lmb: handle more than one DRAM BANK

This fixes the automatic lmb initialization and reservation for boards
with more than one DRAM bank.

This fixes the CVE-2018-18439 and -18440 fixes that only allowed to load
files into the firs DRAM bank from fs and via tftp.

Found-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Signed-off-by: Simon Goldschmidt <simon.k.r.goldschmidt@gmail.com>
Tested-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Reviewed-by: Simon Glass <sjg@chromium.org>

diff --git a/common/bootm.c b/common/bootm.c
index a4618b6d2e176cd4dc46a828299c697af79bfc1f..7c7505f09204cdd10019b42f08bd8405f5026fed 100644 (file)
--- a/common/bootm.c
+++ b/common/bootm.c
@@ -59,8 +59,8 @@ static void boot_start_lmb(bootm_headers_t *images)
        mem_start = env_get_bootm_low();
        mem_size = env_get_bootm_size();
 
-       lmb_init_and_reserve(&images->lmb, (phys_addr_t)mem_start, mem_size,
-                            NULL);
+       lmb_init_and_reserve_range(&images->lmb, (phys_addr_t)mem_start,
+                                  mem_size, NULL);
 }
 #else
 #define lmb_reserve(lmb, base, size)

diff --git a/fs/fs.c b/fs/fs.c
index c05e6c85eda6af26eb8c46b2449b28b4be67eba7..0e9c2f1062c397f0cfb216f1d68124782b954a2e 100644 (file)
--- a/fs/fs.c
+++ b/fs/fs.c
@@ -454,8 +454,7 @@ static int fs_read_lmb_check(const char *filename, ulong addr, loff_t offset,
        if (len && len < read_len)
                read_len = len;
 
-       lmb_init_and_reserve(&lmb, gd->bd->bi_dram[0].start,
-                            gd->bd->bi_dram[0].size, (void *)gd->fdt_blob);
+       lmb_init_and_reserve(&lmb, gd->bd, (void *)gd->fdt_blob);
        lmb_dump_all(&lmb);
 
        if (lmb_alloc_addr(&lmb, addr, read_len) == addr)

diff --git a/include/lmb.h b/include/lmb.h
index e87c0b0ada0fc969a767848cf3ae82af7d85d12c..3b338dfee047f2eac753cea511c90afdccb84ad5 100644 (file)
--- a/include/lmb.h
+++ b/include/lmb.h
@@ -4,6 +4,8 @@
 #ifdef __KERNEL__
 
 #include <asm/types.h>
+#include <asm/u-boot.h>
+
 /*
  * Logical memory blocks.
  *
@@ -29,8 +31,9 @@ struct lmb {
 };
 
 extern void lmb_init(struct lmb *lmb);
-extern void lmb_init_and_reserve(struct lmb *lmb, phys_addr_t base,
-                                phys_size_t size, void *fdt_blob);
+extern void lmb_init_and_reserve(struct lmb *lmb, bd_t *bd, void *fdt_blob);
+extern void lmb_init_and_reserve_range(struct lmb *lmb, phys_addr_t base,
+                                      phys_size_t size, void *fdt_blob);
 extern long lmb_add(struct lmb *lmb, phys_addr_t base, phys_size_t size);
 extern long lmb_reserve(struct lmb *lmb, phys_addr_t base, phys_size_t size);
 extern phys_addr_t lmb_alloc(struct lmb *lmb, phys_size_t size, ulong align);

diff --git a/lib/lmb.c b/lib/lmb.c
index 7aff2c248fe2942841d764833f925182aa196e0f..b3b84e4d37d962297e45f18f31a0c07e8c4c9a48 100644 (file)
--- a/lib/lmb.c
+++ b/lib/lmb.c
@@ -98,12 +98,8 @@ void lmb_init(struct lmb *lmb)
        lmb->reserved.size = 0;
 }
 
-/* Initialize the struct, add memory and call arch/board reserve functions */
-void lmb_init_and_reserve(struct lmb *lmb, phys_addr_t base, phys_size_t size,
-                         void *fdt_blob)
+static void lmb_reserve_common(struct lmb *lmb, void *fdt_blob)
 {
-       lmb_init(lmb);
-       lmb_add(lmb, base, size);
        arch_lmb_reserve(lmb);
        board_lmb_reserve(lmb);
 
@@ -111,6 +107,37 @@ void lmb_init_and_reserve(struct lmb *lmb, phys_addr_t base, phys_size_t size,
                boot_fdt_add_mem_rsv_regions(lmb, fdt_blob);
 }
 
+/* Initialize the struct, add memory and call arch/board reserve functions */
+void lmb_init_and_reserve(struct lmb *lmb, bd_t *bd, void *fdt_blob)
+{
+#ifdef CONFIG_NR_DRAM_BANKS
+       int i;
+#endif
+
+       lmb_init(lmb);
+#ifdef CONFIG_NR_DRAM_BANKS
+       for (i = 0; i < CONFIG_NR_DRAM_BANKS; i++) {
+               if (bd->bi_dram[i].size) {
+                       lmb_add(lmb, bd->bi_dram[i].start,
+                               bd->bi_dram[i].size);
+               }
+       }
+#else
+       if (bd->bi_memsize)
+               lmb_add(lmb, bd->bi_memstart, bd->bi_memsize);
+#endif
+       lmb_reserve_common(lmb, fdt_blob);
+}
+
+/* Initialize the struct, add memory and call arch/board reserve functions */
+void lmb_init_and_reserve_range(struct lmb *lmb, phys_addr_t base,
+                               phys_size_t size, void *fdt_blob)
+{
+       lmb_init(lmb);
+       lmb_add(lmb, base, size);
+       lmb_reserve_common(lmb, fdt_blob);
+}
+
 /* This routine called with relocation disabled. */
 static long lmb_add_region(struct lmb_region *rgn, phys_addr_t base, phys_size_t size)
 {

diff --git a/net/tftp.c b/net/tftp.c
index eca801aa194eb7fb71b5ed8f1de31faaf12f3502..34488b76c8449bfadcec17000da44e41181d9f12 100644 (file)
--- a/net/tftp.c
+++ b/net/tftp.c
@@ -606,8 +606,7 @@ static int tftp_init_load_addr(void)
        struct lmb lmb;
        phys_size_t max_size;
 
-       lmb_init_and_reserve(&lmb, gd->bd->bi_dram[0].start,
-                            gd->bd->bi_dram[0].size, (void *)gd->fdt_blob);
+       lmb_init_and_reserve(&lmb, gd->bd, (void *)gd->fdt_blob);
 
        max_size = lmb_get_free_size(&lmb, load_addr);
        if (!max_size)