u-boot.git/lib, branch v2025.04

efi_loader: stop network in EXIT_BOOT_SERVICES

2025-04-06T16:03:22+00:00

It has been reported that memory corruption can occurred because network
packages where received after EXIT_BOOT_SERVICES. See the thread
starting at [1].

We try to remove all drivers when EXIT_BOOT_SERVICES is called. But

* Some network drivers don't call their own stop method when removed.
* Some network drivers don't have a remove method.
* Some devices have CONFIG_DM_DEVICE_REMOVE=n.

Let's call eth_halt() in EXIT_BOOT_SERVICES explicitly.

[1]
https://lore.kernel.org/all/C101B675-EEE6-44CB-8A44-83F72182FBD6@kohlschutter.com/

Cc: Michael Brown 
Reported-by: Christian Kohlschütter 
Signed-off-by: Heinrich Schuchardt 
Reviewed-by: Michael Brown 
Reviewed-by: Ilias Apalodimas 
Tested-by: Christian Kohlschütter

mbedtls: remove incorrect attribute type checker

2025-04-06T16:02:57+00:00

S/MIME Capabilities (OID: 1.2.840.113549.1.9.15) attributes are
expected to be algorithms but neither data nor MS Inderect Data,
thus the checker for data type is incorrect.

This patch fixes a capsule authentication failure with PKCS#7
message that contains S/MIME capabilities, which formed by the EDK2
GenerateCapsule tool.

S/MIME Capabilities are not common attributes in an EFI capsule,
thus this failure cannot be reproduced with the capsules generated
via mkeficapsule.

Fixes: 7de0d155cce7 ("mbedtls: add PKCS7 parser porting layer")
Reported-by: Ilias Apalodimas 
Signed-off-by: Raymond Mao

efi_loader: fix ipv4 device path node conversion

2025-03-26T11:05:36+00:00

When converting an IPv4 device path node to text, the
EFI_DEVICE_PATH_TO_TEXT_PROTOCOL will produce the following string:

  IPv4(5.6.7.8,TCP,UDP,0x6,DHCP,1.2.3.4,9.10.11.12,255.255.255.0)

This string erroneously contains multiple protocols: TCP, UDP and 0x6.

Add the missing `break' statements in the dp_msging() function to fix this
and obtain the following expected string instead:

  IPv4(5.6.7.8,TCP,DHCP,1.2.3.4,9.10.11.12,255.255.255.0)

Fixes: aaf63429a112 ("efi_loader: add IPv4() to device path to text protocol")
Signed-off-by: Vincent Stehlé 
Cc: Heinrich Schuchardt 
Cc: Ilias Apalodimas 
Cc: Adriano Cordova 
Cc: Tom Rini 
Reviewed-by: Ilias Apalodimas 
Reviewed-by: Heinrich Schuchardt 
Reviewed-by: Andre Przywara 
Signed-off-by: Ilias Apalodimas

lmb: change the return code on lmb_alloc_addr()

2025-03-24T17:12:33+00:00

Ben reports a failure to boot the kernel on hardware that starts its
physical memory from 0x0.
The reason is that lmb_alloc_addr(), which is supposed to reserve a
specific address, takes the address as the first argument, but then also
returns the address for success or failure and treats 0 as a failure.

Since we already know the address change the prototype to return an int.

Reported-by: Ben Schneider 
Signed-off-by: Ilias Apalodimas 
Tested-by: Ben Schneider 
Reviewed-by: Sughosh Ganu

efi_loader: Move .dynamic out of .text in EFI

2025-03-17T08:22:06+00:00

EFI applications need to be relocatable. Ordinarily, this is achieved
through a PE-format .reloc section, but since that requires toolchain
tricks to achieve, U-Boot's EFI applications instead embed ELF-flavored
relocation information and use it for self-relocation; thus, the
.dynamic section needs to be preserved.

Before this patch, it was tacked on to the end of .text, but this was
not proper: A .text section is SHT_PROGBITS, while the .dynamic section
is SHT_DYNAMIC. Attempting to combine them like this creates a section
type mismatch. While GNU ld doesn't seem to complain, LLVM's lld
considers this a fatal linking error.

This patch moves .dynamic out to its own section, so that the output ELF
has the correct types. (They're all mashed together when converting to
binary anyway, so this patch causes no change in the final .efi output.)

Signed-off-by: Sam Edwards 
Cc: Heinrich Schuchardt

Merge tag 'efi-2025-04-rc4' of https://source.denx.de/u-boot/custodians/u-boot-efi

2025-03-03T13:47:37+00:00

CI:

* https://source.denx.de/u-boot/custodians/u-boot-efi/-/pipelines/24904

UEFI:

* Let efi_net_set_dp properly update the device path

Network:

* Avoid buffer overflows in wget_info with legacy TCP stack

efi_loader: efi_net: let efi_net_set_dp properly update the device path

2025-02-28T14:25:30+00:00

This commit fixes an use after free introduced in Commit e55a4acb54
(" efi_loader: net: set EFI bootdevice device path to HTTP when loaded
from wget"). The logic in efi_net_set_dp is reworked so that when the
function is invoked it not only changes the value of the static variable
net_dp (this is how the function was implemented in e55a4acb54) but also
updates the protocol interface of the device path protocol in case efi
has started.

Fixes: e55a4acb54e8 ("efi_loader: net: set EFI bootdevice device path to HTTP when loaded from wget")
Signed-off-by: Adriano Cordova

mbedtls: refactor mbedtls build for XPL

2025-02-27T18:11:02+00:00

Refactor the entire kconfig page for mbedtls, adapt mbedtls makefile
and default config file using 'XPL_', in order to have independent
mbedtls kconfig options in U-Boot Proper, SPL, TPL and VPL.
User can choose legacy or mbedtls libraries for them independently.

Set mbedtls native hashing libraries as default when MBEDTLS_LIB,
SPL_MBEDTLS_LIB, TPL_MBEDTLS_LIB or VPL_MBEDTLS_LIB is selected.

If users prefer using U-Boot legacy hashing libraries, please select
MBEDTLS_LIB_HASHING_ALT, SPL_MBEDTLS_LIB_HASHING_ALT,
TPL_MBEDTLS_LIB_HASHING_ALT or VPL_MBEDTLS_LIB_HASHING_ALT for U-Boot
Proper, SPL, TPL and VPL respectively.

Moreover, rename a few kconfig options and update their descriptions to
improve the consistency of terminology.

Signed-off-by: Raymond Mao 
Acked-by: Ilias Apalodimas

mbedtls: access mbedtls private members in mscode and pkcs7 parser

2025-02-27T18:11:02+00:00

U-Boot requires to access x509_internal.h, mbedtls_sha256_context and
mbedtls_sha1_context in the porting layer, and this requires to
enable MBEDTLS_ALLOW_PRIVATE_ACCESS.

Enable it to mscode and pkcs7_parser to fix a mbedtls internal building
error when X509 is selected.

Moreover, Move it to a separate file to avoid enabling it in multiple
places.

Signed-off-by: Raymond Mao 
Acked-by: Ilias Apalodimas

mbedtls: fix incorrect kconfig dependencies on mbedtls

2025-02-27T18:11:02+00:00

Fixed the building failures when WGET_HTTPS,NET_LWIP and MBEDTLS_LIB
are selected due to a few incorrect kconfig dependencies.

Signed-off-by: Raymond Mao 
Reviewed-by: Ilias Apalodimas