

+- CONFIG_DISPLAY_BOARDINFO + Display information about the board that U-Boot is running on + when U-Boot starts up. The board function checkboard() is called + to do this. + Low Level (hardware related) configuration options: ---------------------------------------------------

Some boards want to report more than just memory size. For example, it might be useful to display the memory type (DDR2, DDR3) or manufacturer.

Add a weak function to support this requirement, accessed through a new 'meminfo' command.

Any example of the DRAM: output is below, just for illustration:

SMDK5250 # meminfo DRAM: 2 GiB Elpida DDR3 @ 800MHz

Signed-off-by: Simon Glass sjg@chromium.org --- Changes in v2: - Rewrite customised memory info patch to use a command

README | 1 + common/cmd_mem.c | 27 +++++++++++++++++++++++++++ include/common.h | 9 +++++++++ include/config_cmd_all.h | 1 + 4 files changed, 38 insertions(+), 0 deletions(-)

diff --git a/README b/README index 36853e5..200edf8 100644 --- a/README +++ b/README @@ -840,6 +840,7 @@ The following options need to be configured: CONFIG_CMD_LOADS loads CONFIG_CMD_MD5SUM print md5 message digest (requires CONFIG_CMD_MEMORY and CONFIG_MD5) + CONFIG_CMD_MEMINFO * Display detailed memory information CONFIG_CMD_MEMORY md, mm, nm, mw, cp, cmp, crc, base, loop, loopw, mtest CONFIG_CMD_MISC Misc functions like sleep etc diff --git a/common/cmd_mem.c b/common/cmd_mem.c index 4d64cff..0f3ffc8 100644 --- a/common/cmd_mem.c +++ b/common/cmd_mem.c @@ -33,6 +33,9 @@ #include <dataflash.h> #endif #include <watchdog.h> +#include <linux/compiler.h> + +DECLARE_GLOBAL_DATA_PTR;

static int mod_mem(cmd_tbl_t *, int, int, int, char * const []);

@@ -1203,6 +1206,22 @@ U_BOOT_CMD(

#endif

+#ifdef CONFIG_CMD_MEMINFO +__weak void board_show_dram(ulong size) +{ + puts("DRAM: "); + print_size(size, "\n"); +} + +static int do_mem_info(cmd_tbl_t *cmdtp, int flag, int argc, + char * const argv[]) +{ + board_show_dram(gd->ram_size); + + return 0; +} +#endif + U_BOOT_CMD( base, 2, 1, do_mem_base, "print or set address offset", @@ -1243,3 +1262,11 @@ U_BOOT_CMD( "[.b, .w, .l] address value delay(ms)" ); #endif /* CONFIG_MX_CYCLIC */ + +#ifdef CONFIG_CMD_MEMINFO +U_BOOT_CMD( + meminfo, 3, 1, do_mem_info, + "display memory information", + "" +); +#endif diff --git a/include/common.h b/include/common.h index 5e3c5ee..a1ab4f0 100644 --- a/include/common.h +++ b/include/common.h @@ -311,6 +311,15 @@ int mac_read_from_eeprom(void); extern u8 _binary_dt_dtb_start[]; /* embedded device tree blob */ int set_cpu_clk_info(void);

+/** + * Show the DRAM size in a board-specific way + * + * This is used by boards to display DRAM information in their own way. + * + * @param size Size of DRAM (which should be displayed along with other info) + */ +void board_show_dram(ulong size); + /* common/flash.c */ void flash_perror (int);

diff --git a/include/config_cmd_all.h b/include/config_cmd_all.h index f434cd0..eadc8b7 100644 --- a/include/config_cmd_all.h +++ b/include/config_cmd_all.h @@ -53,6 +53,7 @@ #define CONFIG_CMD_LICENSE /* console license display */ #define CONFIG_CMD_LOADB /* loadb */ #define CONFIG_CMD_LOADS /* loads */ +#define CONFIG_CMD_MEMINFO /* meminfo */ #define CONFIG_CMD_MEMORY /* md mm nm mw cp cmp crc base loop mtest */ #define CONFIG_CMD_MFSL /* FSL support for Microblaze */ #define CONFIG_CMD_MII /* MII support */

The timer may be inited in arch_cpu_init() so it is not safe to make a bootstage mark before this is called. Arrange the code to fix this.

Note: The question was raised as to why we don't keep all archs in sync. PowerPC doesn't have specific bootstage markers at present (although it does use boot progress). I hope that the generic board series will solve this problem in general, but in the meantime this is a real problem, and only in ARM.

We now get a correct time for board_init_f:

Timer summary in microseconds: Mark Elapsed Stage 0 0 reset 100,000 100,000 spl_start 848,530 748,530 board_init_f 907,301 58,771 board_init_r 910,478 3,177 board_init

Signed-off-by: Simon Glass sjg@chromium.org --- Changes in v2: - Rebase to master - Update commit message

arch/arm/lib/board.c | 11 +++++++++-- 1 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/arch/arm/lib/board.c b/arch/arm/lib/board.c index 1d563bb..0410dae 100644 --- a/arch/arm/lib/board.c +++ b/arch/arm/lib/board.c @@ -232,8 +232,17 @@ int __power_init_board(void) int power_init_board(void) __attribute__((weak, alias("__power_init_board")));

+ /* Record the board_init_f() bootstage (after arch_cpu_init()) */ +static int mark_bootstage(void) +{ + bootstage_mark_name(BOOTSTAGE_ID_START_UBOOT_F, "board_init_f"); + + return 0; +} + init_fnc_t *init_sequence[] = { arch_cpu_init, /* basic arch cpu dependent setup */ + mark_bootstage, #ifdef CONFIG_OF_CONTROL fdtdec_check_fdt, #endif @@ -277,8 +286,6 @@ void board_init_f(ulong bootflag) void *new_fdt = NULL; size_t fdt_size = 0;

- bootstage_mark_name(BOOTSTAGE_ID_START_UBOOT_F, "board_init_f"); - /* Pointer is writable since we allocated a register for it */ gd = (gd_t *) ((CONFIG_SYS_INIT_SP_ADDR) & ~0x07); /* compiler optimization barrier needed for GCC >= 3.4 */

Hi Simon,

On Fri, 30 Nov 2012 15:01:14 -0800, Simon Glass sjg@chromium.org wrote:

From: Arun Mankuzhi arun.m@samsung.com

In Cortex-A15 architecture, when we run cache invalidate the cache clean operation executes automatically. So if there are any dirty cache lines before disabling the L2 cache these will be synchronized with the main memory when invalidate_dcache_all() runs in the last part of U-boot

The two functions after flush_dcache_all is using the stack. So this data will be on the cache. After disable when invalidate is called the data will be flushed from cache to memory. This corrupts the stack in invalida_dcache_all. So this change is required to avoid the u-boot hang.

So flush has to be done just before clearing CR_C bit

Signed-off-by: Arun Mankuzhi arun.m@samsung.com Signed-off-by: Simon Glass sjg@chromium.org

---

Changes in v2: None

arch/arm/lib/cache-cp15.c | 5 ++++- 1 files changed, 4 insertions(+), 1 deletions(-)

diff --git a/arch/arm/lib/cache-cp15.c b/arch/arm/lib/cache-cp15.c index 939de10..06119c8 100644 --- a/arch/arm/lib/cache-cp15.c +++ b/arch/arm/lib/cache-cp15.c @@ -124,8 +124,11 @@ static void cache_disable(uint32_t cache_bit) return; /* if disabling data cache, disable mmu too */ cache_bit |= CR_M;

• flush_dcache_all();
  

  }

• reg = get_cr();
• cp_delay();
• if (cache_bit == (CR_C | CR_M))

• flush_dcache_all();
  

  set_cr(reg & ~cache_bit);

} #endif

Applied the whole series to u-boot-arm/master, thanks!

Amicalement,