platform/kernel/u-boot.git
2 years agomicroblaze: cache: split flush_cache() function
Ovidiu Panait [Tue, 31 May 2022 18:14:28 +0000 (21:14 +0300)]
microblaze: cache: split flush_cache() function

Factor out icache/dcache components from flush_cache() function. Call the
newly added __flush_icache()/__flush_dcache() functions inside
icache_disable() and dcache_disable(), respectively. There is no need to
flush both caches when disabling a particular cache type.

Signed-off-by: Ovidiu Panait <ovpanait@gmail.com>
Link: https://lore.kernel.org/r/20220531181435.3473549-7-ovpanait@gmail.com
Signed-off-by: Michal Simek <michal.simek@amd.com>
2 years agomicroblaze: cache: improve icache Kconfig options
Ovidiu Panait [Tue, 31 May 2022 18:14:27 +0000 (21:14 +0300)]
microblaze: cache: improve icache Kconfig options

Replace CONFIG_ICACHE with a Kconfig option more limited in scope -
XILINX_MICROBLAZE0_USE_WIC. It should be enabled if the processor supports
the "wic" (Write to Instruction Cache) instruction. It will be used to
guard "wic" invocations in microblaze cache code.

Signed-off-by: Ovidiu Panait <ovpanait@gmail.com>
Link: https://lore.kernel.org/r/20220531181435.3473549-6-ovpanait@gmail.com
Signed-off-by: Michal Simek <michal.simek@amd.com>
2 years agomicroblaze: cache: improve dcache Kconfig options
Ovidiu Panait [Tue, 31 May 2022 18:14:26 +0000 (21:14 +0300)]
microblaze: cache: improve dcache Kconfig options

Replace CONFIG_DCACHE with a Kconfig option more limited in scope -
XILINX_MICROBLAZE0_USE_WDC. It should be enabled if the processor supports
the "wdc" (Write to Data Cache) instruction. It will be used to guard
"wdc" invocations in microblaze cache code.

Also, drop all ifdefs around flush_cache() calls and only keep one
CONFIG_IS_ENABLED() guard within flush_cache() itself.

Signed-off-by: Ovidiu Panait <ovpanait@gmail.com>
Link: https://lore.kernel.org/r/20220531181435.3473549-5-ovpanait@gmail.com
Signed-off-by: Michal Simek <michal.simek@amd.com>
2 years agomicroblaze: cache: replace XILINX_USE_DCACHE -> CONFIG_DCACHE
Ovidiu Panait [Tue, 31 May 2022 18:14:25 +0000 (21:14 +0300)]
microblaze: cache: replace XILINX_USE_DCACHE -> CONFIG_DCACHE

XILINX_USE_DCACHE macro was removed in 7556fa09e0e ("microblaze: Simplify
cache handling"), but it was still used in a couple of places.

Replace those occurences with CONFIG_DCACHE.

Signed-off-by: Ovidiu Panait <ovpanait@gmail.com>
Link: https://lore.kernel.org/r/20220531181435.3473549-4-ovpanait@gmail.com
Signed-off-by: Michal Simek <michal.simek@amd.com>
2 years agomicroblaze: start.S: remove unused code
Ovidiu Panait [Tue, 31 May 2022 18:14:24 +0000 (21:14 +0300)]
microblaze: start.S: remove unused code

in16/out16 routines seem to not be used anywhere in microblaze code, so
remove them.

Signed-off-by: Ovidiu Panait <ovpanait@gmail.com>
Link: https://lore.kernel.org/r/20220531181435.3473549-3-ovpanait@gmail.com
Signed-off-by: Michal Simek <michal.simek@amd.com>
2 years agocpu-uclass: relocate ops pointers for CONFIG_NEEDS_MANUAL_RELOC
Ovidiu Panait [Tue, 31 May 2022 18:14:23 +0000 (21:14 +0300)]
cpu-uclass: relocate ops pointers for CONFIG_NEEDS_MANUAL_RELOC

Relocate cpu_ops pointers when CONFIG_NEEDS_MANUAL_RELOC is enabled.

The (gd->flags & GD_FLG_RELOC) check was added to make sure the reloc_done
logic works for drivers that use DM_FLAG_PRE_RELOC.

Signed-off-by: Ovidiu Panait <ovpanait@gmail.com>
Link: https://lore.kernel.org/r/20220531181435.3473549-2-ovpanait@gmail.com
Signed-off-by: Michal Simek <michal.simek@amd.com>
2 years agocmd: cpu: migrate cpu command to U_BOOT_CMD_WITH_SUBCMDS()
Ovidiu Panait [Tue, 31 May 2022 18:14:22 +0000 (21:14 +0300)]
cmd: cpu: migrate cpu command to U_BOOT_CMD_WITH_SUBCMDS()

Migrate cpu command to use U_BOOT_CMD_WITH_SUBCMDS() helper macro, to
reduce duplicated code. This also fixes the cpu command on boards that
enable CONFIG_NEEDS_MANUAL_RELOC.

Signed-off-by: Ovidiu Panait <ovpanait@gmail.com>
Link: https://lore.kernel.org/r/20220531181435.3473549-1-ovpanait@gmail.com
Signed-off-by: Michal Simek <michal.simek@amd.com>
2 years agomicroblaze: Add support for run time relocation
Michal Simek [Fri, 24 Jun 2022 12:15:01 +0000 (14:15 +0200)]
microblaze: Add support for run time relocation

Microblaze is using NEEDS_MANUAL_RELOC from the beginnging. This is causing
issues with function pointer arrays which need to be updated manually after
relocation. Building code with -fPIC and linking with -pic will remove this
limitation and there is no longer need to run manual update.

By default still old option is enabled but by disabling NEEDS_MANUAL_RELOC
code will be compiled for full relocation.

The patch does couple of things which are connected to each other.
- Define STATIC_RELA dependency to call relocate-rela to fill sections.
- REMAKE_ELF was already enabled but u-boot file can't be used because
  sections are empty. relocate-rela will fill them and output file is
  u-boot.elf which should be used.
- Add support for full relocation (u-boot.elf)
- Add support for early relocation when u-boot.bin is loaded to different
  address then CONFIG_SYS_TEXT_BASE
- Add rela.dyn and dynsym sections

Disabling NEEDS_MANUAL_RELOC U-Boot size increased by 10% of it's original
size (550kB to 608kB).

Signed-off-by: Michal Simek <michal.simek@amd.com>
Link: https://lore.kernel.org/r/a845670b34925859b2e321875f7588a29f6655f9.1655299267.git.michal.simek@amd.com
2 years agotools: relocate-rela: Add support for 32bit Microblaze relocation
Michal Simek [Fri, 24 Jun 2022 12:15:00 +0000 (14:15 +0200)]
tools: relocate-rela: Add support for 32bit Microblaze relocation

Microblaze is 32bit that's why it is using elf32 format. Relocation code
requires to get information about rela and dynsym senctions and also text
base which was used for compilation.
Code build with -fPIC and linked with -pic generates 4 relocation types.
R_MICROBLAZE_NONE is the easiest one which doesn't require any action.
R_MICROBLAZE_REL only requires write addend to r_offset address.
R_MICROBLAZE_32/R_MICROBLAZE_GLOB_DAT are the most complicated. There is a
need to find out symbol value with adding symbol value and write it to
address pointed by r_offset. Calculation with addend is also added but
only 0 addend values are generated now.

Signed-off-by: Michal Simek <michal.simek@amd.com>
Link: https://lore.kernel.org/r/9912c3d76933bdf75e1ebb6aab43726cd32cafb5.1655299267.git.michal.simek@amd.com
2 years agotools: relocate-rela: Add support for elf32 decoding
Michal Simek [Fri, 24 Jun 2022 12:15:00 +0000 (14:15 +0200)]
tools: relocate-rela: Add support for elf32 decoding

Add support for 32bit ELF format which is used by Microblaze. Also check
that code runs only for Microblaze.

Function finds information about rela.dyn and dynsym which will be used
later for relocation.

Signed-off-by: Michal Simek <michal.simek@amd.com>
Link: https://lore.kernel.org/r/7491cc72fe04cbd48db014f1492ce463e91dfb42.1655299267.git.michal.simek@amd.com
2 years agotools: relocate-rela: Check that relocation works only for EM_AARCH64
Michal Simek [Fri, 24 Jun 2022 12:15:00 +0000 (14:15 +0200)]
tools: relocate-rela: Check that relocation works only for EM_AARCH64

Relocation support is only for EM_AARCH64 that's why check machine type to
make sure that the code will never run on any unsupported one.

Signed-off-by: Michal Simek <michal.simek@amd.com>
Link: https://lore.kernel.org/r/36f26c8752335239344b265e5ddedad10e9cac8b.1655299267.git.michal.simek@amd.com
2 years agotools: relocate-rela: Extract elf64 reloc to special function
Michal Simek [Fri, 24 Jun 2022 12:15:00 +0000 (14:15 +0200)]
tools: relocate-rela: Extract elf64 reloc to special function

Adding support for new type requires to change code layout that's why move
elf64 code to own function for easier maintenance.

It also solves the problem with not calling fclose in case of error.
Return value from rela_elf64 is saved to variable that's why fclose() is
called all the time.

Signed-off-by: Michal Simek <michal.simek@amd.com>
Link: https://lore.kernel.org/r/21763b80527521c85ca7d4ac64ad6ff4885409c8.1655299267.git.michal.simek@amd.com
2 years agomicroblaze: Create SYM_ADDR macro to deal with symbols
Michal Simek [Fri, 24 Jun 2022 12:15:00 +0000 (14:15 +0200)]
microblaze: Create SYM_ADDR macro to deal with symbols

Symbol handling depends on compilation flags. Right now manual relocation
is used that's why symbols can be referenced just by name and there is no
need to find them out. But when position independent code (PIC) is used
symbols need to be described differently. That's why having one macro
change is easier than changing the whole code.

Signed-off-by: Michal Simek <michal.simek@amd.com>
Link: https://lore.kernel.org/r/d704e9a267c8b536452fb999111dbfbc9d652be5.1655299267.git.michal.simek@amd.com
2 years agomicroblaze: Add comment about reset location
Michal Simek [Fri, 24 Jun 2022 12:15:00 +0000 (14:15 +0200)]
microblaze: Add comment about reset location

Better to add comment to explain why reset vector points all the time to
origin U-Boot location.
If reset happens U-Boot should start from it's origin location.

Signed-off-by: Michal Simek <michal.simek@amd.com>
Link: https://lore.kernel.org/r/5ca6341b7487708247fe2948d7e496ea6f7c2e02.1655299267.git.michal.simek@amd.com
2 years agomicroblaze: Remove _start symbol handling at U-Boot start
Michal Simek [Fri, 24 Jun 2022 12:15:00 +0000 (14:15 +0200)]
microblaze: Remove _start symbol handling at U-Boot start

Right now U-Boot runs all the time from the same address where it is loaded
but going to full relocation code starting address doesn't need to be fixed
and can be simply discovered from reading PC register. That's why use r20
to get PC address and subtract offset from the beginning to get starting
address.

Signed-off-by: Michal Simek <michal.simek@amd.com>
Link: https://lore.kernel.org/r/044b727c33dfbe662f68512d0da0775a4805f360.1655299267.git.michal.simek@amd.com
2 years agomicroblaze: Remove code around r20 in relocate_code()
Michal Simek [Fri, 24 Jun 2022 12:15:00 +0000 (14:15 +0200)]
microblaze: Remove code around r20 in relocate_code()

r20 is not used that's why remove logic around it.

Signed-off-by: Michal Simek <michal.simek@amd.com>
Link: https://lore.kernel.org/r/1b32bab5c050d099b2f6d49bc4896322ed03d788.1655299267.git.michal.simek@amd.com
2 years agomicroblaze: Optimize register usage in relocate_code
Michal Simek [Fri, 24 Jun 2022 12:15:00 +0000 (14:15 +0200)]
microblaze: Optimize register usage in relocate_code

There are additional operations which can be done simpler that's why
improve logic around relocation address r7 handling and _start symbol.

Signed-off-by: Michal Simek <michal.simek@amd.com>
Link: https://lore.kernel.org/r/c8b60f72f1605c2ba6b4b7be1893d7e6ec3d8597.1655299267.git.michal.simek@amd.com
2 years agomicroblaze: Change stack protection address to new stack address
Michal Simek [Fri, 24 Jun 2022 12:15:00 +0000 (14:15 +0200)]
microblaze: Change stack protection address to new stack address

SLR low address is still setup to 0 that's why only high limit should be
updated. STACK_SIZE macro is present and could be possible used for
low address alignment but it is not done by this patch.

Signed-off-by: Michal Simek <michal.simek@amd.com>
Link: https://lore.kernel.org/r/c00cb843df848703b760a65934ed3ce31fafcf19.1655299267.git.michal.simek@amd.com
2 years agomicroblaze: Separate code end substraction
Michal Simek [Fri, 24 Jun 2022 12:15:00 +0000 (14:15 +0200)]
microblaze: Separate code end substraction

Follow up patch will convert symbol handling that's why it is necessary to
separate logic around symbols to special instruction. It adds 4B for new
instruction but it is worth to do it to have code ready for for full
relocation.

Signed-off-by: Michal Simek <michal.simek@amd.com>
Link: https://lore.kernel.org/r/030863fa9a9c1ca0a9b082fe498522da09189fbc.1655299267.git.michal.simek@amd.com
2 years agomicroblaze: Enable REMAKE_ELF
Michal Simek [Fri, 24 Jun 2022 12:14:59 +0000 (14:14 +0200)]
microblaze: Enable REMAKE_ELF

Enable u-boot.elf recreation from u-boot.bin to prepare for removing manul
relocation. Enable option for big endian configuration but it is not used
too much that's why it is completely untested.
By supporting this system there is a need to define LITTLE/BIG endian
Kconfig options to pass -EL/-EB flags.

Full command line for u-boot.elf recreation looks like this:
microblazeel-xilinx-linux-gnu-objcopy -I binary -B microblaze \
 -O elf32-microblazeel u-boot.bin u-boot-elf.o

Signed-off-by: Michal Simek <michal.simek@amd.com>
Link: https://lore.kernel.org/r/7e242a519fcd1c693b9103c5599b515af555ca43.1655299267.git.michal.simek@amd.com
2 years agomips: Move endianness selection to arch/Kconfig
Michal Simek [Fri, 24 Jun 2022 12:14:59 +0000 (14:14 +0200)]
mips: Move endianness selection to arch/Kconfig

This option will be used by Microblaze that's why move it to generic
location to be able to use it.

Signed-off-by: Michal Simek <michal.simek@amd.com>
Link: https://lore.kernel.org/r/ceb39fa615cb5657b66a7b77bab99e86ca7a3346.1655299267.git.michal.simek@amd.com
2 years agomicroblaze: Fix typo in exception.c
Michal Simek [Fri, 24 Jun 2022 12:14:59 +0000 (14:14 +0200)]
microblaze: Fix typo in exception.c

Trivial fix.

Signed-off-by: Michal Simek <michal.simek@amd.com>
Link: https://lore.kernel.org/r/c4ede6dc738c5bd7c518f3bb2c9410b15c102e20.1655299267.git.michal.simek@amd.com
2 years agomicroblaze: Remove CONFIG_TEXT_BASE from code
Michal Simek [Fri, 24 Jun 2022 12:14:59 +0000 (14:14 +0200)]
microblaze: Remove CONFIG_TEXT_BASE from code

Use symbol instead macro to find where U-Boot starts.

Signed-off-by: Michal Simek <michal.simek@amd.com>
Link: https://lore.kernel.org/r/d5d4c201bee6171e85b47783d916387d84db0456.1655299267.git.michal.simek@amd.com
2 years agomicroblaze: Fix early stack allocation
Michal Simek [Fri, 24 Jun 2022 12:14:59 +0000 (14:14 +0200)]
microblaze: Fix early stack allocation

CONFIG_SYS_INIT_SP_OFFSET macro place stack to TEXT_BASE - SYS_MALLOC_F_LEN
but there is no reason to do it now because board_init_f_alloc_reserve()
returns exact location where stack should be. That's why stack location is
calculated at run time and there is no need to hardcode it via macro. This
change will help with placing U-Boot to any address.

Signed-off-by: Michal Simek <michal.simek@amd.com>
Link: https://lore.kernel.org/r/e9aee69646e022fd8a96cbee2d2a07ab81fb6e05.1655299267.git.michal.simek@amd.com
2 years agomicroblaze: Fix stack protection behavior
Michal Simek [Fri, 24 Jun 2022 12:14:59 +0000 (14:14 +0200)]
microblaze: Fix stack protection behavior

When U-Boot starts stack protection can be already enabled that's why setup
the lowest possible SLR value which is address 0. And the highest possible
stack in front of U-Boot. That's why you should never load U-Boot to the
beginning of DDR. There must be some space reserved. Code is using this
location for early malloc space, early global data and stack.

Signed-off-by: Michal Simek <michal.simek@amd.com>
Link: https://lore.kernel.org/r/86b9748bad12142659804d6381bc6bbf20be44f1.1655299267.git.michal.simek@amd.com
2 years agomicroblaze: Switch absolute branches to relative
Michal Simek [Fri, 24 Jun 2022 12:14:59 +0000 (14:14 +0200)]
microblaze: Switch absolute branches to relative

There is no reason to use absolute branches and use just relative. This
change helps with moving binary to different location and start it from
there.

Signed-off-by: Michal Simek <michal.simek@amd.com>
Link: https://lore.kernel.org/r/83a5103b85c1c2220cd3ab4d5365169c6660e40a.1655299267.git.michal.simek@amd.com
2 years agotools: relocate-rela: Read rela start/end directly from ELF
Michal Simek [Fri, 24 Jun 2022 12:14:59 +0000 (14:14 +0200)]
tools: relocate-rela: Read rela start/end directly from ELF

There is no need to pass section information via parameters.
Let's read text base and rela start/end directly from elf.
It will help with reading other information from ELF for others
architecture. Input to relocate-rela is u-boot binary and u-boot ELF.

Signed-off-by: Michal Simek <michal.simek@amd.com>
Link: https://lore.kernel.org/r/ab7ae14a6e058722e8c608089729e98edf20a08d.1655299267.git.michal.simek@amd.com
2 years agotools: relocate-rela: Use global variables
Michal Simek [Fri, 24 Jun 2022 12:14:59 +0000 (14:14 +0200)]
tools: relocate-rela: Use global variables

Declare rela_start/end and text_base as global variables. It will help with
using these variables for ELF decoding.

Signed-off-by: Michal Simek <michal.simek@amd.com>
Link: https://lore.kernel.org/r/7485b163e92f8f3f754c35f7c88c3314f2212efd.1655299267.git.michal.simek@amd.com
2 years agoMakefile: Fix description for relocate-rela parameters
Michal Simek [Fri, 24 Jun 2022 12:14:59 +0000 (14:14 +0200)]
Makefile: Fix description for relocate-rela parameters

Numbers in comment are shifter which is visible from command which calls
them. Also relocate-rela usage is describing them.
"Usage: %s <bin file> <text base> <rela start> <rela end>"

Signed-off-by: Michal Simek <michal.simek@amd.com>
Link: https://lore.kernel.org/r/bb0287b9071eb33eea0cf914a7128c2603684377.1655299267.git.michal.simek@amd.com
2 years agotools: relocate-rela: Open binary u-boot file later
Michal Simek [Fri, 24 Jun 2022 12:14:59 +0000 (14:14 +0200)]
tools: relocate-rela: Open binary u-boot file later

There is no value to open u-boot binary file so early. Better to check all
values first and then open binary file.

Signed-off-by: Michal Simek <michal.simek@amd.com>
Link: https://lore.kernel.org/r/9c2b4ebadbe83497db28af02f6af2623793ffdb6.1655299267.git.michal.simek@amd.com
2 years agoarm64: zynqmp: Fix tps544/u3007 node description
Michal Simek [Wed, 15 Jun 2022 09:56:56 +0000 (11:56 +0200)]
arm64: zynqmp: Fix tps544/u3007 node description

u3007 is removed in zynqmp-m-a2197-02-revA board and on
zynqmp-m-a2197-03-revA it was renamed to v3022 at address 0x18.

Signed-off-by: Michal Simek <michal.simek@xilinx.com>
Signed-off-by: Michal Simek <michal.simek@amd.com>
Link: https://lore.kernel.org/r/f477796bcca6fce09168699a0498d792f4a54acf.1655287013.git.michal.simek@amd.com
2 years agoarm64: zynqmp: Update tps53681 i2c address
Michal Simek [Wed, 15 Jun 2022 09:56:55 +0000 (11:56 +0200)]
arm64: zynqmp: Update tps53681 i2c address

TI manual (https://www.ti.com/lit/gpn/TPS53681) is saying that i2c address
is 7bit where c0h is 1100000 which is 0x60.

This will fix issues reported by make dtbs that 0xc0 is above 7bit regular
i2c address range.

Signed-off-by: Michal Simek <michal.simek@xilinx.com>
Signed-off-by: Michal Simek <michal.simek@amd.com>
Link: https://lore.kernel.org/r/2f50c1cd258f6b05deb2a6a9af7fa92952f3f8cb.1655287013.git.michal.simek@amd.com
2 years agoarm64: zynqmp: Fix i2c addresses for vck190 SC
Michal Simek [Wed, 15 Jun 2022 09:56:54 +0000 (11:56 +0200)]
arm64: zynqmp: Fix i2c addresses for vck190 SC

si570 is normally at 0x5d address and address is not aligned with address
in node.
8T49N240 can't be at 0xd8 that's why it is shifter by one bit.

Signed-off-by: Michal Simek <michal.simek@xilinx.com>
Signed-off-by: Michal Simek <michal.simek@amd.com>
Link: https://lore.kernel.org/r/4fa86fffa9cb8abe633fbc5a9c55bea249b5edfb.1655287013.git.michal.simek@amd.com
2 years agopinctrl: zynqmp: Add support for output-enable and bias-high-impedance
Ashok Reddy Soma [Wed, 15 Jun 2022 09:52:28 +0000 (11:52 +0200)]
pinctrl: zynqmp: Add support for output-enable and bias-high-impedance

Add support to handle 'output-enable' and 'bias-high-impedance'
configurations. DT property output-enable brings out the pins from
tri-state, whereas bias-high-impedance changes the pins state to
tri-state.

Signed-off-by: Ashok Reddy Soma <ashok.reddy.soma@xilinx.com>
Signed-off-by: Michal Simek <michal.simek@amd.com>
Link: https://lore.kernel.org/r/1a02cd41d183d397ebce23c497178281c7286692.1655286745.git.michal.simek@amd.com
2 years agoarm64: zynqmp: Enable DP for kv260-revA board
Michal Simek [Fri, 24 Jun 2022 12:14:25 +0000 (14:14 +0200)]
arm64: zynqmp: Enable DP for kv260-revA board

DP is enabled for revB and should be enabled for kv260-revA too. Changes in
other boards were done by commit 8b82a3a7feb0 ("arm64: zynqmp: Enable DP
driver for SOMs").

Signed-off-by: Michal Simek <michal.simek@amd.com>
Link: https://lore.kernel.org/r/4e273bce3a8acf4495b67b702b1704acec8d9ccb.1654779436.git.michal.simek@amd.com
2 years agoxilinx: zynqmp: Do not use 0 as spl bss start address
Stefan Herbrechtsmeier [Tue, 7 Jun 2022 07:43:14 +0000 (09:43 +0200)]
xilinx: zynqmp: Do not use 0 as spl bss start address

Do not use 0 as address for memory because of the special meaning for
pointers (null pointer). Change the spl bss start address to the second
page.

Signed-off-by: Stefan Herbrechtsmeier <stefan.herbrechtsmeier@weidmueller.com>
Link: https://lore.kernel.org/r/20220607074314.27125-1-stefan.herbrechtsmeier-oss@weidmueller.com
Signed-off-by: Michal Simek <michal.simek@amd.com>
2 years agoarm64: zynqmp: Add support for kr260 revA/B boards
Michal Simek [Wed, 18 May 2022 10:49:26 +0000 (12:49 +0200)]
arm64: zynqmp: Add support for kr260 revA/B boards

Board is using kv260 design for couple of parts defined by spec like i2c
eeproms, ina260, uart, etc.

Board has 4 gems. One gem connected via PS SGMII(GT), another PS RGMII(MIO)
and 2 via EMIO. First two shares the same MIO lines for PHYs. PL based one
have separate EMIO lines via PL.

Also two USB 3.0 with usb hubs are present. USB phys and USB hubs should
have separate reset line. The first usb0 hub also has USB-SD controller
(usb2244) connected to port 0.

To test compatibility with k26 you can run:
fdtoverlay -o /tmp/output.dtb -i arch/arm/dts/zynqmp-sm-k26-revA.dtb \
arch/arm/dts/zynqmp-sck-kr-g-revA.dtbo

Also add support for kr260-revB board. Based on FRU it is revision B
but schematics can be label as revA03.
Changes in revB are:
- SFP light
- GEM2/3 TX_CLK fixes
- PMOD/RPI connector fixes
- Replace si5332 with oscilators

Signed-off-by: Michal Simek <michal.simek@xilinx.com>
Signed-off-by: Michal Simek <michal.simek@amd.com>
Link: https://lore.kernel.org/r/dac2ee1826e73b89c8cc1e430354eb43d291f675.1652870941.git.michal.simek@amd.com
2 years agoserial: Setup serial base and freq for zynq/zynqmp
Michal Simek [Mon, 6 Jun 2022 07:44:01 +0000 (09:44 +0200)]
serial: Setup serial base and freq for zynq/zynqmp

Setup default values for debug console, base address and frequency.

Signed-off-by: Michal Simek <michal.simek@amd.com>
Link: https://lore.kernel.org/r/ce93efd3ed67aa6390810ce0b79e0d00e7c36b4b.1652871485.git.michal.simek@amd.com
2 years agoarm64: zynqmp: Add debug messages to bl2_plat_get_bl31_params()
Michal Simek [Mon, 6 Jun 2022 07:37:09 +0000 (09:37 +0200)]
arm64: zynqmp: Add debug messages to bl2_plat_get_bl31_params()

It is useful to get information about BL type and entry address that's why
add some debug messages.

Signed-off-by: Michal Simek <michal.simek@amd.com>
Link: https://lore.kernel.org/r/fb023b618a009009a0b564c24223cadc10ced5b3.1652871741.git.michal.simek@amd.com
2 years agoarm64: versal: Add support to load an app at EL1
Ashok Reddy Soma [Fri, 6 May 2022 05:53:45 +0000 (23:53 -0600)]
arm64: versal: Add support to load an app at EL1

Add support to switch to EL1 and load an EL1 app from U-Boot which is
executing at EL2 or EL3 in aarch64 mode.

Signed-off-by: Ashok Reddy Soma <ashok.reddy.soma@xilinx.com>
Link: https://lore.kernel.org/r/20220506055345.1921-1-ashok.reddy.soma@xilinx.com
Signed-off-by: Michal Simek <michal.simek@amd.com>
2 years agoxilinx: Add CONFIG_DM_ETH_PHY config
T Karthik Reddy [Tue, 10 May 2022 11:26:11 +0000 (13:26 +0200)]
xilinx: Add CONFIG_DM_ETH_PHY config

Enable CONFIG_DM_ETH_PHY to utilize shared MDIO bus support on all xilinx
platforms.

Signed-off-by: T Karthik Reddy <t.karthik.reddy@xilinx.com>
Signed-off-by: Michal Simek <michal.simek@amd.com>
Acked-by: Ashok Reddy Soma <ashok.reddy.soma@xilinx.com>
Link: https://lore.kernel.org/r/965981eb324d13a98aad8bd88eb8b50bc5147a7e.1652181968.git.michal.simek@amd.com
2 years agonet: xilinx: axi_emaclite: Use shared MDIO bus support for axi emaclite driver
T Karthik Reddy [Tue, 10 May 2022 11:26:10 +0000 (13:26 +0200)]
net: xilinx: axi_emaclite: Use shared MDIO bus support for axi emaclite driver

CONFIG_DM_ETH_PHY enables support to utilize generic ethernet phy
framework. Though if ethernet PHY node is in other ethernet node, it
will use shared MDIO to access the PHY of other ethernet. Move ethernet
print info statement from plat function to probe function, as phyaddr is
not enumerated when CONFIG_DM_ETH_PHY is enabled.

Signed-off-by: T Karthik Reddy <t.karthik.reddy@xilinx.com>
Signed-off-by: Michal Simek <michal.simek@amd.com>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
Acked-by: Ashok Reddy Soma <ashok.reddy.soma@xilinx.com>
Link: https://lore.kernel.org/r/93e11ccca56b6e52b2dcc283d08d5042537f828f.1652181968.git.michal.simek@amd.com
2 years agonet: xilinx: axi_emac: Use shared MDIO bus support for axi emac driver
T Karthik Reddy [Tue, 10 May 2022 11:26:09 +0000 (13:26 +0200)]
net: xilinx: axi_emac: Use shared MDIO bus support for axi emac driver

CONFIG_DM_ETH_PHY enables support to utilize generic ethernet phy
framework. Though if ethernet PHY node is in other ethernet node, it
will use shared MDIO to access the PHY of other ethernet. Move ethernet
print info statement from plat function to probe function, as phyaddr is
not enumerated when CONFIG_DM_ETH_PHY is enabled.

Signed-off-by: T Karthik Reddy <t.karthik.reddy@xilinx.com>
Signed-off-by: Michal Simek <michal.simek@amd.com>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
Acked-by: Ashok Reddy Soma <ashok.reddy.soma@xilinx.com>
Link: https://lore.kernel.org/r/ecfec78234233fefdc172c141c207b2d78ef70c5.1652181968.git.michal.simek@amd.com
2 years agodtoc: Update test_src_scan.py for new tegra compatibles
Tom Rini [Tue, 14 Jun 2022 17:59:23 +0000 (13:59 -0400)]
dtoc: Update test_src_scan.py for new tegra compatibles

This test was written to match up with the list of compatibles in
drivers/i2c/tegra_i2c.c so adding another one requires the test to be
updated to match.

Fixes: 0d2105ae5e32 ("arm: tegra: Update some DT compatibles")
Signed-off-by: Tom Rini <trini@konsulko.com>
2 years agoMerge branch 'master' of https://source.denx.de/u-boot/custodians/u-boot-tegra
Tom Rini [Tue, 14 Jun 2022 16:28:58 +0000 (12:28 -0400)]
Merge branch 'master' of https://source.denx.de/u-boot/custodians/u-boot-tegra

Signed-off-by: Tom Rini <trini@konsulko.com>
2 years agoboard: apalis_t30/tk1/colibri_t20/t30: integrate mac address via dt
Marcel Ziswiler [Sat, 21 May 2022 10:42:46 +0000 (12:42 +0200)]
board: apalis_t30/tk1/colibri_t20/t30: integrate mac address via dt

Use device tree to set MAC address of the Ethernet chip.

Signed-off-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
Signed-off-by: Tom Warren <twarren@nvidia.com>
2 years agoarm: tegra: Update some DT compatibles
Peter Robinson [Tue, 3 May 2022 08:32:54 +0000 (09:32 +0100)]
arm: tegra: Update some DT compatibles

Some of the DT compatibles have changed upstream so add new DT compatibles
to ensure things continue to keep working if the device trees are
updated.

Signed-off-by: Peter Robinson <pbrobinson@gmail.com>
Signed-off-by: Tom Warren <twarren@nvidia.com>
2 years agopci: tegra: Update error prints with new lines
Peter Robinson [Tue, 3 May 2022 08:29:22 +0000 (09:29 +0100)]
pci: tegra: Update error prints with new lines

Add new lines to make errorr messages easier to read.

Signed-off-by: Peter Robinson <pbrobinson@gmail.com>
Signed-off-by: Tom Warren <twarren@nvidia.com>
2 years agoARM: tegra: XUSB padctl: Add new lines for errors
Peter Robinson [Tue, 3 May 2022 08:29:21 +0000 (09:29 +0100)]
ARM: tegra: XUSB padctl: Add new lines for errors

Add new lines for error messages to make them easier to read.

Signed-off-by: Peter Robinson <pbrobinson@gmail.com>
Signed-off-by: Tom Warren <twarren@nvidia.com>
2 years agoMerge tag 'efi-2022-07-rc5' of https://source.denx.de/u-boot/custodians/u-boot-efi
Tom Rini [Mon, 13 Jun 2022 13:33:37 +0000 (09:33 -0400)]
Merge tag 'efi-2022-07-rc5' of https://source.denx.de/u-boot/custodians/u-boot-efi

Pull request for efi-2022-07-rc5

UEFI:

* Ignore OsIndications if CONFIG_EFI_IGNORE_OSINDICATIONS=y
* Correct UEFI default binary name
* Let efidebug create boot options without file path
* Support booting with a boot option with shortened device only device path

2 years agoefi_loader: create boot options without file path
Heinrich Schuchardt [Sat, 11 Jun 2022 05:22:08 +0000 (05:22 +0000)]
efi_loader: create boot options without file path

Allow the efidebug command to create boot options without file path, e.g.

    efidebug boot add -b 0001 'short dev only' host 0:1 ''
    efidebug boot add -B 0002 'long dev only' host 0:1 ''

Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2 years agoefi_loader: allow booting from short dev only DP
Heinrich Schuchardt [Sat, 11 Jun 2022 05:22:07 +0000 (05:22 +0000)]
efi_loader: allow booting from short dev only DP

Allow booting from a short form device-path without file path, e.g.

    /HD(1,GPT,5ef79931-a1aa-4c70-9d67-611e8f69eafd,0x800,0x1000)

Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2 years agoefi_loader: correctly identify binary name
Heinrich Schuchardt [Fri, 10 Jun 2022 16:24:48 +0000 (18:24 +0200)]
efi_loader: correctly identify binary name

Only on the sandbox the default EFI binary name (e.g. BOOTX64.EFI) must
match the host architecture.

In all other cases we must use the target architecture.

Use #elif where appropriate.

Reported-by: Vagrant Cascadian <vagrant@reproducible-builds.org>
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2 years agoEFI: FMP: Use a common GetImageInfo function for FIT and raw images
Sughosh Ganu [Wed, 1 Jun 2022 18:00:41 +0000 (23:30 +0530)]
EFI: FMP: Use a common GetImageInfo function for FIT and raw images

The GetImageInfo function definitions for the FIT images and raw
images are the same. Use a common function for the both the Firmware
Management Protocol(FMP) instances for raw and FIT images.

Signed-off-by: Sughosh Ganu <sughosh.ganu@linaro.org>
Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2 years agoEFI: Do not consider OsIndications variable if CONFIG_EFI_IGNORE_OSINDICATIONS is...
Sughosh Ganu [Wed, 1 Jun 2022 18:00:39 +0000 (23:30 +0530)]
EFI: Do not consider OsIndications variable if CONFIG_EFI_IGNORE_OSINDICATIONS is enabled

The EFI_IGNORE_OSINDICATIONS config symbol was introduced as a
mechanism to have capsule updates work even on platforms where the
SetVariable runtime service was not supported. The current logic
requires the OsIndications variable to have been set to a 64 bit value
even when the EFI_IGNORE_OSINDICATIONS config is enabled. Return an
error code on not being able to read the variable only when
EFI_IGNORE_OSINDICATIONS is not enabled.

Signed-off-by: Sughosh Ganu <sughosh.ganu@linaro.org>
Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2 years agoMerge https://source.denx.de/u-boot/custodians/u-boot-usb
Tom Rini [Wed, 8 Jun 2022 12:25:30 +0000 (08:25 -0400)]
Merge https://source.denx.de/u-boot/custodians/u-boot-usb

- MediaTek XHCI bugfix, add  USB251xB/xBi driver

2 years agomisc: Port USB251xB/xBi Hi-Speed Hub Controller Driver from Linux
Marek Vasut [Sun, 10 Apr 2022 04:27:14 +0000 (06:27 +0200)]
misc: Port USB251xB/xBi Hi-Speed Hub Controller Driver from Linux

This patch adds a driver for configuration of the Microchip USB251xB/xBi
USB 2.0 hub controller series with USB 2.0 upstream connectivity, SMBus
configuration interface and two to four USB 2.0 downstream ports.

This is ported from Linux as of Linux kernel commit
5c2b9c61ae5d8 ("usb: usb251xb: add boost-up property support")

Signed-off-by: Marek Vasut <marex@denx.de>
Cc: Bin Meng <bmeng.cn@gmail.com>
Cc: Michal Simek <michal.simek@xilinx.com>
Cc: Simon Glass <sjg@chromium.org>
2 years agoMerge https://source.denx.de/u-boot/custodians/u-boot-watchdog
Tom Rini [Tue, 7 Jun 2022 12:17:24 +0000 (08:17 -0400)]
Merge https://source.denx.de/u-boot/custodians/u-boot-watchdog

- Fix SPL build with watchdog disabled in asm files (Pali)

2 years agoMerge tag 'xilinx-for-v2022.07-rc4-v2' of https://source.denx.de/u-boot/custodians...
Tom Rini [Tue, 7 Jun 2022 12:17:08 +0000 (08:17 -0400)]
Merge tag 'xilinx-for-v2022.07-rc4-v2' of https://source.denx.de/u-boot/custodians/u-boot-microblaze

Xilinx changes for v2022.07-rc4-v2

- Fix revision name (remove spaces)

2 years agousb: xhci-mtk: disable all ports when disable host controller
Chunfeng Yun [Fri, 27 May 2022 01:52:09 +0000 (09:52 +0800)]
usb: xhci-mtk: disable all ports when disable host controller

This is used to avoid the ports status of IPPC being brought in kernel
stage, it may cause ports error especially when the xhci controller is
a component of dual-role controller.

Reported-by: Yun-Chien Yu <yun-chien.yu@mediatek.com>
Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
2 years agowatchdog: Fix SPL build with watchdog disabled in asm files
Pali Rohár [Thu, 28 Apr 2022 11:33:09 +0000 (13:33 +0200)]
watchdog: Fix SPL build with watchdog disabled in asm files

Allow to compile assembler files in SPL build which calls WATCHDOG_RESET
function when watchdog is disabled in SPL and enabled in U-Boot proper.

This issue was fixed in past by commit 7fbd42f5afc4 ("watchdog: Handle SPL
build with watchdog disabled") for C source files, but not for assembler
source files.

Currently the only assembler source file which calls WATCHDOG_RESET is
arch/powerpc/lib/ticks.S, so this patch affects and fixes powerpc SPL
builds.

Signed-off-by: Pali Rohár <pali@kernel.org>
Reviewed-by: Stefan Roese <sr@denx.de>
2 years agoPrepare v2022.07-rc4
Tom Rini [Mon, 6 Jun 2022 14:25:13 +0000 (10:25 -0400)]
Prepare v2022.07-rc4

Signed-off-by: Tom Rini <trini@konsulko.com>
2 years agoconfigs: fsl: add missing SYS_FMAN_FW_ADDR defines
Camelia Groza [Thu, 2 Jun 2022 13:47:09 +0000 (16:47 +0300)]
configs: fsl: add missing SYS_FMAN_FW_ADDR defines

Two defconfigs were missed when transitioning the SYS_FMAN_FW_ADDR
symbol to Kconfig. CONFIG_SYS_FMAN_FW_ADDR is currently initialized to
0 by default on these builds, which prevents the firmware from loading.

Add the correct symbols to these defconfigs.

Fixes: a97a071d10d2b ("configs: fsl: migrate FMAN/QE specific defines to Kconfig")
Signed-off-by: Camelia Groza <camelia.groza@nxp.com>
2 years agodoc: update mail author for st-dt.rst
Patrick Delaunay [Thu, 2 Jun 2022 16:34:49 +0000 (18:34 +0200)]
doc: update mail author for st-dt.rst

Update author email address with the one dedicated to
upstream activities.

Signed-off-by: Patrick Delaunay <patrick.delaunay@foss.st.com>
2 years agoxilinx: fru: Replace spaces with \0 in detected revision
Michal Simek [Mon, 6 Jun 2022 07:31:27 +0000 (09:31 +0200)]
xilinx: fru: Replace spaces with \0 in detected revision

Also fix board revision field where spaces are used instead of \0.
The same change was done for board name by commit 530560b6f8eb ("xilinx:
fru: Replace spaces with \0 in detected name").

Signed-off-by: Michal Simek <michal.simek@amd.com>
Link: https://lore.kernel.org/r/e069e5134e57899e859786ad8ba48721df6df752.1653911444.git.michal.simek@amd.com
2 years agoMerge tag 'efi-2022-07-rc4-4' of https://source.denx.de/u-boot/custodians/u-boot-efi
Tom Rini [Sat, 4 Jun 2022 13:38:56 +0000 (09:38 -0400)]
Merge tag 'efi-2022-07-rc4-4' of https://source.denx.de/u-boot/custodians/u-boot-efi

Pull request for efi-2022-07-rc4-4

UEFI:

* Fix the implementation of the firmware management protocol
* Fix the unit tests for signed update capsules

2 years agoefi: test/py: authenticate fit capsules
Vincent Stehlé [Tue, 31 May 2022 07:55:34 +0000 (09:55 +0200)]
efi: test/py: authenticate fit capsules

Add support for the authentication of UEFI capsules containing FIT images.

The authentication code is moved out of the function handling raw images
into a new function efi_firmware_capsule_authenticate(). The special case
for the FMP header coming from edk2 tools is preserved. There is no
functional change for capsules containing raw images.

The python test for signed capsules with raw images is renamed with no
functional change and a new test is added for signed capsules containing
FIT images.

This can be tested with sandbox64_defconfig or sandbox_flattree_defconfig,
plus CONFIG_EFI_CAPSULE_AUTHENTICATE=y.

Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
Cc: Heinrich Schuchardt <xypron.glpk@gmx.de>
2 years agotest/py: efi_capsule: repair image authentication test
Vincent Stehlé [Tue, 31 May 2022 07:55:33 +0000 (09:55 +0200)]
test/py: efi_capsule: repair image authentication test

Repair the python tests for authenticated EFI capsules, which can be run
with sandbox_defconfig plus CONFIG_EFI_CAPSULE_AUTHENTICATE=y.

- Account for the reset changes done by commit 3e6f81000672 ("efi_loader:
  test/py: Reset system after capsule update on disk").
- Fix the capsule GUID typo introduced by commit 2e9c3c6965ba ("test:
  capsule: Modify the capsule tests to use GUID values for sandbox").

Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
Cc: Heinrich Schuchardt <xypron.glpk@gmx.de>
2 years agoEFI: Update the documentation to reflect the correct value of OsIndications
Sughosh Ganu [Tue, 31 May 2022 07:15:35 +0000 (12:45 +0530)]
EFI: Update the documentation to reflect the correct value of OsIndications

The OsIndications is a 64 bit variable, and the current code expects
the value of the variable to be 64 bit. Update the documentation to
reflect this fact.

Signed-off-by: Sughosh Ganu <sughosh.ganu@linaro.org>
Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2 years agoEFI: Populate descriptor_count value only when image_info_size is not zero
Sughosh Ganu [Tue, 31 May 2022 07:15:33 +0000 (12:45 +0530)]
EFI: Populate descriptor_count value only when image_info_size is not zero

The GetImageInfo function of the Firmware Mangement Protocol(FMP) gets
called initially to query the size of the image descriptor array that
would have to be allocated. During this call, the rest of the function
arguments, specifically pointers might be passed as NULL. Do not
populate the descriptor_count value before it is known that the call
to GetImageInfo has been made with the allocated buffer for the image
descriptors.

Signed-off-by: Sughosh Ganu <sughosh.ganu@linaro.org>
Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2 years agodoc: environment: Fix typo
Chris Packham [Wed, 25 May 2022 01:08:51 +0000 (13:08 +1200)]
doc: environment: Fix typo

"valu" should be "value".

Signed-off-by: Chris Packham <judge.packham@gmail.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2 years agoMerge branch '2022-06-03-assorted-fixes'
Tom Rini [Fri, 3 Jun 2022 19:42:13 +0000 (15:42 -0400)]
Merge branch '2022-06-03-assorted-fixes'

- armv8 TCR write bugfix, ubifs bugfix, imx8mq clk bugfixes, two network
  fixes, Add U-Boot version to chosen node, update TI AM64x board
  maintainers

2 years agoboard: ti: am64x: Update MAINTAINERS
Dave Gerlach [Fri, 3 Jun 2022 19:30:20 +0000 (14:30 -0500)]
board: ti: am64x: Update MAINTAINERS

Move maintainership of TI AM64x boards to Vignesh.

Signed-off-by: Dave Gerlach <d-gerlach@ti.com>
2 years agosquashfs: Fix compilation on big endian systems
Pali Rohár [Wed, 6 Apr 2022 21:31:53 +0000 (23:31 +0200)]
squashfs: Fix compilation on big endian systems

Signed-off-by: Pali Rohár <pali@kernel.org>
Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
2 years agoimx: imx8mq: select CONFIG_CMD_CLK
Peng Fan [Mon, 23 May 2022 11:38:28 +0000 (19:38 +0800)]
imx: imx8mq: select CONFIG_CMD_CLK

select CONFIG_CMD_CLK to enable dump clk in uboot shell

Signed-off-by: Peng Fan <peng.fan@nxp.com>
2 years agoimx: imx8mq: default select CLK_IMX8MQ
Peng Fan [Mon, 23 May 2022 11:38:27 +0000 (19:38 +0800)]
imx: imx8mq: default select CLK_IMX8MQ

Since the power domain driver default select CONFIG_CLK, so we will
meet lots failures without CLK_IMX8MQ, so default select it.

Fixes: commit 4eb82c2e56a7c ("imx: power-domain: Get rid of SMCCC dependency")
Signed-off-by: Peng Fan <peng.fan@nxp.com>
2 years agofdt: Add U-Boot version to chosen node
Francesco Dolcini [Thu, 19 May 2022 14:22:26 +0000 (16:22 +0200)]
fdt: Add U-Boot version to chosen node

Add a new device tree property "u-boot,version" in the chosen node to
pass the U-Boot version to the operating system.
This can be useful to implement a firmware upgrade procedure from the
operating system.

Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Reviewed-by: Tom Rini <trini@konsulko.com>
2 years agonet: Check for the minimum IP fragmented datagram size
Fabio Estevam [Thu, 26 May 2022 14:14:37 +0000 (11:14 -0300)]
net: Check for the minimum IP fragmented datagram size

Nicolas Bidron and Nicolas Guigo reported the two bugs below:

"
----------BUG 1----------

In compiled versions of U-Boot that define CONFIG_IP_DEFRAG, a value of
`ip->ip_len` (IP packet header's Total Length) higher than `IP_HDR_SIZE`
and strictly lower than `IP_HDR_SIZE+8` will lead to a value for `len`
comprised between `0` and `7`. This will ultimately result in a
truncated division by `8` resulting value of `0` forcing the hole
metadata and fragment to point to the same location. The subsequent
memcopy will overwrite the hole metadata with the fragment data. Through
a second fragment, this can be exploited to write to an arbitrary offset
controlled by that overwritten hole metadata value.

This bug is only exploitable locally as it requires crafting two packets
the first of which would most likely be dropped through routing due to
its unexpectedly low Total Length. However, this bug can potentially be
exploited to root linux based embedded devices locally.

```C
static struct ip_udp_hdr *__net_defragment(struct ip_udp_hdr *ip, int *lenp)
{
     static uchar pkt_buff[IP_PKTSIZE] __aligned(PKTALIGN);
     static u16 first_hole, total_len;
     struct hole *payload, *thisfrag, *h, *newh;
     struct ip_udp_hdr *localip = (struct ip_udp_hdr *)pkt_buff;
     uchar *indata = (uchar *)ip;
     int offset8, start, len, done = 0;
     u16 ip_off = ntohs(ip->ip_off);

     /* payload starts after IP header, this fragment is in there */
     payload = (struct hole *)(pkt_buff + IP_HDR_SIZE);
     offset8 =  (ip_off & IP_OFFS);
     thisfrag = payload + offset8;
     start = offset8 * 8;
     len = ntohs(ip->ip_len) - IP_HDR_SIZE;
```

The last line of the previous excerpt from `u-boot/net/net.c` shows how
the attacker can control the value of `len` to be strictly lower than
`8` by issuing a packet with `ip_len` between `21` and `27`
(`IP_HDR_SIZE` has a value of `20`).

Also note that `offset8` here is `0` which leads to `thisfrag = payload`.

```C
     } else if (h >= thisfrag) {
         /* overlaps with initial part of the hole: move this hole */
         newh = thisfrag + (len / 8);
         *newh = *h;
         h = newh;
         if (h->next_hole)
             payload[h->next_hole].prev_hole = (h - payload);
         if (h->prev_hole)
             payload[h->prev_hole].next_hole = (h - payload);
         else
             first_hole = (h - payload);

     } else {
```

Lower down the same function, execution reaches the above code path.
Here, `len / 8` evaluates to `0` leading to `newh = thisfrag`. Also note
that `first_hole` here is `0` since `h` and `payload` point to the same
location.

```C
     /* finally copy this fragment and possibly return whole packet */
     memcpy((uchar *)thisfrag, indata + IP_HDR_SIZE, len);
```

Finally, in the above excerpt the `memcpy` overwrites the hole metadata
since `thisfrag` and `h` both point to the same location. The hole
metadata is effectively overwritten with arbitrary data from the
fragmented IP packet data. If `len` was crafted to be `6`, `last_byte`,
`next_hole`, and `prev_hole` of the `first_hole` can be controlled by
the attacker.

Finally the arbitrary offset write occurs through a second fragment that
only needs to be crafted to write data in the hole pointed to by the
previously controlled hole metadata (`next_hole`) from the first packet.

 ### Recommendation

Handle cases where `len` is strictly lower than 8 by preventing the
overwrite of the hole metadata during the memcpy of the fragment. This
could be achieved by either:
* Moving the location where the hole metadata is stored when `len` is
lower than `8`.
* Or outright rejecting fragmented IP datagram with a Total Length
(`ip_len`) lower than 28 bytes which is the minimum valid fragmented IP
datagram size (as defined as the minimum fragment of 8 octets in the IP
Specification Document:
[RFC791](https://datatracker.ietf.org/doc/html/rfc791) page 25).

----------BUG 2----------

In compiled versions of U-Boot that define CONFIG_IP_DEFRAG, a value of
`ip->ip_len` (IP packet header's Total Length) lower than `IP_HDR_SIZE`
will lead to a negative value for `len` which will ultimately result in
a buffer overflow during the subsequent `memcpy` that uses `len` as it's
`count` parameter.

This bug is only exploitable on local ethernet as it requires crafting
an invalid packet to include an unexpected `ip_len` value in the IP UDP
header that's lower than the minimum accepted Total Length of a packet
(21 as defined in the IP Specification Document:
[RFC791](https://datatracker.ietf.org/doc/html/rfc791)). Such packet
would in all likelihood be dropped while being routed to its final
destination through most routing equipment and as such requires the
attacker to be in a local position in order to be exploited.

```C
static struct ip_udp_hdr *__net_defragment(struct ip_udp_hdr *ip, int *lenp)
{
     static uchar pkt_buff[IP_PKTSIZE] __aligned(PKTALIGN);
     static u16 first_hole, total_len;
     struct hole *payload, *thisfrag, *h, *newh;
     struct ip_udp_hdr *localip = (struct ip_udp_hdr *)pkt_buff;
     uchar *indata = (uchar *)ip;
     int offset8, start, len, done = 0;
     u16 ip_off = ntohs(ip->ip_off);

     /* payload starts after IP header, this fragment is in there */
     payload = (struct hole *)(pkt_buff + IP_HDR_SIZE);
     offset8 =  (ip_off & IP_OFFS);
     thisfrag = payload + offset8;
     start = offset8 * 8;
     len = ntohs(ip->ip_len) - IP_HDR_SIZE;
```

The last line of the previous excerpt from `u-boot/net/net.c` shows
where the underflow to a negative `len` value occurs if `ip_len` is set
to a value strictly lower than 20 (`IP_HDR_SIZE` being 20). Also note
that in the above excerpt the `pkt_buff` buffer has a size of
`CONFIG_NET_MAXDEFRAG` which defaults to 16 KB but can range from 1KB to
64 KB depending on configurations.

```C
     /* finally copy this fragment and possibly return whole packet */
     memcpy((uchar *)thisfrag, indata + IP_HDR_SIZE, len);
```

In the above excerpt the `memcpy` overflows the destination by
attempting to make a copy of nearly 4 gigabytes in a buffer that's
designed to hold `CONFIG_NET_MAXDEFRAG` bytes at most which leads to a DoS.

 ### Recommendation

Stop processing of the packet if `ip_len` is lower than 21 (as defined
by the minimum length of a data carrying datagram in the IP
Specification Document:
[RFC791](https://datatracker.ietf.org/doc/html/rfc791) page 34)."

Add a check for ip_len lesser than 28 and stop processing the packet
in this case.

Such a check covers the two reported bugs.

Reported-by: Nicolas Bidron <nicolas.bidron@nccgroup.com>
Signed-off-by: Fabio Estevam <festevam@denx.de>
2 years agoarmv8: Fix TCR 64-bit writes
Andre Przywara [Mon, 9 May 2022 16:08:49 +0000 (17:08 +0100)]
armv8: Fix TCR 64-bit writes

The AArch64 TCR_ELx register is a 64-bit register, and many newer
architecture features use bits in the upper half. So far U-Boot was
igorant of those bits, trying to leave them alone.
However, in an effort to set bit 31 to 1, it failed doing so, because
the compiler sign-extended "1 << 31", so that all bits[63:31] got set.

Older ARMv8.0 cores don't define anything dangerous up there, but newer
architecture revisions do, and setting all those bits will end badly:
=================
$ qemu-system-aarch64 -cpu max ....
U-Boot 2022.07-rc1 (May 09 2022 - 15:21:00 +0100)

DRAM:  1.5 GiB
=================  (hangs here)

Defining TCR_ELx_RSVD to "1U << 31" avoids the sign-extension, so all
upper bits stay at a safe 0 value. This means no more surprises when
U-Boot runs on a more capable CPU core.

Reported-by: Balaji Anandapadmanaban <Balaji.Anandapadmanaban@arm.com>
Signed-off-by: Andre Przywara <andre.przywara@arm.com>
Reviewed-by: Peng Fan <peng.fan@nxp.com>
Tested-by: Peter Collingbourne <pcc@google.com>
Reviewed-by: Peter Collingbourne <pcc@google.com>
2 years agonet: enetc: unregister mdiobus
Michael Walle [Tue, 31 May 2022 16:36:16 +0000 (18:36 +0200)]
net: enetc: unregister mdiobus

If the device fails to probe - for example, when there is no
ethaddr set - then the private data is automatically freed
but the mdiobus remains registered.

Fixes: 1e354cb39314 ("drivers: net: fsl_enetc: register internal MDIO bus")
Signed-off-by: Michael Walle <michael@walle.cc>
2 years agoubifs: Fix lockup/crash when reading files
Pali Rohár [Tue, 17 May 2022 20:45:28 +0000 (22:45 +0200)]
ubifs: Fix lockup/crash when reading files

Commit b1a14f8a1c2e ("UBIFS: Change ubifsload to not read beyond the
requested size") added optimization to do not read more bytes than it is
really needed. But this commit introduced incorrect handling of the hole at
the end of file. This logic cause U-Boot to crash or lockup when trying to
read from the ubifs filesystem.

When read_block() call returns -ENOENT error (not an error, but the hole)
then dn-> structure is not filled and contain garbage. So using of dn->size
for memcpy() argument cause that U-Boot tries to copy unspecified amount of
bytes from possible unmapped memory. Which randomly cause lockup of P2020
CPU.

Fix this issue by copying UBIFS_BLOCK_SIZE bytes from read buffer when
dn->size is not available. UBIFS_BLOCK_SIZE is the size of the buffer
itself and read_block() fills buffer by zeros when it returns -ENOENT.

This patch fixes ubifsload on P2020.

Fixes: b1a14f8a1c2e ("UBIFS: Change ubifsload to not read beyond the requested size")
Signed-off-by: Pali Rohár <pali@kernel.org>
Reviewed-by: Stefan Roese <sr@denx.de>
2 years agoMerge tag 'efi-2022-07-rc4-3' of https://source.denx.de/u-boot/custodians/u-boot-efi
Tom Rini [Tue, 31 May 2022 17:05:53 +0000 (13:05 -0400)]
Merge tag 'efi-2022-07-rc4-3' of https://source.denx.de/u-boot/custodians/u-boot-efi

Pull request for efi-2022-07-rc4-3

UEFI:

* fix a problem in loading an image from a short-path
* fix building the bootmenu command for CONFIG_EFI_LOADER=n
* correct the bootefi command syntax
* add firmware management protocol to the documentation

Others:

* bootmenu: fix bootmenu title handling

Tested-by: Pali Rohár <pali@kernel.org> [n900, for bootmenu working as before]
2 years agobootmenu: use utf-8 for menu title
Masahisa Kojima [Sun, 29 May 2022 01:52:43 +0000 (10:52 +0900)]
bootmenu: use utf-8 for menu title

The commit a3d0aa87acbe ("bootmenu: update bootmenu_entry structure")
changes the bootmenu title type from char to u16(UTF16 string)
to support EFI based system. If EFI_LOADER is not enabled,
printf("%ls") is not supported, so bootmenu does not appear
correctly.

This commit changes the type of menu title from u16(UTF16) to
utf-8 string and EFI strings is conveted into utf-8.

Fixes: a3d0aa87acbe ("bootmenu: update bootmenu_entry structure")
Signed-off-by: Masahisa Kojima <masahisa.kojima@linaro.org>
Tested-by: Pali Rohar <pali@kernel.org>
Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2 years agodoc/efi: add firmware management protocol to the documentation
Vincent Stehlé [Wed, 25 May 2022 09:20:21 +0000 (11:20 +0200)]
doc/efi: add firmware management protocol to the documentation

The firmware management protocol can be used to manage device firmware.
U-Boot can be configured to provide an implementation.

Document the related functions in the API section.

Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2 years agoefi: fix documentation warnings
Vincent Stehlé [Wed, 25 May 2022 09:20:22 +0000 (11:20 +0200)]
efi: fix documentation warnings

This fixes the following warnings:

  ./lib/efi_loader/efi_firmware.c:283: warning: Function parameter or member 'package_version' not described in 'efi_firmware_fit_get_image_info'
  ./lib/efi_loader/efi_firmware.c:283: warning: Function parameter or member 'package_version_name' not described in 'efi_firmware_fit_get_image_info'
  ./lib/efi_loader/efi_firmware.c:369: warning: bad line: firmware image
  ./lib/efi_loader/efi_firmware.c:395: warning: Function parameter or member 'package_version' not described in 'efi_firmware_raw_get_image_info'
  ./lib/efi_loader/efi_firmware.c:395: warning: Function parameter or member 'package_version_name' not described in 'efi_firmware_raw_get_image_info'

Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
Cc: Heinrich Schuchardt <xypron.glpk@gmx.de>
Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2 years agolib/charset: fix compile warnings
Masahisa Kojima [Mon, 16 May 2022 11:00:42 +0000 (20:00 +0900)]
lib/charset: fix compile warnings

This commit fixes the following compile warnings
for the documentation.

./include/charset.h:276: warning: Function parameter or member 'size' not described in 'u16_strlcat'
./include/charset.h:276: warning: Excess function parameter 'count' description in 'u16_strlcat'

Signed-off-by: Masahisa Kojima <masahisa.kojima@linaro.org>
Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2 years agoefi_loader: bootmgr: fix a problem in loading an image from a short-path
AKASHI Takahiro [Thu, 12 May 2022 02:29:02 +0000 (11:29 +0900)]
efi_loader: bootmgr: fix a problem in loading an image from a short-path

Booting from a short-form device path which starts with the first element
being a File Path Media Device Path failed because it doesn't contain
any valid device with simple file system protocol and efi_dp_find_obj()
in efi_load_image_from_path() will return NULL.
For instance,
/VenHw(e61d73b9-a384-4acc-aeab-82e828f3628b)/Scsi(0,0)/\helloworld.efi
-> shortened version: /\helloworld.efi

With this patch applied, all the media devices with simple file system
protocol are enumerated and the boot manager attempts to boot temporarily
generated device paths one-by-one.

This new implementation is still a bit incompatible with the UEFI
specification in terms of:
* not creating real boot options
* not try
  "If a device does not support the EFI_SIMPLE_FILE_SYSTEM_PROTOCOL, but
  supports the EFI_BLOCK_IO_PROTOCOL protocol, then the EFI Boot Service
  ConnectController must be called for this device with DriverImageHandle
  and RemainingDevicePath set to NULL and the Recursive flag is set to TRUE."
(See section 3.1.2 "Load Option Processing".)

But it still gives us a closer and better solution than the current.

Fixes: commit 9cdf470274ff ("efi_loader: support booting via short-form device-path")
Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2 years agoefi_loader: disk: add efi_disk_is_removable()
AKASHI Takahiro [Thu, 12 May 2022 02:29:01 +0000 (11:29 +0900)]
efi_loader: disk: add efi_disk_is_removable()

This helper function will be used to determine if the device is
removable media, initially for handling a short-path loading.

Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2 years agocmd/bootefi: correct command syntax
Heinrich Schuchardt [Thu, 19 May 2022 06:00:56 +0000 (08:00 +0200)]
cmd/bootefi: correct command syntax

For indicating the address and size of a memory region other commands use a
<addr>[:<size>] syntax. Do the same for bootefi.

Fixes: 2058983689f0 ("cmd: bootefi: restore ability to boot arbitrary blob")
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2 years agotest: don't change console timeout in EFI selftest.
Heinrich Schuchardt [Mon, 9 May 2022 20:02:05 +0000 (22:02 +0200)]
test: don't change console timeout in EFI selftest.

Changing the console timeout to 500 ms without restoring the original value
leads to failures in other tests. As the console timeout change is not
necessary for the text input protocol tests remove it.

Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2 years agotest: fix pylint warnings in test_efi_selftest.py
Heinrich Schuchardt [Sun, 8 May 2022 08:40:49 +0000 (10:40 +0200)]
test: fix pylint warnings in test_efi_selftest.py

* change format of parameter documentation
* avoid superfluous assignments

Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2 years agobootmenu: U-Boot console is enabled as default
Masahisa Kojima [Thu, 26 May 2022 10:09:38 +0000 (19:09 +0900)]
bootmenu: U-Boot console is enabled as default

The commit 2158b0da220c ("bootmenu: add Kconfig option
not to enter U-Boot console") disables to enter U-Boot
console from bootmenu as default, this change affects the
existing bootmenu users.

This commit reverts the default behavior, the bootmenu can
enter U-Boot console same as before.
CMD_BOOTMENU_ENTER_UBOOT_CONSOLE is renamed
BOOTMENU_DISABLE_UBOOT_CONSOLE and depends on
AUTOBOOT_MENU_SHOW.

Fixes: 2158b0da220c ("bootmenu: add Kconfig option not to enter U-Boot console")
Signed-off-by: Masahisa Kojima <masahisa.kojima@linaro.org>
Tested-by: Pali Rohar <pali@kernel.org>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2 years agodoc: sandbox: Add additional valgrind documentation
Sean Anderson [Fri, 27 May 2022 14:02:59 +0000 (10:02 -0400)]
doc: sandbox: Add additional valgrind documentation

This documents some additional options which can be used with valgrind, as
well as directions for future work. It also fixes up inline literals to
actually be inline literals (and not italics). The content of this
documentation is primarily adapted from [1].

[1] https://lore.kernel.org/u-boot/57cb4b49-fa30-1194-9ac3-faa53e8033bd@gmail.com/

Signed-off-by: Sean Anderson <seanga2@gmail.com>
Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2 years agodoc/build/gcc: add more required packages
Heinrich Schuchardt [Thu, 26 May 2022 08:15:58 +0000 (10:15 +0200)]
doc/build/gcc: add more required packages

The following Python packages are used by U-Boot, too:

* python3-asteval
* python3-subunit
* python3-testtools

Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2 years agodoc: sandbox: Add a note of disabling LTO when using gdb
Bin Meng [Tue, 17 May 2022 16:21:29 +0000 (00:21 +0800)]
doc: sandbox: Add a note of disabling LTO when using gdb

Image created by LTO is not friendly to debugger, let's document this.

Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
Mention CONFIG_CC_OPTIMIZE_FOR_DEBUG and LLDB.
Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2 years agodoc: sandbox: Correct the memory size config option
Bin Meng [Tue, 17 May 2022 16:09:17 +0000 (00:09 +0800)]
doc: sandbox: Correct the memory size config option

It should be CONFIG_SANDBOX_RAM_SIZE_MB.

Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2 years agovalgrind: Disable on Risc-V
Sean Anderson [Fri, 27 May 2022 14:03:00 +0000 (10:03 -0400)]
valgrind: Disable on Risc-V

There are no defined instruction sequences in include/valgrind.h for
Risc-V, so CONFIG_VALGRIND will do nothing on this arch (and possibly won't
compile?). Update Kconfig accordingly.

Signed-off-by: Sean Anderson <seanga2@gmail.com>
Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2 years agotest: restore timeout after bootmenu unit test
Heinrich Schuchardt [Mon, 9 May 2022 19:59:13 +0000 (21:59 +0200)]
test: restore timeout after bootmenu unit test

In the bootmenu unit test the console timeout is set to 500 ms.
Other tests rely on the original timeout. Ensure that the original value
is restored.

Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2 years agodisk: incorrect message in is_gpt_valid()
Heinrich Schuchardt [Mon, 9 May 2022 19:35:44 +0000 (21:35 +0200)]
disk: incorrect message in is_gpt_valid()

alloc_read_gpt_entries() writes differentiated error messages.
The caller is_gpt_valid() should not write an extra possibly wrong message.

Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2 years agoMerge https://source.denx.de/u-boot/custodians/u-boot-riscv
Tom Rini [Fri, 27 May 2022 12:50:42 +0000 (08:50 -0400)]
Merge https://source.denx.de/u-boot/custodians/u-boot-riscv