u-boot.git/cmd, branch v2022.07

i2c: fix stack buffer overflow vulnerability in i2c md command

2022-06-28T19:51:56+00:00

When running "i2c md 0 0 80000100", the function do_i2c_md parses the
length into an unsigned int variable named length. The value is then
moved to a signed variable:

    int nbytes = length;
    #define DISP_LINE_LEN 16
    int linebytes = (nbytes > DISP_LINE_LEN) ? DISP_LINE_LEN : nbytes;
    ret = dm_i2c_read(dev, addr, linebuf, linebytes);

On systems where integers are 32 bits wide, 0x80000100 is a negative
value to "nbytes > DISP_LINE_LEN" is false and linebytes gets assigned
0x80000100 instead of 16.

The consequence is that the function which reads from the i2c device
(dm_i2c_read or i2c_read) is called with a 16-byte stack buffer to fill
but with a size parameter which is too large. In some cases, this could
trigger a crash. But with some i2c drivers, such as drivers/i2c/nx_i2c.c
(used with "nexell,s5pxx18-i2c" bus), the size is actually truncated to
a 16-bit integer. This is because function i2c_transfer expects an
unsigned short length. In such a case, an attacker who can control the
response of an i2c device can overwrite the return address of a function
and execute arbitrary code through Return-Oriented Programming.

Fix this issue by using unsigned integers types in do_i2c_md. While at
it, make also alen unsigned, as signed sizes can cause vulnerabilities
when people forgot to check that they can be negative.

Signed-off-by: Nicolas Iooss 
Reviewed-by: Heiko Schocher

cmd: correct return value for printenv -e

2022-06-19T13:53:09+00:00

If printenv -e is executed and the specified variable is not found, the
return value $? of the command should be 1 (false).

Signed-off-by: Heinrich Schuchardt

bootmenu: use utf-8 for menu title

2022-05-31T05:57:02+00:00

The commit a3d0aa87acbe ("bootmenu: update bootmenu_entry structure")
changes the bootmenu title type from char to u16(UTF16 string)
to support EFI based system. If EFI_LOADER is not enabled,
printf("%ls") is not supported, so bootmenu does not appear
correctly.

This commit changes the type of menu title from u16(UTF16) to
utf-8 string and EFI strings is conveted into utf-8.

Fixes: a3d0aa87acbe ("bootmenu: update bootmenu_entry structure")
Signed-off-by: Masahisa Kojima 
Tested-by: Pali Rohar 
Reviewed-by: Heinrich Schuchardt

cmd/bootefi: correct command syntax

2022-05-28T08:59:27+00:00

For indicating the address and size of a memory region other commands use a
[:] syntax. Do the same for bootefi.

Fixes: 2058983689f0 ("cmd: bootefi: restore ability to boot arbitrary blob")
Signed-off-by: Heinrich Schuchardt

bootmenu: U-Boot console is enabled as default

2022-05-28T08:59:27+00:00

The commit 2158b0da220c ("bootmenu: add Kconfig option
not to enter U-Boot console") disables to enter U-Boot
console from bootmenu as default, this change affects the
existing bootmenu users.

This commit reverts the default behavior, the bootmenu can
enter U-Boot console same as before.
CMD_BOOTMENU_ENTER_UBOOT_CONSOLE is renamed
BOOTMENU_DISABLE_UBOOT_CONSOLE and depends on
AUTOBOOT_MENU_SHOW.

Fixes: 2158b0da220c ("bootmenu: add Kconfig option not to enter U-Boot console")
Signed-off-by: Masahisa Kojima 
Tested-by: Pali Rohar 
Reviewed-by: Ilias Apalodimas 
Reviewed-by: Heinrich Schuchardt

cmd/sbi: add implementation ID 6 - Coffer

2022-05-26T10:37:55+00:00

The sbi command displays the ID of the implementation of the RISC-V
Supervisor Binary Interface Specification. A new ID for Coffer has recently
been added.

Signed-off-by: Heinrich Schuchardt 
Reviewed-by: Leo Yu-Chi Liang

spi: spi_flash_probe_bus_cs() rely on DT for spi speed and mode

2022-05-23T13:33:10+00:00

Now, spi_flash_probe_bus_cs() relies on DT for spi speed and mode
and logically calls spi_get_bus_and_cs(). In case spi mode and speed are
not read from DT, make usage of spi_flash_probe() instead.

To sum-up:
 - Previous call tree was:
    spi_flash_probe() -> spi_flash_probe_bus_cs() -> spi_get_bus_and_cs()

 - Current call tree is:
    spi_flash_probe() -> _spi_get_bus_and_cs()
    spi_flash_probe_bus_cs() -> spi_get_bus_and_cs()

This patch impacts the following :
  - cmd/sf.c: if spi mode and/or speed is passed in argument of
    do_spi_flash_probe(), call spi_flash_probe() otherwise call
    spi_flash_probe_bus_cs().

  - drivers/net/fm/fm.c: as by default spi speed and mode was set to
    0 and a comment indicates that speed and mode are read from DT,
    use spi_flash_probe_bus_cs().

  - drivers/net/pfe_eth/pfe_firmware.c: spi speed and mode are not read
    from DT by all platforms using this driver, so keep legacy and replace
    spi_flash_probe_bus_cs() by spi_flash_probe();

  - drivers/net/sni_netsec.c : spi speed and mode are not read from DT,
    so replace spi_flash_probe_bus_cs() by spi_flash_probe().

  - drivers/usb/gadget/max3420_udc.c: Can't find any platform which make
    usage of this driver, nevertheless, keep legacy and replace
    spi_get_bus_and_cs() by _spi_get_bus_and_cs().

  - env/sf.c: a comment indicates that speed and mode are read
    from DT. So use spi_flash_probe_bus_cs().

Signed-off-by: Patrice Chotard 

Cc: Marek Behun 
Cc: Jagan Teki 
Cc: Vignesh R 
Cc: Joe Hershberger 
Cc: Ramon Fried 
Cc: Lukasz Majewski 
Cc: Marek Vasut 
Cc: Wolfgang Denk 
Cc: Simon Glass 
Cc: Stefan Roese 
Cc: "Pali Rohár" 
Cc: Konstantin Porotchkin 
Cc: Igal Liberman 
Cc: Bin Meng 
Cc: Pratyush Yadav 
Cc: Sean Anderson 
Cc: Anji J 
Cc: Biwen Li 
Cc: Priyanka Jain 
Cc: Chaitanya Sakinam

spi: spi-uclass: Add new spi_get_bus_and_cs() implementation

2022-05-23T13:33:10+00:00

Move legacy spi_get_bus_and_cs() code to _spi_get_bus_and_cs().

Add new spi_get_bus_and_cs() implementation which rely on DT
for speed and mode and don't need any drv_name nor dev_name
parameters. This will prepare the ground for next patch.

Update all callers to use _spi_get_bus_and_cs() to keep the
same behavior.

Signed-off-by: Patrice Chotard 

Cc: Marek Behun 
Cc: Jagan Teki 
Cc: Vignesh R 
Cc: Joe Hershberger 
Cc: Ramon Fried 
Cc: Lukasz Majewski 
Cc: Marek Vasut 
Cc: Wolfgang Denk 
Cc: Simon Glass 
Cc: Stefan Roese 
Cc: "Pali Rohár" 
Cc: Konstantin Porotchkin 
Cc: Igal Liberman 
Cc: Bin Meng 
Cc: Pratyush Yadav 
Cc: Sean Anderson 
Cc: Anji J 
Cc: Biwen Li 
Cc: Priyanka Jain 
Cc: Chaitanya Sakinam

cmd: mvebu: Hide bubt specific options when bubt is disabled

2022-05-16T09:31:33+00:00

CONFIG_MVEBU_NAND_BOOT, CONFIG_MVEBU_SPI_BOOT, CONFIG_MVEBU_MMC_BOOT and
CONFIG_MVEBU_UBOOT_DFLT_NAME are unused when CONFIG_CMD_MVEBU_BUBT is not
enabled. So hide them.

Signed-off-by: Pali Rohár 
Reviewed-by: Stefan Roese

Merge tag 'efi-2022-07-rc3-2' of https://source.denx.de/u-boot/custodians/u-boot-efi

2022-05-08T15:31:48+00:00

Pull request for efi-2022-07-rc3-2

UEFI:
* Fix build errors due to
  - using sed with non-standard extension for regular expression
  - target architecture not recognized for CROSS_COMPILE=armv7a-*
  - CONFIG_EVENT not selected
* add sha384/512 on certificate revocation

Others:
* factor out the user input handling in bootmenu command