| Age | Commit message (Collapse) | Author |
|---|
|
This converts the following to Kconfig:
CONFIG_SPL_TARGET
Signed-off-by: Tom Rini <[email protected]>
|
|
This is not used anywhere, drop it.
Signed-off-by: Tom Rini <[email protected]>
|
|
There are no users of CONFIG_SPL_SPI_FLASH_MINIMAL only platforms
defining it, drop it.
Signed-off-by: Tom Rini <[email protected]>
|
|
This converts the following to Kconfig:
CONFIG_SPL_GD_ADDR
Signed-off-by: Tom Rini <[email protected]>
|
|
These are presumably private to non-upstream code, remove.
Signed-off-by: Tom Rini <[email protected]>
|
|
This is mostly unused. In the case where it is currently used, it means
the same as CONFIG_SPL_PAD_TO, which is already set for the platform.
Signed-off-by: Tom Rini <[email protected]>
|
|
This converts the following to Kconfig:
CONFIG_SYS_SPL_MALLOC_SIZE
CONFIG_SYS_SPL_MALLOC_START
We introduce a default value here as well, and CONFIG_SYS_SPL_MALLOC to
control if we have a malloc pool or not.
Signed-off-by: Tom Rini <[email protected]>
|
|
This converts the following to Kconfig:
CONFIG_SPL_BSS_START_ADDR
Signed-off-by: Tom Rini <[email protected]>
|
|
This converts the following to Kconfig:
CONFIG_SPL_RELOC_TEXT_BASE
CONFIG_SPL_RELOC_STACK
CONFIG_SPL_RELOC_MALLOC_ADDR
CONFIG_SPL_RELOC_MALLOC_SIZE
Signed-off-by: Tom Rini <[email protected]>
|
|
This converts the following to Kconfig:
CONFIG_TPL_NAND_INIT
Signed-off-by: Tom Rini <[email protected]>
|
|
Update the Kconfig entry to have the correct defaults for i.MX7
platforms, and move the existing large comment from imx7_spl.h to
doc/imx/common/imx7.txt so that it's not lost.
Signed-off-by: Tom Rini <[email protected]>
|
|
Update the Kconfig entry to have the correct defaults for i.MX6
platforms, and move the existing large comment from imx6_spl.h to
doc/imx/common/imx6.txt so that it's not lost.
Signed-off-by: Tom Rini <[email protected]>
|
|
This converts the following to Kconfig:
CONFIG_SPL_STACK
Signed-off-by: Tom Rini <[email protected]>
|
|
- Make all users of CUSTOM_SYS_INIT_SP_ADDR reference SYS_INIT_SP_ADDR
- Introduce HAS_CUSTOM_SYS_INIT_SP_ADDR to allow for setting the stack
pointer directly, otherwise we use the common calculation.
- On some platforms that were using the standard calculation but did not
set CONFIG_SYS_INIT_RAM_SIZE / CONFIG_SYS_INIT_RAM_ADDR, set them.
- On a small number of platforms that were not subtracting
GENERATED_GBL_DATA_SIZE do so now via the standard calculation.
- CONFIG_SYS_INIT_SP_OFFSET is now widely unused, so remove it from most
board config header files.
Signed-off-by: Tom Rini <[email protected]>
|
|
We have a number of CONFIG symbols today that are of the form:
SYM1 = CONST1 + CONST2
or other static math operations (shifts, etc). The issue is that by
moving these to Kconfig we no longer have the ability to calculate these
values, so they become less flexible and useful. It's also the case
that sometimes a platform will just define SYM1 directly or perform a
slightly different set of calculations. We introduce this header now to
have a place to start to handle these cases.
Signed-off-by: Tom Rini <[email protected]>
|
|
We have GENERATED_GBL_DATA_SIZE to tell us how large the generated
global data is, so do not use a hard-coded value of 1024 for it.
Signed-off-by: Tom Rini <[email protected]>
|
|
CONFIG_SYS_GBL_DATA_OFFSET
In the places where PowerPC references CONFIG_SYS_GBL_DATA_OFFSET it
does so as (CONFIG_SYS_INIT_RAM_ADDR + CONFIG_SYS_GBL_DATA_OFFSET). And
it defines CONFIG_SYS_GBL_DATA_OFFSET in the same manner that other
architectures define CONFIG_SYS_INIT_SP_OFFSET. Other architectures
define CONFIG_SYS_INIT_SP_ADDR as (CONFIG_SYS_INIT_RAM_ADDR +
CONFIG_SYS_INIT_SP_OFFSET) typically. Rename things within PowerPC for
consistency with other architectures.
Signed-off-by: Tom Rini <[email protected]>
|
|
This value is only referenced by PowerPC code in a way other than
directly as CONFIG_SYS_INIT_SP_ADDR. Switch to CONFIG_SYS_INIT_SP_ADDR
directly.
Signed-off-by: Tom Rini <[email protected]>
|
|
This value is only referenced by PowerPC code in a way other than
directly as CONFIG_SYS_INIT_SP_ADDR. Switch to CONFIG_SYS_INIT_SP_ADDR
directly.
Signed-off-by: Tom Rini <[email protected]>
|
|
In some cases, we define CONFIG_SYS_INIT_SP_ADDR differently for SPL or
full U-Boot. This case should be making use of CONFIG_SPL_STACK, as
that's what that variable is for. In a few other cases we define
CONFIG_SPL_STACK directly to CONFIG_SYS_INIT_SP_ADDR, but do not need to
as the code handles this correctly, normally.
Signed-off-by: Tom Rini <[email protected]>
|
|
The definition of CONFIG_SPL_BOOTROM_SAVE is always a fixed
CONFIG_SPL_STACK + 4, while CONFIG_SPL_STACK is not constant. This
change will make it clear where the location is still, once
CONFIG_SPL_STACK moves to Kconfig.
Cc: Stefan Roese <[email protected]>
Signed-off-by: Tom Rini <[email protected]>
|
|
There are no platforms that set this, remove the code.
Signed-off-by: Tom Rini <[email protected]>
|
|
This converts the following to Kconfig:
CONFIG_SPL_COMMON_INIT_DDR
Signed-off-by: Tom Rini <[email protected]>
|
|
A number of PowerPC platforms define this, for SPL. To move this to
Kconfig, it needs to be CONFIG_SPL_SYS_CCSR_DO_NOT_RELOCATE, so use
CONFIG_IS_ENABLED() to check for usage. A number of layerscape
platforms bring this logic from PowerPC, but only need a small part of
it, for the fman driver. Remove their unused portion at least.
Signed-off-by: Tom Rini <[email protected]>
|
|
This converts the following to Kconfig:
CONFIG_SPL_SYS_MALLOC_SIMPLE
The problem here is that a few platforms have been doing:
#ifdef CONFIG_SPL_BUILD
#define CONFIG_SYS_MALLOC_SIMPLE
#endif
instead of defining CONFIG_SPL_SYS_MALLOC_SIMPLE directly. Correct this
and update the documentation in a few places to match usage.
Signed-off-by: Tom Rini <[email protected]>
|
|
This converts the following to Kconfig:
CONFIG_SPL_BSS_MAX_SIZE
CONFIG_SPL_MAX_FOOTPRINT
Note that the da850evm platforms were violating the "only use one" rule
here, and so now hard-code their BSS limit.
Signed-off-by: Tom Rini <[email protected]>
|
|
This converts the following to Kconfig:
CONFIG_SPL_PAD_TO
CONFIG_SPL_MAX_SIZE
CONFIG_TPL_PAD_TO
CONFIG_TPL_MAX_SIZE
Note that we need to make TPL_MAX_SIZE be hex, and so move and convert the
existing places.
Signed-off-by: Tom Rini <[email protected]>
|
|
This converts the following to Kconfig:
CONFIG_SPL_FS_LOAD_ARGS_NAME
CONFIG_SPL_FS_LOAD_KERNEL_NAME
CONFIG_SPL_FS_LOAD_PAYLOAD_NAME
Signed-off-by: Tom Rini <[email protected]>
|
|
This converts the following to Kconfig:
CONFIG_SPL_NAND_RAW_ONLY
CONFIG_SPL_NAND_SOFTECC
Signed-off-by: Tom Rini <[email protected]>
|
|
This converts the following to Kconfig:
CONFIG_SPL_INIT_MINIMAL
CONFIG_SPL_FLUSH_IMAGE
CONFIG_SPL_SKIP_RELOCATE
Signed-off-by: Tom Rini <[email protected]>
|
|
This converts the following to Kconfig:
CONFIG_SYS_CFI_FLASH_STATUS_POLL
Signed-off-by: Tom Rini <[email protected]>
|
|
This converts the following to Kconfig:
CONFIG_SYS_FLASH_CFI_WIDTH
Signed-off-by: Tom Rini <[email protected]>
|
|
This is only referenced in non-SPL_DM cases, of which there are
currently none. Remove this option and slightly re-organize the code is
there is now never an if/else at the start of spl_sata_load_image()
Signed-off-by: Tom Rini <[email protected]>
|
|
This option is not referenced in code, remove it.
Signed-off-by: Tom Rini <[email protected]>
|
|
This symbol is not used anywhere, remove it.
Signed-off-by: Tom Rini <[email protected]>
|
|
This symbol has been unused in code for some time now, remove
the final references.
Signed-off-by: Tom Rini <[email protected]>
|
|
This is always defined to 2, and referenced in two places. Move the
define to <asm/omap_common.h> and make sure the code that uses this
includes that file. Make <asm/arch-omap*/clock.h> not include that
file, as we don't need to be doing so.
Signed-off-by: Tom Rini <[email protected]>
|
|
This converts the following to Kconfig:
CONFIG_SYS_BOOTPARAMS_LEN
Signed-off-by: Tom Rini <[email protected]>
|
|
This converts the following to Kconfig:
CONFIG_HUSH_INIT_VAR
Signed-off-by: Tom Rini <[email protected]>
|
|
This converts the following to Kconfig:
CONFIG_SYS_BARGSIZE
Signed-off-by: Tom Rini <[email protected]>
|
|
This converts the following to Kconfig:
CONFIG_SYS_CBSIZE
Signed-off-by: Tom Rini <[email protected]>
|
|
This converts the following to Kconfig:
CONFIG_SYS_PBSIZE
Signed-off-by: Tom Rini <[email protected]>
|
|
This converts the following to Kconfig:
CONFIG_SYS_MAXARGS
Signed-off-by: Tom Rini <[email protected]>
|
|
Nicolas Bidron and Nicolas Guigo reported the two bugs below:
"
----------BUG 1----------
In compiled versions of U-Boot that define CONFIG_IP_DEFRAG, a value of
`ip->ip_len` (IP packet header's Total Length) higher than `IP_HDR_SIZE`
and strictly lower than `IP_HDR_SIZE+8` will lead to a value for `len`
comprised between `0` and `7`. This will ultimately result in a
truncated division by `8` resulting value of `0` forcing the hole
metadata and fragment to point to the same location. The subsequent
memcopy will overwrite the hole metadata with the fragment data. Through
a second fragment, this can be exploited to write to an arbitrary offset
controlled by that overwritten hole metadata value.
This bug is only exploitable locally as it requires crafting two packets
the first of which would most likely be dropped through routing due to
its unexpectedly low Total Length. However, this bug can potentially be
exploited to root linux based embedded devices locally.
```C
static struct ip_udp_hdr *__net_defragment(struct ip_udp_hdr *ip, int *lenp)
{
static uchar pkt_buff[IP_PKTSIZE] __aligned(PKTALIGN);
static u16 first_hole, total_len;
struct hole *payload, *thisfrag, *h, *newh;
struct ip_udp_hdr *localip = (struct ip_udp_hdr *)pkt_buff;
uchar *indata = (uchar *)ip;
int offset8, start, len, done = 0;
u16 ip_off = ntohs(ip->ip_off);
/* payload starts after IP header, this fragment is in there */
payload = (struct hole *)(pkt_buff + IP_HDR_SIZE);
offset8 = (ip_off & IP_OFFS);
thisfrag = payload + offset8;
start = offset8 * 8;
len = ntohs(ip->ip_len) - IP_HDR_SIZE;
```
The last line of the previous excerpt from `u-boot/net/net.c` shows how
the attacker can control the value of `len` to be strictly lower than
`8` by issuing a packet with `ip_len` between `21` and `27`
(`IP_HDR_SIZE` has a value of `20`).
Also note that `offset8` here is `0` which leads to `thisfrag = payload`.
```C
} else if (h >= thisfrag) {
/* overlaps with initial part of the hole: move this hole */
newh = thisfrag + (len / 8);
*newh = *h;
h = newh;
if (h->next_hole)
payload[h->next_hole].prev_hole = (h - payload);
if (h->prev_hole)
payload[h->prev_hole].next_hole = (h - payload);
else
first_hole = (h - payload);
} else {
```
Lower down the same function, execution reaches the above code path.
Here, `len / 8` evaluates to `0` leading to `newh = thisfrag`. Also note
that `first_hole` here is `0` since `h` and `payload` point to the same
location.
```C
/* finally copy this fragment and possibly return whole packet */
memcpy((uchar *)thisfrag, indata + IP_HDR_SIZE, len);
```
Finally, in the above excerpt the `memcpy` overwrites the hole metadata
since `thisfrag` and `h` both point to the same location. The hole
metadata is effectively overwritten with arbitrary data from the
fragmented IP packet data. If `len` was crafted to be `6`, `last_byte`,
`next_hole`, and `prev_hole` of the `first_hole` can be controlled by
the attacker.
Finally the arbitrary offset write occurs through a second fragment that
only needs to be crafted to write data in the hole pointed to by the
previously controlled hole metadata (`next_hole`) from the first packet.
### Recommendation
Handle cases where `len` is strictly lower than 8 by preventing the
overwrite of the hole metadata during the memcpy of the fragment. This
could be achieved by either:
* Moving the location where the hole metadata is stored when `len` is
lower than `8`.
* Or outright rejecting fragmented IP datagram with a Total Length
(`ip_len`) lower than 28 bytes which is the minimum valid fragmented IP
datagram size (as defined as the minimum fragment of 8 octets in the IP
Specification Document:
[RFC791](https://datatracker.ietf.org/doc/html/rfc791) page 25).
----------BUG 2----------
In compiled versions of U-Boot that define CONFIG_IP_DEFRAG, a value of
`ip->ip_len` (IP packet header's Total Length) lower than `IP_HDR_SIZE`
will lead to a negative value for `len` which will ultimately result in
a buffer overflow during the subsequent `memcpy` that uses `len` as it's
`count` parameter.
This bug is only exploitable on local ethernet as it requires crafting
an invalid packet to include an unexpected `ip_len` value in the IP UDP
header that's lower than the minimum accepted Total Length of a packet
(21 as defined in the IP Specification Document:
[RFC791](https://datatracker.ietf.org/doc/html/rfc791)). Such packet
would in all likelihood be dropped while being routed to its final
destination through most routing equipment and as such requires the
attacker to be in a local position in order to be exploited.
```C
static struct ip_udp_hdr *__net_defragment(struct ip_udp_hdr *ip, int *lenp)
{
static uchar pkt_buff[IP_PKTSIZE] __aligned(PKTALIGN);
static u16 first_hole, total_len;
struct hole *payload, *thisfrag, *h, *newh;
struct ip_udp_hdr *localip = (struct ip_udp_hdr *)pkt_buff;
uchar *indata = (uchar *)ip;
int offset8, start, len, done = 0;
u16 ip_off = ntohs(ip->ip_off);
/* payload starts after IP header, this fragment is in there */
payload = (struct hole *)(pkt_buff + IP_HDR_SIZE);
offset8 = (ip_off & IP_OFFS);
thisfrag = payload + offset8;
start = offset8 * 8;
len = ntohs(ip->ip_len) - IP_HDR_SIZE;
```
The last line of the previous excerpt from `u-boot/net/net.c` shows
where the underflow to a negative `len` value occurs if `ip_len` is set
to a value strictly lower than 20 (`IP_HDR_SIZE` being 20). Also note
that in the above excerpt the `pkt_buff` buffer has a size of
`CONFIG_NET_MAXDEFRAG` which defaults to 16 KB but can range from 1KB to
64 KB depending on configurations.
```C
/* finally copy this fragment and possibly return whole packet */
memcpy((uchar *)thisfrag, indata + IP_HDR_SIZE, len);
```
In the above excerpt the `memcpy` overflows the destination by
attempting to make a copy of nearly 4 gigabytes in a buffer that's
designed to hold `CONFIG_NET_MAXDEFRAG` bytes at most which leads to a DoS.
### Recommendation
Stop processing of the packet if `ip_len` is lower than 21 (as defined
by the minimum length of a data carrying datagram in the IP
Specification Document:
[RFC791](https://datatracker.ietf.org/doc/html/rfc791) page 34)."
Add a check for ip_len lesser than 28 and stop processing the packet
in this case.
Such a check covers the two reported bugs.
Reported-by: Nicolas Bidron <[email protected]>
Signed-off-by: Fabio Estevam <[email protected]>
|
|
This commit fixes the following compile warnings
for the documentation.
./include/charset.h:276: warning: Function parameter or member 'size' not described in 'u16_strlcat'
./include/charset.h:276: warning: Excess function parameter 'count' description in 'u16_strlcat'
Signed-off-by: Masahisa Kojima <[email protected]>
Reviewed-by: Heinrich Schuchardt <[email protected]>
|
|
This helper function will be used to determine if the device is
removable media, initially for handling a short-path loading.
Signed-off-by: AKASHI Takahiro <[email protected]>
Reviewed-by: Heinrich Schuchardt <[email protected]>
|
|
|
|
Set kernel_comp_addr_r and kernel_comp_size for compressed kernel.
Adjust existing addresses for ramdisk, so that kernel_comp_addr_r
comes before the ramdisk image, since the decompressed kernel size
is known to us. This way we can allow big ramdisk image to be loaded.
Signed-off-by: Bin Meng <[email protected]>
Reviewed-by: Leo Yu-Chi Liang <[email protected]>
|
|
Set kernel_comp_addr_r and kernel_comp_size for compressed kernel.
Adjust existing addresses for ramdisk, so that kernel_comp_addr_r
comes before the ramdisk image, since the decompressed kernel size
is known to us. This way we can allow big ramdisk image to be loaded.
Update unleashed.rst to remove the manual environment configuration
for compressed kernel boot.
Signed-off-by: Bin Meng <[email protected]>
Reviewed-by: Leo Yu-Chi Liang <[email protected]>
|
|
Move kernel_comp_addr_r to an address that comes before the ramdisk
image, since the decompressed kernel size is known to us. This way
we can allow big ramdisk image to be loaded.
Signed-off-by: Bin Meng <[email protected]>
Reviewed-by: Leo Yu-Chi Liang <[email protected]>
|
