u-boot.git/common/spl, branch v2021.04-rc2

common: Drop asm/global_data.h from common header

2021-02-02T20:33:42Z

Move this out of the common header and include it only where needed. In a number of cases this requires adding "struct udevice;" to avoid adding another large header or in other cases replacing / adding missing header files that had been pulled in, very indirectly. Finally, we have a few cases where we did not need to include at all, so remove that include. Signed-off-by: Simon Glass Signed-off-by: Tom Rini

x86: spl: Add a function to find the text base

2021-02-01T07:11:41Z

It is useful to know the TEXT_BASE value for the image being loaded in TPL/SPL. Add a new spl_get_image_text_base() function to handle this. Make use of this in the x86 SPL handler, instead of having the logic there. Signed-off-by: Simon Glass Reviewed-by: Bin Meng

spl: Add functions for next and previous phase

2021-01-27T22:03:16Z

It is useful to be able to figure out which phase we are loading next and which phase we came from. Add some functions to handle this as well as returning the name of a phase. This allows messages like "Booting to x" where x is the next phase. At present, TPL says 'Jumping to U-Boot' at the end, when in fact it is jumping to SPL. This is confusing, so use the new functions to correct this. Tests for this will come with an upcoming minor SPL test refactor. Signed-off-by: Simon Glass

bootcount: allow to use this feature on TPL

2021-01-27T21:58:57Z

This commit add an option TPL_BOOTCOUNT_LIMIT to use bootcount on TPL. Signed-off-by: Philippe Reynes Reviewed-by: Simon Glass

sunxi: support loading with SPL > 32KB

2021-01-25T21:52:00Z

H616 supports and needs bigger SPL than 32 KiB, mostly due to big DRAM driver and need for PMIC configuration, which pulls several drivers which are not needed otherwise. spl_mmc_get_uboot_raw_sector() will now compare pre-configured size with that, reported in SPL header. If size in header is bigger, it will use that value instead. In the process of function rework, also add missing function argument. Signed-off-by: Andre Przywara Signed-off-by: Jernej Skrabec Reviewed-by: Samuel Holland

sunxi: Introduce common symbol for H6 like SoCs

2021-01-25T21:52:00Z

It turns out that there are at least 2 other SoCs which have basically the same memory map, similar clocks and other features as H6. It's very likely that we'll see more such SoCs in the future. In order to ease porting to new SoCs and lower ifdef clutter, introduce common symbol for them. Signed-off-by: Jernej Skrabec Reviewed-by: Samuel Holland Reviewed-by: Andre Przywara Signed-off-by: Andre Przywara

common: spl: spl_fit.c: report an error on hash check fail

2021-01-16T19:49:09Z

When the hash check fails on a loadable image, the SPL/TPL simply jump to the next one. This commit changes this behaviour, when the hash check fails on a loadable image, the function spl_load_simple_fit stops and report an error. Signed-off-by: Philippe Reynes Reviewed-by: Simon Glass

spl: Kconfig: Add SPL dependency to CONFIG_HANDOFF

2021-01-15T19:36:12Z

CONFIG_HANDOFF is used in u-boot proper to locate handoff info from SPL during pre-relocation init (in setup_spl_handoff). Add explicit dependency on CONFIG_SPL, to fix the following build error when CONFIG_HANDOFF && !CONFIG_SPL: common/board_f.c: In function ‘setup_spl_handoff’: common/board_f.c:283:4: error: ‘gd_t {aka struct global_data}’ has no member named ‘spl_handoff’ gd->spl_handoff = bloblist_find(BLOBLISTT_SPL_HANDOFF, ^~ Signed-off-by: Ovidiu Panait Reviewed-by: Simon Glass

spl: Drop bd_info in the data section

2021-01-05T19:24:40Z

This uses up space in the SPL binary but it always starts as zero. Also some boards cannot support data in TPL (e.g. Intel Apollo Lake). Use malloc() to allocate this structure instead, by moving the init a little later, after malloc() is inited. Make this function optional since it pulls in malloc(). This reduces the TPL binary size on coral by about 64 bytes Signed-off-by: Simon Glass

spl: fit: Prefer a malloc()'d buffer for loading images

2020-12-07T22:40:34Z

Fit images were loaded to a buffer provided by spl_get_load_buffer(). This may work when the FIT image is small and fits between the start of DRAM and SYS_TEXT_BASE. One problem with this approach is that the location of the buffer may be manipulated by changing the 'size' field of the FIT. A maliciously crafted FIT image could place the buffer over executable code and be able to take control of SPL. This is unacceptable for secure boot of signed FIT images. Another problem is with larger FIT images, usually containing one or more linux kernels. In such cases the buffer be be large enough so as to start before DRAM (Figure I). Trying to load an image in this case has undefined behavior. For example, on stm32mp1, the MMC controller hits a RX overrun error, and aborts loading. _________________ | FIT Image | | | /===================\ /=====================\ || DRAM || | DRAM | || || | | ||_________________|| SYS_TEXT_BASE | ___________________ | | | || FIT Image || | | || || | _________________ | SYS_SPL_MALLOC_START || _________________ || || malloc() data || ||| malloc() data ||| ||_________________|| |||_________________||| | | ||___________________|| | | | | Figure I Figure II One possibility that was analyzed was to remove the negative offset, such that the buffer starts at SYS_TEXT_BASE. This is not a proper solution because on a number of platforms, the malloc buffer() is placed at a fixed address, usually after SYS_TEXT_BASE. A large enough FIT image could cause the malloc()'d data to be overwritten (Figure II) when loading. /======================\ | DRAM | | | | | CONFIG_SYS_TEXT_BASE | | | | | ____________________ | CONFIG_SYS_SPL_MALLOC_START || malloc() data || || || || __________________ || ||| FIT Image ||| ||| ||| ||| ||| Figure III The solution proposed here is to replace the ad-hoc heuristics of spl_get_load_buffer() with malloc(). This provides two advantages: * Bounds checking of the buffer region * Guarantees the buffer does not conflict with other memory The first problem is solved by constraining the buffer such that it will not overlap currently executing code. This eliminates the chance of a malicious FIT being able to replace the executing SPL code prior to signature checking. The second problem is solved in conjunction with increasing CONFIG_SYS_SPL_MALLOC_SIZE. Since the SPL malloc() region is carefully crafted on a per-platform basis, the chances of memory conflicts are virtually eliminated. Signed-off-by: Alexandru Gagniuc