soc: xilinx: zynqmp: Add machine identification support
Add machine identification support based on the
zynqmp_get_silicon_idcode_name function and use the soc_get_machine
function of the soc uclass to get silicon idcode name for the fpga init.
Probe the driver before use to ensure that the driver is always
available and the global data are valid. Initialize the global data
with zero and probe the driver if the global data are still zero. This
allows a usage of the firmware functions from other drivers with
arbitrary order between the drivers.
"size-cells" of the nand controller node should be 0 as the "reg"
property of the nand device node contains the chip select number and not
address information.
The patch fixes the below compilation warning
arch/arm/dts/zynq-zc770-xm011.dtb: Warning (reg_format):
/axi/memory-controller@e000e000/nand-controller@0,0/nand@0:reg: property
has invalid length (4 bytes) (#address-cells == 1, #size-cells == 1)
arm64: zynqmp: Fix usb node drive strength and slew rate
As per design, all input/rx pins should have fast slew rate and 12mA
drive strength. Rest all pins should be slow slew rate and 4mA drive
strength. Fix usb nodes as per this and remove setting of slow slew rate
for all the usb gorup pins.
Michal Simek [Fri, 24 Jun 2022 12:16:32 +0000 (14:16 +0200)]
microblaze: Remove interrupt handler
The primary purpose for this code was timer. By converting it to
CONFIG_TIMER there is no code which uses this implementation that's why
remove it. If there is a need to handle interrupts this patch can be
reverted in future.
Michal Simek [Fri, 24 Jun 2022 12:16:32 +0000 (14:16 +0200)]
microblaze: Convert axi timer to DM driver
Move axi timer driver from Microblaze to generic location.
Origin implementation was irq based with counting down timer.
CONFIG_TIMER drivers are designed differently that timer is free running up
timer with automatic reload without any interrupt.
Information about clock rates are find out in timer_pre_probe() that's why
there is no need to get any additional information from DT in the driver
itself (only register offset).
Ovidiu Panait [Tue, 31 May 2022 18:14:35 +0000 (21:14 +0300)]
cpu: add CPU driver for microblaze
Add a basic CPU driver that retrieves information about the microblaze CPU
core. cpu_ops handlers are implemented so that the "cpu" command can work
properly:
U-Boot-mONStR> cpu list
0: cpu@0 MicroBlaze @ 50MHz, Rev: 11.0, FPGA family: zynq7000
U-Boot-mONStR> cpu detail
0: cpu@0 MicroBlaze @ 50MHz, Rev: 11.0, FPGA family: zynq7000
ID = 0, freq = 50 MHz: L1 cache, MMU
Note: cpu_ver_lookup[] and family_string_lookup[] arrays were imported from
linux.
Provide a static Kconfig value for the target FPGA archtitecture, as it is
done in Linux. The cpu-uclass driver will cross-check it with the value
read from PVR10 register.
Ovidiu Panait [Tue, 31 May 2022 18:14:32 +0000 (21:14 +0300)]
microblaze: cache: introduce flush_dcache_range()
Align microblaze with the other architectures and provide an
implementation for flush_dcache_range(). Also, remove the microblaze
exception in drivers/core/device.c.
Ovidiu Panait [Tue, 31 May 2022 18:14:31 +0000 (21:14 +0300)]
microblaze: cache: introduce cpuinfo structure
Introduce a minimal cpuinfo structure to hold cache related info. The
instruction/data cache size and cache line size are initialized early in
the boot to default Kconfig values. They will be overwritten with data
from PVR/dtb if the microblaze UCLASS_CPU driver is enabled.
The cpuinfo struct was placed in global_data to allow the microblaze
UCLASS_CPU driver to also run before relocation (initialized global data
should be read-only before relocation).
gd_cpuinfo() helper macro was added to avoid volatile
"-Wdiscarded-qualifiers" warnings when using the pointer directly.
Ovidiu Panait [Tue, 31 May 2022 18:14:30 +0000 (21:14 +0300)]
microblaze: cache: introduce flush_cache_all()
All flush_cache() calls in microblaze code are supposed to flush the
entire instruction and data caches, so introduce flush_cache_all()
helper to handle this.
Also, provide implementations for flush_dcache_all() and
invalidate_icache_all() so that icache and dcache u-boot commands can
work.
Ovidiu Panait [Tue, 31 May 2022 18:14:29 +0000 (21:14 +0300)]
microblaze: cache: introduce Kconfig options for icache/dcache sizes
Replace XILINX_DCACHE_BYTE_SIZE macro with two Kconfig symbols for
instruction and data caches sizes, respectively:
CONFIG_XILINX_MICROBLAZE0_ICACHE_SIZE
CONFIG_XILINX_MICROBLAZE0_DCACHE_SIZE
Also, get rid of the hardcoded value in icache_disable().
Ovidiu Panait [Tue, 31 May 2022 18:14:28 +0000 (21:14 +0300)]
microblaze: cache: split flush_cache() function
Factor out icache/dcache components from flush_cache() function. Call the
newly added __flush_icache()/__flush_dcache() functions inside
icache_disable() and dcache_disable(), respectively. There is no need to
flush both caches when disabling a particular cache type.
Ovidiu Panait [Tue, 31 May 2022 18:14:27 +0000 (21:14 +0300)]
microblaze: cache: improve icache Kconfig options
Replace CONFIG_ICACHE with a Kconfig option more limited in scope -
XILINX_MICROBLAZE0_USE_WIC. It should be enabled if the processor supports
the "wic" (Write to Instruction Cache) instruction. It will be used to
guard "wic" invocations in microblaze cache code.
Ovidiu Panait [Tue, 31 May 2022 18:14:26 +0000 (21:14 +0300)]
microblaze: cache: improve dcache Kconfig options
Replace CONFIG_DCACHE with a Kconfig option more limited in scope -
XILINX_MICROBLAZE0_USE_WDC. It should be enabled if the processor supports
the "wdc" (Write to Data Cache) instruction. It will be used to guard
"wdc" invocations in microblaze cache code.
Also, drop all ifdefs around flush_cache() calls and only keep one
CONFIG_IS_ENABLED() guard within flush_cache() itself.
Ovidiu Panait [Tue, 31 May 2022 18:14:22 +0000 (21:14 +0300)]
cmd: cpu: migrate cpu command to U_BOOT_CMD_WITH_SUBCMDS()
Migrate cpu command to use U_BOOT_CMD_WITH_SUBCMDS() helper macro, to
reduce duplicated code. This also fixes the cpu command on boards that
enable CONFIG_NEEDS_MANUAL_RELOC.
Michal Simek [Fri, 24 Jun 2022 12:15:01 +0000 (14:15 +0200)]
microblaze: Add support for run time relocation
Microblaze is using NEEDS_MANUAL_RELOC from the beginnging. This is causing
issues with function pointer arrays which need to be updated manually after
relocation. Building code with -fPIC and linking with -pic will remove this
limitation and there is no longer need to run manual update.
By default still old option is enabled but by disabling NEEDS_MANUAL_RELOC
code will be compiled for full relocation.
The patch does couple of things which are connected to each other.
- Define STATIC_RELA dependency to call relocate-rela to fill sections.
- REMAKE_ELF was already enabled but u-boot file can't be used because
sections are empty. relocate-rela will fill them and output file is
u-boot.elf which should be used.
- Add support for full relocation (u-boot.elf)
- Add support for early relocation when u-boot.bin is loaded to different
address then CONFIG_SYS_TEXT_BASE
- Add rela.dyn and dynsym sections
Disabling NEEDS_MANUAL_RELOC U-Boot size increased by 10% of it's original
size (550kB to 608kB).
Michal Simek [Fri, 24 Jun 2022 12:15:00 +0000 (14:15 +0200)]
tools: relocate-rela: Add support for 32bit Microblaze relocation
Microblaze is 32bit that's why it is using elf32 format. Relocation code
requires to get information about rela and dynsym senctions and also text
base which was used for compilation.
Code build with -fPIC and linked with -pic generates 4 relocation types.
R_MICROBLAZE_NONE is the easiest one which doesn't require any action.
R_MICROBLAZE_REL only requires write addend to r_offset address.
R_MICROBLAZE_32/R_MICROBLAZE_GLOB_DAT are the most complicated. There is a
need to find out symbol value with adding symbol value and write it to
address pointed by r_offset. Calculation with addend is also added but
only 0 addend values are generated now.
Michal Simek [Fri, 24 Jun 2022 12:15:00 +0000 (14:15 +0200)]
tools: relocate-rela: Extract elf64 reloc to special function
Adding support for new type requires to change code layout that's why move
elf64 code to own function for easier maintenance.
It also solves the problem with not calling fclose in case of error.
Return value from rela_elf64 is saved to variable that's why fclose() is
called all the time.
Michal Simek [Fri, 24 Jun 2022 12:15:00 +0000 (14:15 +0200)]
microblaze: Create SYM_ADDR macro to deal with symbols
Symbol handling depends on compilation flags. Right now manual relocation
is used that's why symbols can be referenced just by name and there is no
need to find them out. But when position independent code (PIC) is used
symbols need to be described differently. That's why having one macro
change is easier than changing the whole code.
Michal Simek [Fri, 24 Jun 2022 12:15:00 +0000 (14:15 +0200)]
microblaze: Add comment about reset location
Better to add comment to explain why reset vector points all the time to
origin U-Boot location.
If reset happens U-Boot should start from it's origin location.
Michal Simek [Fri, 24 Jun 2022 12:15:00 +0000 (14:15 +0200)]
microblaze: Remove _start symbol handling at U-Boot start
Right now U-Boot runs all the time from the same address where it is loaded
but going to full relocation code starting address doesn't need to be fixed
and can be simply discovered from reading PC register. That's why use r20
to get PC address and subtract offset from the beginning to get starting
address.
Michal Simek [Fri, 24 Jun 2022 12:15:00 +0000 (14:15 +0200)]
microblaze: Change stack protection address to new stack address
SLR low address is still setup to 0 that's why only high limit should be
updated. STACK_SIZE macro is present and could be possible used for
low address alignment but it is not done by this patch.
Michal Simek [Fri, 24 Jun 2022 12:15:00 +0000 (14:15 +0200)]
microblaze: Separate code end substraction
Follow up patch will convert symbol handling that's why it is necessary to
separate logic around symbols to special instruction. It adds 4B for new
instruction but it is worth to do it to have code ready for for full
relocation.
Michal Simek [Fri, 24 Jun 2022 12:14:59 +0000 (14:14 +0200)]
microblaze: Enable REMAKE_ELF
Enable u-boot.elf recreation from u-boot.bin to prepare for removing manul
relocation. Enable option for big endian configuration but it is not used
too much that's why it is completely untested.
By supporting this system there is a need to define LITTLE/BIG endian
Kconfig options to pass -EL/-EB flags.
Full command line for u-boot.elf recreation looks like this:
microblazeel-xilinx-linux-gnu-objcopy -I binary -B microblaze \
-O elf32-microblazeel u-boot.bin u-boot-elf.o
Michal Simek [Fri, 24 Jun 2022 12:14:59 +0000 (14:14 +0200)]
microblaze: Fix early stack allocation
CONFIG_SYS_INIT_SP_OFFSET macro place stack to TEXT_BASE - SYS_MALLOC_F_LEN
but there is no reason to do it now because board_init_f_alloc_reserve()
returns exact location where stack should be. That's why stack location is
calculated at run time and there is no need to hardcode it via macro. This
change will help with placing U-Boot to any address.
Michal Simek [Fri, 24 Jun 2022 12:14:59 +0000 (14:14 +0200)]
microblaze: Fix stack protection behavior
When U-Boot starts stack protection can be already enabled that's why setup
the lowest possible SLR value which is address 0. And the highest possible
stack in front of U-Boot. That's why you should never load U-Boot to the
beginning of DDR. There must be some space reserved. Code is using this
location for early malloc space, early global data and stack.
Michal Simek [Fri, 24 Jun 2022 12:14:59 +0000 (14:14 +0200)]
tools: relocate-rela: Read rela start/end directly from ELF
There is no need to pass section information via parameters.
Let's read text base and rela start/end directly from elf.
It will help with reading other information from ELF for others
architecture. Input to relocate-rela is u-boot binary and u-boot ELF.
Michal Simek [Fri, 24 Jun 2022 12:14:59 +0000 (14:14 +0200)]
Makefile: Fix description for relocate-rela parameters
Numbers in comment are shifter which is visible from command which calls
them. Also relocate-rela usage is describing them.
"Usage: %s <bin file> <text base> <rela start> <rela end>"
pinctrl: zynqmp: Add support for output-enable and bias-high-impedance
Add support to handle 'output-enable' and 'bias-high-impedance'
configurations. DT property output-enable brings out the pins from
tri-state, whereas bias-high-impedance changes the pins state to
tri-state.
Michal Simek [Fri, 24 Jun 2022 12:14:25 +0000 (14:14 +0200)]
arm64: zynqmp: Enable DP for kv260-revA board
DP is enabled for revB and should be enabled for kv260-revA too. Changes in
other boards were done by commit 8b82a3a7feb0 ("arm64: zynqmp: Enable DP
driver for SOMs").
Michal Simek [Wed, 18 May 2022 10:49:26 +0000 (12:49 +0200)]
arm64: zynqmp: Add support for kr260 revA/B boards
Board is using kv260 design for couple of parts defined by spec like i2c
eeproms, ina260, uart, etc.
Board has 4 gems. One gem connected via PS SGMII(GT), another PS RGMII(MIO)
and 2 via EMIO. First two shares the same MIO lines for PHYs. PL based one
have separate EMIO lines via PL.
Also two USB 3.0 with usb hubs are present. USB phys and USB hubs should
have separate reset line. The first usb0 hub also has USB-SD controller
(usb2244) connected to port 0.
To test compatibility with k26 you can run:
fdtoverlay -o /tmp/output.dtb -i arch/arm/dts/zynqmp-sm-k26-revA.dtb \
arch/arm/dts/zynqmp-sck-kr-g-revA.dtbo
Also add support for kr260-revB board. Based on FRU it is revision B
but schematics can be label as revA03.
Changes in revB are:
- SFP light
- GEM2/3 TX_CLK fixes
- PMOD/RPI connector fixes
- Replace si5332 with oscilators
T Karthik Reddy [Tue, 10 May 2022 11:26:10 +0000 (13:26 +0200)]
net: xilinx: axi_emaclite: Use shared MDIO bus support for axi emaclite driver
CONFIG_DM_ETH_PHY enables support to utilize generic ethernet phy
framework. Though if ethernet PHY node is in other ethernet node, it
will use shared MDIO to access the PHY of other ethernet. Move ethernet
print info statement from plat function to probe function, as phyaddr is
not enumerated when CONFIG_DM_ETH_PHY is enabled.
T Karthik Reddy [Tue, 10 May 2022 11:26:09 +0000 (13:26 +0200)]
net: xilinx: axi_emac: Use shared MDIO bus support for axi emac driver
CONFIG_DM_ETH_PHY enables support to utilize generic ethernet phy
framework. Though if ethernet PHY node is in other ethernet node, it
will use shared MDIO to access the PHY of other ethernet. Move ethernet
print info statement from plat function to probe function, as phyaddr is
not enumerated when CONFIG_DM_ETH_PHY is enabled.
Tom Rini [Tue, 14 Jun 2022 17:59:23 +0000 (13:59 -0400)]
dtoc: Update test_src_scan.py for new tegra compatibles
This test was written to match up with the list of compatibles in
drivers/i2c/tegra_i2c.c so adding another one requires the test to be
updated to match.
Fixes: 0d2105ae5e32 ("arm: tegra: Update some DT compatibles") Signed-off-by: Tom Rini <trini@konsulko.com>
Tom Rini [Mon, 13 Jun 2022 13:33:37 +0000 (09:33 -0400)]
Merge tag 'efi-2022-07-rc5' of https://source.denx.de/u-boot/custodians/u-boot-efi
Pull request for efi-2022-07-rc5
UEFI:
* Ignore OsIndications if CONFIG_EFI_IGNORE_OSINDICATIONS=y
* Correct UEFI default binary name
* Let efidebug create boot options without file path
* Support booting with a boot option with shortened device only device path
Sughosh Ganu [Wed, 1 Jun 2022 18:00:41 +0000 (23:30 +0530)]
EFI: FMP: Use a common GetImageInfo function for FIT and raw images
The GetImageInfo function definitions for the FIT images and raw
images are the same. Use a common function for the both the Firmware
Management Protocol(FMP) instances for raw and FIT images.
Signed-off-by: Sughosh Ganu <sughosh.ganu@linaro.org> Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Sughosh Ganu [Wed, 1 Jun 2022 18:00:39 +0000 (23:30 +0530)]
EFI: Do not consider OsIndications variable if CONFIG_EFI_IGNORE_OSINDICATIONS is enabled
The EFI_IGNORE_OSINDICATIONS config symbol was introduced as a
mechanism to have capsule updates work even on platforms where the
SetVariable runtime service was not supported. The current logic
requires the OsIndications variable to have been set to a 64 bit value
even when the EFI_IGNORE_OSINDICATIONS config is enabled. Return an
error code on not being able to read the variable only when
EFI_IGNORE_OSINDICATIONS is not enabled.
Signed-off-by: Sughosh Ganu <sughosh.ganu@linaro.org> Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Marek Vasut [Sun, 10 Apr 2022 04:27:14 +0000 (06:27 +0200)]
misc: Port USB251xB/xBi Hi-Speed Hub Controller Driver from Linux
This patch adds a driver for configuration of the Microchip USB251xB/xBi
USB 2.0 hub controller series with USB 2.0 upstream connectivity, SMBus
configuration interface and two to four USB 2.0 downstream ports.
This is ported from Linux as of Linux kernel commit 5c2b9c61ae5d8 ("usb: usb251xb: add boost-up property support")
Signed-off-by: Marek Vasut <marex@denx.de> Cc: Bin Meng <bmeng.cn@gmail.com> Cc: Michal Simek <michal.simek@xilinx.com> Cc: Simon Glass <sjg@chromium.org>
Chunfeng Yun [Fri, 27 May 2022 01:52:09 +0000 (09:52 +0800)]
usb: xhci-mtk: disable all ports when disable host controller
This is used to avoid the ports status of IPPC being brought in kernel
stage, it may cause ports error especially when the xhci controller is
a component of dual-role controller.
watchdog: Fix SPL build with watchdog disabled in asm files
Allow to compile assembler files in SPL build which calls WATCHDOG_RESET
function when watchdog is disabled in SPL and enabled in U-Boot proper.
This issue was fixed in past by commit 7fbd42f5afc4 ("watchdog: Handle SPL
build with watchdog disabled") for C source files, but not for assembler
source files.
Currently the only assembler source file which calls WATCHDOG_RESET is
arch/powerpc/lib/ticks.S, so this patch affects and fixes powerpc SPL
builds.
Signed-off-by: Pali Rohár <pali@kernel.org> Reviewed-by: Stefan Roese <sr@denx.de>
Two defconfigs were missed when transitioning the SYS_FMAN_FW_ADDR
symbol to Kconfig. CONFIG_SYS_FMAN_FW_ADDR is currently initialized to
0 by default on these builds, which prevents the firmware from loading.
Add the correct symbols to these defconfigs.
Fixes: a97a071d10d2b ("configs: fsl: migrate FMAN/QE specific defines to Kconfig") Signed-off-by: Camelia Groza <camelia.groza@nxp.com>
Michal Simek [Mon, 6 Jun 2022 07:31:27 +0000 (09:31 +0200)]
xilinx: fru: Replace spaces with \0 in detected revision
Also fix board revision field where spaces are used instead of \0.
The same change was done for board name by commit 530560b6f8eb ("xilinx:
fru: Replace spaces with \0 in detected name").
Vincent Stehlé [Tue, 31 May 2022 07:55:34 +0000 (09:55 +0200)]
efi: test/py: authenticate fit capsules
Add support for the authentication of UEFI capsules containing FIT images.
The authentication code is moved out of the function handling raw images
into a new function efi_firmware_capsule_authenticate(). The special case
for the FMP header coming from edk2 tools is preserved. There is no
functional change for capsules containing raw images.
The python test for signed capsules with raw images is renamed with no
functional change and a new test is added for signed capsules containing
FIT images.
This can be tested with sandbox64_defconfig or sandbox_flattree_defconfig,
plus CONFIG_EFI_CAPSULE_AUTHENTICATE=y.
Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com> Cc: Heinrich Schuchardt <xypron.glpk@gmx.de>
Vincent Stehlé [Tue, 31 May 2022 07:55:33 +0000 (09:55 +0200)]
test/py: efi_capsule: repair image authentication test
Repair the python tests for authenticated EFI capsules, which can be run
with sandbox_defconfig plus CONFIG_EFI_CAPSULE_AUTHENTICATE=y.
- Account for the reset changes done by commit 3e6f81000672 ("efi_loader:
test/py: Reset system after capsule update on disk").
- Fix the capsule GUID typo introduced by commit 2e9c3c6965ba ("test:
capsule: Modify the capsule tests to use GUID values for sandbox").
Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com> Cc: Heinrich Schuchardt <xypron.glpk@gmx.de>
Sughosh Ganu [Tue, 31 May 2022 07:15:35 +0000 (12:45 +0530)]
EFI: Update the documentation to reflect the correct value of OsIndications
The OsIndications is a 64 bit variable, and the current code expects
the value of the variable to be 64 bit. Update the documentation to
reflect this fact.
Signed-off-by: Sughosh Ganu <sughosh.ganu@linaro.org> Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Sughosh Ganu [Tue, 31 May 2022 07:15:33 +0000 (12:45 +0530)]
EFI: Populate descriptor_count value only when image_info_size is not zero
The GetImageInfo function of the Firmware Mangement Protocol(FMP) gets
called initially to query the size of the image descriptor array that
would have to be allocated. During this call, the rest of the function
arguments, specifically pointers might be passed as NULL. Do not
populate the descriptor_count value before it is known that the call
to GetImageInfo has been made with the allocated buffer for the image
descriptors.
Signed-off-by: Sughosh Ganu <sughosh.ganu@linaro.org> Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Chris Packham [Wed, 25 May 2022 01:08:51 +0000 (13:08 +1200)]
doc: environment: Fix typo
"valu" should be "value".
Signed-off-by: Chris Packham <judge.packham@gmail.com> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Add a new device tree property "u-boot,version" in the chosen node to
pass the U-Boot version to the operating system.
This can be useful to implement a firmware upgrade procedure from the
operating system.
Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com> Reviewed-by: Tom Rini <trini@konsulko.com>
Fabio Estevam [Thu, 26 May 2022 14:14:37 +0000 (11:14 -0300)]
net: Check for the minimum IP fragmented datagram size
Nicolas Bidron and Nicolas Guigo reported the two bugs below:
"
----------BUG 1----------
In compiled versions of U-Boot that define CONFIG_IP_DEFRAG, a value of
`ip->ip_len` (IP packet header's Total Length) higher than `IP_HDR_SIZE`
and strictly lower than `IP_HDR_SIZE+8` will lead to a value for `len`
comprised between `0` and `7`. This will ultimately result in a
truncated division by `8` resulting value of `0` forcing the hole
metadata and fragment to point to the same location. The subsequent
memcopy will overwrite the hole metadata with the fragment data. Through
a second fragment, this can be exploited to write to an arbitrary offset
controlled by that overwritten hole metadata value.
This bug is only exploitable locally as it requires crafting two packets
the first of which would most likely be dropped through routing due to
its unexpectedly low Total Length. However, this bug can potentially be
exploited to root linux based embedded devices locally.
/* payload starts after IP header, this fragment is in there */
payload = (struct hole *)(pkt_buff + IP_HDR_SIZE);
offset8 = (ip_off & IP_OFFS);
thisfrag = payload + offset8;
start = offset8 * 8;
len = ntohs(ip->ip_len) - IP_HDR_SIZE;
```
The last line of the previous excerpt from `u-boot/net/net.c` shows how
the attacker can control the value of `len` to be strictly lower than
`8` by issuing a packet with `ip_len` between `21` and `27`
(`IP_HDR_SIZE` has a value of `20`).
Also note that `offset8` here is `0` which leads to `thisfrag = payload`.
```C
} else if (h >= thisfrag) {
/* overlaps with initial part of the hole: move this hole */
newh = thisfrag + (len / 8);
*newh = *h;
h = newh;
if (h->next_hole)
payload[h->next_hole].prev_hole = (h - payload);
if (h->prev_hole)
payload[h->prev_hole].next_hole = (h - payload);
else
first_hole = (h - payload);
} else {
```
Lower down the same function, execution reaches the above code path.
Here, `len / 8` evaluates to `0` leading to `newh = thisfrag`. Also note
that `first_hole` here is `0` since `h` and `payload` point to the same
location.
```C
/* finally copy this fragment and possibly return whole packet */
memcpy((uchar *)thisfrag, indata + IP_HDR_SIZE, len);
```
Finally, in the above excerpt the `memcpy` overwrites the hole metadata
since `thisfrag` and `h` both point to the same location. The hole
metadata is effectively overwritten with arbitrary data from the
fragmented IP packet data. If `len` was crafted to be `6`, `last_byte`,
`next_hole`, and `prev_hole` of the `first_hole` can be controlled by
the attacker.
Finally the arbitrary offset write occurs through a second fragment that
only needs to be crafted to write data in the hole pointed to by the
previously controlled hole metadata (`next_hole`) from the first packet.
### Recommendation
Handle cases where `len` is strictly lower than 8 by preventing the
overwrite of the hole metadata during the memcpy of the fragment. This
could be achieved by either:
* Moving the location where the hole metadata is stored when `len` is
lower than `8`.
* Or outright rejecting fragmented IP datagram with a Total Length
(`ip_len`) lower than 28 bytes which is the minimum valid fragmented IP
datagram size (as defined as the minimum fragment of 8 octets in the IP
Specification Document:
[RFC791](https://datatracker.ietf.org/doc/html/rfc791) page 25).
----------BUG 2----------
In compiled versions of U-Boot that define CONFIG_IP_DEFRAG, a value of
`ip->ip_len` (IP packet header's Total Length) lower than `IP_HDR_SIZE`
will lead to a negative value for `len` which will ultimately result in
a buffer overflow during the subsequent `memcpy` that uses `len` as it's
`count` parameter.
This bug is only exploitable on local ethernet as it requires crafting
an invalid packet to include an unexpected `ip_len` value in the IP UDP
header that's lower than the minimum accepted Total Length of a packet
(21 as defined in the IP Specification Document:
[RFC791](https://datatracker.ietf.org/doc/html/rfc791)). Such packet
would in all likelihood be dropped while being routed to its final
destination through most routing equipment and as such requires the
attacker to be in a local position in order to be exploited.
/* payload starts after IP header, this fragment is in there */
payload = (struct hole *)(pkt_buff + IP_HDR_SIZE);
offset8 = (ip_off & IP_OFFS);
thisfrag = payload + offset8;
start = offset8 * 8;
len = ntohs(ip->ip_len) - IP_HDR_SIZE;
```
The last line of the previous excerpt from `u-boot/net/net.c` shows
where the underflow to a negative `len` value occurs if `ip_len` is set
to a value strictly lower than 20 (`IP_HDR_SIZE` being 20). Also note
that in the above excerpt the `pkt_buff` buffer has a size of
`CONFIG_NET_MAXDEFRAG` which defaults to 16 KB but can range from 1KB to
64 KB depending on configurations.
```C
/* finally copy this fragment and possibly return whole packet */
memcpy((uchar *)thisfrag, indata + IP_HDR_SIZE, len);
```
In the above excerpt the `memcpy` overflows the destination by
attempting to make a copy of nearly 4 gigabytes in a buffer that's
designed to hold `CONFIG_NET_MAXDEFRAG` bytes at most which leads to a DoS.
### Recommendation
Stop processing of the packet if `ip_len` is lower than 21 (as defined
by the minimum length of a data carrying datagram in the IP
Specification Document:
[RFC791](https://datatracker.ietf.org/doc/html/rfc791) page 34)."
Add a check for ip_len lesser than 28 and stop processing the packet
in this case.
Such a check covers the two reported bugs.
Reported-by: Nicolas Bidron <nicolas.bidron@nccgroup.com> Signed-off-by: Fabio Estevam <festevam@denx.de>
Andre Przywara [Mon, 9 May 2022 16:08:49 +0000 (17:08 +0100)]
armv8: Fix TCR 64-bit writes
The AArch64 TCR_ELx register is a 64-bit register, and many newer
architecture features use bits in the upper half. So far U-Boot was
igorant of those bits, trying to leave them alone.
However, in an effort to set bit 31 to 1, it failed doing so, because
the compiler sign-extended "1 << 31", so that all bits[63:31] got set.
Older ARMv8.0 cores don't define anything dangerous up there, but newer
architecture revisions do, and setting all those bits will end badly:
=================
$ qemu-system-aarch64 -cpu max ....
U-Boot 2022.07-rc1 (May 09 2022 - 15:21:00 +0100)
DRAM: 1.5 GiB
================= (hangs here)
Defining TCR_ELx_RSVD to "1U << 31" avoids the sign-extension, so all
upper bits stay at a safe 0 value. This means no more surprises when
U-Boot runs on a more capable CPU core.
Reported-by: Balaji Anandapadmanaban <Balaji.Anandapadmanaban@arm.com> Signed-off-by: Andre Przywara <andre.przywara@arm.com> Reviewed-by: Peng Fan <peng.fan@nxp.com> Tested-by: Peter Collingbourne <pcc@google.com> Reviewed-by: Peter Collingbourne <pcc@google.com>
projects / u-boot.git / log