aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2020-12-10Merge tag 'efi-next' of https://gitlab.denx.de/u-boot/custodians/u-boot-efi ↵WIP/10Dec2020-nextTom Rini15-298/+1191
into next Pull request for UEFI sub-system for next Bug fixes * avoid corruption of FAT file system when using long names * correct values for RuntimeServicesSupport concerning UEFI capsule update * link partition to block device via EFI_OPEN_PROTOCOL_BY_CHILD_CONTROLLER New feature * support EFI_LOAD_FILE_PROTOCOL in LoadImage() boot service
2020-12-10efi_loader: link partition to block deviceHeinrich Schuchardt1-0/+20
We provide a UEFI driver for block devices. When ConnectController() is called for a handle with the EFI_BLOCK_IO_PROTOCOL this driver creates the partitions. When DisconnectController() is called the handles for the partitions have to be deleted. This requires that the child controllers (partitions) open the EFI_BLOCK_IO_PROTOCOL of the controller (block IO device) with attribute EFI_OPEN_PROTOCOL_BY_CHILD_CONTROLLER. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-12-10efi_loader: make efi_protocol_open() non-staticHeinrich Schuchardt2-1/+6
Provide efi_protocol_open() as library function. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-12-10efi_selftest: test EFI_LOAD_FILE_PROTOCOLHeinrich Schuchardt2-0/+478
A unit test is supplied to test the support for the EFI_LOAD_FILE_PROTOCOL and the EFI_LOAD_FILE2_PROTOCOL by the LoadImage() boot service. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-12-10efi_selftest: clean up MakefileHeinrich Schuchardt1-8/+6
Bring all obj-y entries together. Sort *.o targets. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-12-10efi_loader: support EFI_LOAD_FILE_PROTOCOLHeinrich Schuchardt1-1/+48
Support loading images via the EFI_LOAD_FILE_PROTOCOL and EFI_LOAD_FILE2_PROTOCOL. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-12-10efi_loader: carve out efi_load_image_from_file()Heinrich Schuchardt1-9/+36
efi_load_image_from_file() should read via either of: * EFI_SIMPLE_FILE_SYSTEM_PROTOCOL * EFI_LOAD_FILE_PROTOCOL * EFI_LOAD_FILE2_PROTOCOL To make the code readable carve out a function to load the image via the file system protocol. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-12-10efi_loader: pass boot_policy to efi_load_image_from_pathHeinrich Schuchardt1-7/+9
Implementing support for loading images via the EFI_LOAD_FILE_PROTOCOL requires the boot policy as input for efi_load_image_from_path(). Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-12-10efi_loader: move EFI_LOAD_FILE2_PROTOCOL_GUIDHeinrich Schuchardt4-6/+10
The EFI_LOAD_FILE_PROTOCOL_GUID and EFI_LOAD_FILE2_PROTOCOL_GUID are needed to complement the implementation of the LoadFile() boot service. Remove a duplicate declaration of a variable for the EFI_LOAD_FILE2_PROTOCOL_GUID. Move the remaining declaration to efi_boottime.c. Add a variable for the EFI_LOAD_FILE_PROTOCOL_GUID. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-12-10efi_loader: resequence functions in efi_boottime.cHeinrich Schuchardt1-82/+82
For implementing support for the EFI_LOAD_FILE_PROTOCOL in the LoadImage() service we will have to call the LocateDevicePath() service. To avoid a forward declaration resequence the functions. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-12-10efi_loader: remove EFI_HII_CONFIG_ROUTING_PROTOCOLHeinrich Schuchardt3-7/+8
Our implementation of the EFI_HII_CONFIG_ROUTING_PROTOCOL is a mere stub, where all services return an error code. The protocol is neither needed for the EFI shell nor for the UEFI SCT. To reduce the code size remove it from the U-Boot binary. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-12-10efi_loader: don't set EFI_RT_SUPPORTED_UPDATE_CAPSULEHeinrich Schuchardt1-4/+0
The EFI_RT_PROPERTIES_TABLE configuration table indicates which runtime services are available at runtime. Even if CONFIG_EFI_RUNTIME_UPDATE_CAPSULE=y, we neither support UpdateCapsule() nor QueryCapsuleCapabilities() at runtime. Thus we should not set the corresponding flags EFI_RT_SUPPORTED_UPDATE_CAPSULE and EFI_RT_SUPPORTED_QUERY_CAPSULE_CAPABILITIES in RuntimeServicesSupported. Fixes: 2bc27ca8a04a ("efi_loader: define UpdateCapsule api") Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-12-10fs: fat: deletion of long file namesHeinrich Schuchardt1-12/+76
Long file names are stored in multiple directory entries. When deleting a file we must delete all of them. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-12-10fs: fat: first dentry of long name in FAT iteratorHeinrich Schuchardt1-2/+18
A long name is split over multiple directory entries. When deleting a file with a long name we need the first directory entry to be able to delete the whole chain. Add the necessary fields to the FAT iterator: * cluster of first directory entry * address of first directory entry * remaining entries in cluster Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-12-10fs: fat: use constant DELETED_FLAGHeinrich Schuchardt1-1/+1
When deleting a directory entry 0xe5 is written to name[0]. We have a constant for this value and should use it consistently. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-12-10fs: fat: search file should not allocate clusterHeinrich Schuchardt1-23/+6
Searching for a file is not a write operation. So it should not lead to the allocation of a new cluster to the directory. If we reuse deleted entries, we might not even use the new cluster and due to not flushing it the directory could be corrupted. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-12-10fs: fat: reuse deleted directory entriesHeinrich Schuchardt1-12/+22
When creating new directory entries try to reuse entries marked as deleted. In fill_dir_slot() do not allocate new clusters as this has already been done in fat_find_empty_dentries(). Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-12-10fs: fat: fat_find_empty_dentries()Heinrich Schuchardt1-1/+61
Provide a function to find a series of empty directory entries. The current directory is scanned for deleted entries. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-12-10fs: fat: flush new directory clusterHeinrich Schuchardt1-9/+19
When handling long file names directory entries may be split over multiple clusters. We must make sure that new clusters are zero filled on disk. When allocating a new cluster for a directory flush it. The flushing should be executed before updating the FAT. This way if flushing fails, we still have a valid directory structure. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-12-10fs: fat: set start cluster for root directoryHeinrich Schuchardt1-1/+3
When iterating over a child directory we set itr->start_clust. Do the same when over the root directory. When looking for deleted directory entries or existing short names we will have to iterate over directories a second and third time. With this patch we do not need any special logic for the root directory. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-12-10fs: fat: dentry iterator for fill_dir_slot()Heinrich Schuchardt1-1/+1
For reusing deleted directory entries we have to adjust the function called to step to the next directory entry. This patch alone is not enough to actually reuse deleted directory entries as the fill_dir_slot() is still called with first never used directory entry. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-12-10fs: fat: generate unique short namesHeinrich Schuchardt1-5/+36
File names must be unique within their directory. So before assigning a short name we must check that it is unique. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-12-10fs: fat: call set_name() only onceHeinrich Schuchardt1-33/+54
In set_name() we select the short name. Once this is correctly implemented this will be a performance intensive operation because we need to check that the name does not exist yet. So set_name should only be called once. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-12-10fs: fat: pass shortname to fill_dir_slotHeinrich Schuchardt1-8/+12
Currently we pass the short name via the directory iterator. Pass it explicitly as a parameter. This removes the requirement to set the short name in the iterator before writing the long name. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-12-10fs: fat: create correct short namesHeinrich Schuchardt2-77/+140
The current function set_name() used to create short names has the following deficiencies resolved by this patch: * Long names (e.g. FOO.TXT) are stored even if a short name is enough. * Short names with spaces are created, e.g. "A ~1.TXT". * Short names with illegal characters are created, e.g. "FOO++BAR". * Debug output does not not consider that the short file name has no concluding '\0'. The solution for the following bug is split of into a separate patch: * Short file names must be unique. This patch only provides the loop over possible short file names. Fixes: c30a15e590c ("FAT: Add FAT write feature") Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-12-10fs: fat: export fat_next_cluster()Heinrich Schuchardt2-33/+80
Rename function next_cluster() to fat_next_cluster() and export it. When creating a new directory entries we should reuse deleted entries. This requires re-scanning the directory. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-12-10fs: fat: correct first cluster for '..'Heinrich Schuchardt1-1/+5
The FAT specification [1] requires that for a '..' directory entry pointing to the root directory the fields DIR_FstClusHi and DIR_FstClusLo are 0. [1] Microsoft FAT Specification, Microsoft Corporation, August 30 2005 Fixes: 31a18d570d96 ("fs: fat: support mkdir") Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de> Acked-by: Marek Szyprowski <m.szyprowski@samsung.com>
2020-12-07spl: fit: Prefer a malloc()'d buffer for loading imagesWIP/07Dec2020-nextAlexandru Gagniuc1-15/+22
Fit images were loaded to a buffer provided by spl_get_load_buffer(). This may work when the FIT image is small and fits between the start of DRAM and SYS_TEXT_BASE. One problem with this approach is that the location of the buffer may be manipulated by changing the 'size' field of the FIT. A maliciously crafted FIT image could place the buffer over executable code and be able to take control of SPL. This is unacceptable for secure boot of signed FIT images. Another problem is with larger FIT images, usually containing one or more linux kernels. In such cases the buffer be be large enough so as to start before DRAM (Figure I). Trying to load an image in this case has undefined behavior. For example, on stm32mp1, the MMC controller hits a RX overrun error, and aborts loading. _________________ | FIT Image | | | /===================\ /=====================\ || DRAM || | DRAM | || || | | ||_________________|| SYS_TEXT_BASE | ___________________ | | | || FIT Image || | | || || | _________________ | SYS_SPL_MALLOC_START || _________________ || || malloc() data || ||| malloc() data ||| ||_________________|| |||_________________||| | | ||___________________|| | | | | Figure I Figure II One possibility that was analyzed was to remove the negative offset, such that the buffer starts at SYS_TEXT_BASE. This is not a proper solution because on a number of platforms, the malloc buffer() is placed at a fixed address, usually after SYS_TEXT_BASE. A large enough FIT image could cause the malloc()'d data to be overwritten (Figure II) when loading. /======================\ | DRAM | | | | | CONFIG_SYS_TEXT_BASE | | | | | ____________________ | CONFIG_SYS_SPL_MALLOC_START || malloc() data || || || || __________________ || ||| FIT Image ||| ||| ||| ||| ||| Figure III The solution proposed here is to replace the ad-hoc heuristics of spl_get_load_buffer() with malloc(). This provides two advantages: * Bounds checking of the buffer region * Guarantees the buffer does not conflict with other memory The first problem is solved by constraining the buffer such that it will not overlap currently executing code. This eliminates the chance of a malicious FIT being able to replace the executing SPL code prior to signature checking. The second problem is solved in conjunction with increasing CONFIG_SYS_SPL_MALLOC_SIZE. Since the SPL malloc() region is carefully crafted on a per-platform basis, the chances of memory conflicts are virtually eliminated. Signed-off-by: Alexandru Gagniuc <mr.nuke.me@gmail.com>
2020-12-07Merge branch '2020-12-07-bootm-and-spl-atf-improvements' into nextTom Rini31-99/+914
- Series to improve "bootm" by allowing variable evaluation within the cmdline we would be passing. This will help with Chrome OS but can be useful elsewhere. - Improve ATF (TF-A) support within SPL.
2020-12-04bootm: Support string substitution in bootargsSimon Glass5-12/+172
In some cases it is necessary to pass parameters to Linux so that it will boot correctly. For example, the rootdev parameter is often used to specify the root device. However the root device may change depending on whence U-Boot loads the kernel. At present it is necessary to build up the command line by adding device strings to it one by one. It is often more convenient to provide a template for bootargs, with U-Boot doing the substitution from other environment variables. Add a way to substitute strings in the bootargs variable. This allows things like "rootdev=${rootdev}" to be used in bootargs, with the ${rootdev} substitution providing the UUID of the root device. For example, to substitute the GUID of the kernel partition: setenv bootargs "console=/dev/ttyS0 rootdev=${uuid}/PARTNROFF=1 kern_guid=${uuid}" part uuid mmc 2:2 uuid bootm This is particularly useful when the command line from another place. For example, Chrome OS stores the command line next to the kernel itself. It depends on the kernel version being used as well as the hardware features, so it is extremely difficult to devise a U-Boot script that works on all boards and kernel versions. With this feature, the command line can be read from disk and used directly, with a few substitutions set up. Signed-off-by: Simon Glass <sjg@chromium.org>
2020-12-04cli: Support macro processing with a fixed-size bufferSimon Glass3-8/+19
At present cli_simple_process_macros() requires that the caller provide an output buffer that is exactly CONFIG_SYS_CBSIZE bytes in length. This makes sense since it is designed to be used from the command line. But we also want to use it for bootargs substitution. Update the function to allow the caller to specify the buffer size. Also return an error if the buffer is exhausted. The caller can ignore that if preferred. Signed-off-by: Simon Glass <sjg@chromium.org>
2020-12-04x86: zimage: Add silent-console processingSimon Glass1-0/+14
At present zimage does its own command-line processing and does not support the 'silent console' feature. There doesn't seem to be any good reason for this. Add support for silent console to zimage. Signed-off-by: Simon Glass <sjg@chromium.org>
2020-12-04bootm: Allow updating the bootargs in a bufferSimon Glass3-16/+132
At present we only support updating the 'bootargs' environment variable. Add another function to update a buffer instead. This will allow zimage to use this feature. Also add a lot more tests to cover various cases. Signed-off-by: Simon Glass <sjg@chromium.org>
2020-12-04bootm: Update bootm_process_cmdline_env() to use flagsSimon Glass3-10/+19
At present only one transformation is supported: making the Linux console silent. To prepare for adding more, convert the boolean parameter into a flag value. Signed-off-by: Simon Glass <sjg@chromium.org>
2020-12-04bootm: Split out bootargs environment reading / writingSimon Glass1-22/+73
At present bootm_process_cmdline_env() reads the 'bootargs' variable and then writes it back afterwards. This is painful for tests, which would rather use a simple buffer. It is also useful for zimage to use a buffer, since it does not actually put the Linux command line in the bootargs variable. Refactor the existing code into two pieces. One handles reading and writing the environment variable, as well as allocating a buffer for use by the rest of the code, which now operates on a buffer. Signed-off-by: Simon Glass <sjg@chromium.org>
2020-12-04bootm: Use size rather than length for CONSOLE_ARGSimon Glass1-7/+8
Use the size (including terminator) for in this function, rather than the length. This is arguably easier to follow, with the coming refactor. Signed-off-by: Simon Glass <sjg@chromium.org>
2020-12-04bootm: Add a bool parameter to bootm_process_cmdline_env()Simon Glass3-16/+17
This function will soon do more than just handle the 'silent linux' feature. As a first step, update it to take a boolean parameter, indicating whether or not the processing is required. Signed-off-by: Simon Glass <sjg@chromium.org>
2020-12-04bootm: Rename fixup_silent_linux()Simon Glass3-9/+9
We want to add more processing to this function. Before doing so, rename it to bootm_process_cmdline_env(), which is more generic. Signed-off-by: Simon Glass <sjg@chromium.org>
2020-12-04bootm: Update fixup_silent_linux() to return an errorSimon Glass3-14/+29
At present this function fails silently on error. Update it to produce an error code. Report this error to the user and abort the boot, since it likely will prevent a successful start. No tests are added at this stage, since additional refactoring is taking place in subsequent patches. Signed-off-by: Simon Glass <sjg@chromium.org>
2020-12-04bootm: Add tests for fixup_silent_linux()Simon Glass7-7/+73
This function currently has no tests. Export it so that we can implement a simple test on sandbox. Use IS_ENABLED() to remove the unused code, instead #ifdef. Signed-off-by: Simon Glass <sjg@chromium.org>
2020-12-04env: Allow returning errors from hdelete_r()Simon Glass4-10/+21
At present this function returns 1 on success and 0 on failure. But in the latter case it provides no indication of what went wrong. If an attempt is made to delete a non-existent variable, the caller may want to ignore this error. This happens when setting a non-existent variable to "", for example. Update the function to return 0 on success and a useful error code on failure. Add a function comment too. Make sure that env_set() does not return an error if it is deleting a variable that doesn't exist. We could update env_set() to return useful error numbers also, but that is beyond the scope of this change. Signed-off-by: Simon Glass <sjg@chromium.org> wip
2020-12-04board: sl28: add OP-TEE Trusted OS support (bl32)Michael Walle3-0/+66
Add support to load the OP-TEE Trusted OS by the SPL. Signed-off-by: Michael Walle <michael@walle.cc>
2020-12-04board: sl28: add ATF support (bl31)Michael Walle4-2/+109
Add support to load the bl31 part of the ARM Trusted Firmware by the SPL. Signed-off-by: Michael Walle <michael@walle.cc>
2020-12-04board: sl28: remove u-boot from loadable DT nodeMichael Walle1-3/+0
It is not needed. Remove it. Signed-off-by: Michael Walle <michael@walle.cc>
2020-12-04armv8: layerscape: don't initialize GIC in SPLMichael Walle1-0/+2
The BL31 expects the GIC to be uninitialized. Thus, if we are loading the BL31 by the SPL we must not initialize it. If u-boot is loaded by the SPL directly, it will initialize the GIC again (in the same lowlevel_init()). This was tested on a custom board with SPL loading the BL31 and jumping to u-boot as BL33 as well as loading u-boot directly by the SPL. In case the ATF BL1/BL2 is used, this patch won't change anything, because no SPL is used at all. Signed-off-by: Michael Walle <michael@walle.cc>
2020-12-04spl: atf: add support for LOAD_IMAGE_V2Michael Walle4-4/+169
Newer platforms use the LOAD_IMAGE_V2 parameter passing method. Add support for it. Signed-off-by: Michael Walle <michael@walle.cc>
2020-12-04spl: atf: remove helper structure from common headerMichael Walle2-14/+11
bl2_to_bl31_params_mem is just an implementation detail of the SPL ATF support and is not needed anywhere else. Move it from the header to the actual module. Signed-off-by: Michael Walle <michael@walle.cc> Acked-by: Michal Simek <michal.simek@xilinx.com>
2020-12-04spl: atf: provide a bl2_plat_get_bl31_params_default()Michael Walle2-15/+42
Move the actual implementation of the bl2_plat_get_bl31_params() to its own function. The weak function will just call the default implementation. This has the advantage that board code can still call the original implementation if it just want to modify minor things. Signed-off-by: Michael Walle <michael@walle.cc>
2020-12-04spl: atf: move storage for bl31_params into functionMichael Walle1-3/+2
There is no need to have the storage available globally. This is also a preparation for LOAD_IMAGE_V2 support. That will introduce a similar generator function which also has its own storage. Signed-off-by: Michael Walle <michael@walle.cc> Acked-by: Michal Simek <michal.simek@xilinx.com>
2020-12-04treewide: use CONFIG_IS_ENABLED() for ARMV8_SEC_FIRMWARE_SUPPORTMichael Walle5-10/+10
There is SPL_ARMV8_SEC_FIRMWARE_SUPPORT and ARMV8_SEC_FIRMWARE_SUPPORT. Thus use CONFIG_IS_ENABLED() instead of the simple #ifdef. Signed-off-by: Michael Walle <michael@walle.cc> Acked-by: Michal Simek <michal.simek@xilinx.com>
generated by cgit v1.1 at 2024-08-20 00:39:33 +0000