Add tests to check that these two attacks are mitigated by recent patches.
Signed-off-by: NSimon Glass <sjg@chromium.org>
Reported-by: NBruce Monroe <bruce.monroe@intel.com>
Reported-by: NArie Haenel <arie.haenel@intel.com>
Reported-by: NJulien Lenoir <julien.lenoir@intel.com>

Add a library which performs two different attacks on a FIT.
Signed-off-by: NJulien Lenoir <julien.lenoir@intel.com>
Signed-off-by: NBruce Monroe <bruce.monroe@intel.com>
Signed-off-by: NArie Haenel <arie.haenel@intel.com>
Signed-off-by: NSimon Glass <sjg@chromium.org>

When searching for a node called 'fred', any unit address appended to the
name is ignored by libfdt, meaning that 'fred' can match 'fred@1'. This
means that we cannot be sure that the node originally intended is the one
that is used.

Disallow use of nodes with unit addresses.

Update the forge test also, since it uses @ addresses.

CVE-2021-27138
Signed-off-by: NSimon Glass <sjg@chromium.org>
Reported-by: NBruce Monroe <bruce.monroe@intel.com>
Reported-by: NArie Haenel <arie.haenel@intel.com>
Reported-by: NJulien Lenoir <julien.lenoir@intel.com>

At present fdt_find_regions() assumes that the FIT is a valid devicetree.
If the FIT has two root nodes this is currently not detected in this
function, nor does libfdt's fdt_check_full() notice. Also it is possible
for the root node to have a name even though it should not.

Add checks for these and return -FDT_ERR_BADSTRUCTURE if a problem is
detected.

CVE-2021-27097
Signed-off-by: NSimon Glass <sjg@chromium.org>
Reported-by: NBruce Monroe <bruce.monroe@intel.com>
Reported-by: NArie Haenel <arie.haenel@intel.com>
Reported-by: NJulien Lenoir <julien.lenoir@intel.com>

Rsync all defconfig files using moveconfig.py
Signed-off-by: NTom Rini <trini@konsulko.com>

- Merge the patch to take <asm/global_data.h> out of <common.h>

- Remove some boards that are behind on conversions and have had their
  removal acked or suggested by the relevant maintainers.

This board has not been converted to CONFIG_DM by the deadline of v2020.01
and is missing other conversions which depend on this as well.  Remove it.

Cc: Nobuhiro Iwamatsu <iwamatsu@nigauri.org>
Signed-off-by: NTom Rini <trini@konsulko.com>

This board has not been converted to CONFIG_DM by the deadline of v2020.01
and is missing other conversions which depend on this as well.  Remove it.

As this is the last SH4A board, remove that support as well.

Cc: Marek Vasut <marek.vasut+renesas@gmail.com>
Signed-off-by: NTom Rini <trini@konsulko.com>

This board has not been converted to CONFIG_DM by the deadline of v2020.01
and is missing other conversions which depend on this as well.  Remove it.
Signed-off-by: NTom Rini <trini@konsulko.com>

This board has not been converted to CONFIG_DM by the deadline of v2020.01
and is missing other conversions which depend on this as well.  Remove it.
Signed-off-by: NTom Rini <trini@konsulko.com>

This board has not been converted to CONFIG_DM by the deadline of v2020.01
and is missing other conversions which depend on this as well.  Remove it.

Patch-cc: Nobuhiro Iwamatsu <iwamatsu.nobuhiro@renesas.com>
Patch-cc: Nobuhiro Iwamatsu <iwamatsu@nigauri.org>
Signed-off-by: NTom Rini <trini@konsulko.com>

This board has not been converted to CONFIG_DM by the deadline of v2020.01
and is missing other conversions which depend on this as well.  Remove it.
Signed-off-by: NTom Rini <trini@konsulko.com>

This board relies on using CONFIG_LIBATA but does not enable CONFIG_AHCI.  The
deadline for this conversion was the v2019.07 release.  The use of CONFIG_AHCI
requires CONFIG_DM.  The deadline for this conversion was v2020.01.  Remove
this board.

Cc: Priyanka Jain <priyanka.jain@nxp.com>
Signed-off-by: NTom Rini <trini@konsulko.com>
Reviewed-by: NPriyanka Jain <priyanka.jain@nxp.com>

This board relies on using CONFIG_LIBATA but does not enable CONFIG_AHCI.  The
deadline for this conversion was the v2019.07 release.  The use of CONFIG_AHCI
requires CONFIG_DM.  The deadline for this conversion was v2020.01.  Remove
this board.

Cc: Priyanka Jain <priyanka.jain@nxp.com>
Signed-off-by: NTom Rini <trini@konsulko.com>
Reviewed-by: NPriyanka Jain <priyanka.jain@nxp.com>

This board relies on using CONFIG_LIBATA but does not enable CONFIG_AHCI.  The
deadline for this conversion was the v2019.07 release.  The use of CONFIG_AHCI
requires CONFIG_DM.  The deadline for this conversion was v2020.01.  Remove
this board.

Cc: Priyanka Jain <priyanka.jain@nxp.com>
Signed-off-by: NTom Rini <trini@konsulko.com>
Reviewed-by: NPriyanka Jain <priyanka.jain@nxp.com>

This board relies on using CONFIG_LIBATA but does not enable CONFIG_AHCI.  The
deadline for this conversion was the v2019.07 release.  The use of CONFIG_AHCI
requires CONFIG_DM.  The deadline for this conversion was v2020.01.  Remove
this board.

Cc: Priyanka Jain <priyanka.jain@nxp.com>
Signed-off-by: NTom Rini <trini@konsulko.com>
Reviewed-by: NPriyanka Jain <priyanka.jain@nxp.com>

This board has not been converted to CONFIG_DM_MMC by the deadline of
v2019.04, which is almost two years ago.  In addition there are other DM
migrations it is also missing.  Remove it.

Cc: Chris Packham <judge.packham@gmail.com>
Signed-off-by: NTom Rini <trini@konsulko.com>
Acked-by: NChris Packham <judge.packham@gmail.com>

This board has not been converted to CONFIG_DM_MMC by the deadline of
v2019.04, which is almost two years ago.  In addition there are other DM
migrations it is also missing.  Remove it.

Cc: Prabhakar Kushwaha <prabhakar.kushwaha@nxp.com>
Cc: Priyanka Jain <priyanka.jain@nxp.com>
Signed-off-by: NTom Rini <trini@konsulko.com>
Reviewed-by: NPriyanka Jain <priyanka.jain@nxp.com>

This board has not been converted to CONFIG_DM_MMC by the deadline of
v2019.04, which is almost two years ago.  In addition there are other DM
migrations it is also missing.  Remove it.

Cc: Stefano Babic <sbabic@denx.de>
Signed-off-by: NTom Rini <trini@konsulko.com>
Acked-by: NStefano Babic <sbabic@denx.de>

This board has not been converted to CONFIG_DM_MMC by the deadline of
v2019.04, which is almost two years ago.  In addition there are other DM
migrations it is also missing.  Remove it.

Cc: Lauri Hintsala <lauri.hintsala@bluegiga.com>
Signed-off-by: NTom Rini <trini@konsulko.com>
Acked-by: Lauri Hintsala <lauri.hintsala@silabs.com<mailto:lauri.hintsala@silabs.com>>
Signed-off-by: Tom Rini <trini@konsulko.com<mailto:trini@konsulko.com>>

On Rockchip platforms we need this area of code in TPL, but there is no
TPL_SEPARATE_BSS symbol.

This reverts commit 0a2aaab0.
Reported-by: NMarkus Reichl <m.reichl@fivetechno.de>
Reported-by: NJesper Schmitz Mouridsen <jesper@schmitz.computer>
Reported-by: NPeter Robinson <pbrobinson@gmail.com>
Tested-by: NPeter Robinson <pbrobinson@gmail.com>
Signed-off-by: NTom Rini <trini@konsulko.com>

Pull request for UEFI sub-system for efi-2021-04-rc2-2

Bug fixes:
* fix stack smashing in UEFI capsule updates
* correct loading of UEFI binaries where Virtual size is not a
  multiple of FileAlignment
* simplify detection of capsule files.
* buildman: use threading.is_alive() instead of removed method IsAlive()

The isAlive() method was deprecated in Python 3.8 and has been removed in
Python 3.9. See https://bugs.python.org/issue37804. Use is_alive() instead.

Since Python 2.6 is_alive() has been a synonym for isAlive(). So there
should be no problems for users using elder Python 3 versions.
Signed-off-by: NHeinrich Schuchardt <xypron.glpk@gmx.de>
Reviewed-by: NSimon Glass <sjg@chromium.org>

fix get_last_capsule() leads to writes beyond the stack allocated buffer.
This was indicated when enabling the stack protector.

utf16_utf8_strcpy() only stops copying when reaching '\0'. The current
invocation always writes beyond the end of value[].

The output length of utf16_utf8_strcpy() may be longer than the number of
UTF-16 tokens. E.g has "CapsuleКиев" has 11 UTF-16 tokens but 15 UTF-8
tokens. Hence, using utf16_utf8_strcpy() without checking the input may
lead to further writes beyond value[].

The current invocation of strict_strtoul() reads beyond the end of value[].

A non-hexadecimal value after "Capsule" (e.g. "CapsuleZZZZ") must result in
an error. We cat catch this by checking the return value of strict_strtoul().

A value that is too short after "Capsule" (e.g. "Capsule0") must result in
an error. We must check the string length of value[].
Signed-off-by: NHeinrich Schuchardt <xypron.glpk@gmx.de>

'.' and '..' are directories. So when looking for capsule files it is
sufficient to check that the attribute EFI_FILE_DIRECTORY is not set. We
don't have to check for these special names.
Signed-off-by: NHeinrich Schuchardt <xypron.glpk@gmx.de>

PE section table entries' SizeOfRawData must be a multiple of
FileAlignment, and thus may be rounded up and larger than their
VirtualSize.

We should not load beyond the VirtualSize, which is "the total size of
the section when loaded into memory" -- we may clobber real data at the
target in some other section, since we load sections in reverse order
and sections are usually laid out sequentially.
Signed-off-by: NAsherah Connor <ashe@kivikakk.ee>
Reviewed-by: NHeinrich Schuchardt <xypron.glpk@gmx.de>

First set of u-boot-atmel fixes for 2021.04 cycle:

This small PR includes just two fixes but very important: one revert in
the clk subsystem which fixes the boot on many old boards
(sama5d2_xplained, sama5d4_xplained), which currently crash at boot; and
one small fix related to debug serial on sama7g5ek board.

Revert changes in at91 compat.c that cause u-boot to fail booting on
sama5d4_xplained and sama5d2_xplained

Log below:

<debug_uart>
No serial driver found
Could not initialize timer (err -19)

Could not initialize timer (err -19)

Could not initialize timer (err -19)

Could not initialize timer (err -19)

Could not initialize timer (err -19)

Could not initialize timer (err -19)

Could not initialize timer (err -19)

Could not initialize timer (err -19)

Fixes: a2703ce1 ("dm: Remove uses of device_bind_offset()")
Cc: Simon Glass <sjg@chromium.org>
Signed-off-by: NEugen Hristev <eugen.hristev@microchip.com>
Reviewed-by: NSimon Glass <sjg@chromium.org>

If the serial tx/rx are floating, it can happen that bogus characters
are detected on the line at boot time. This leads to U-boot accidentally
thinking someone pressed a key to stop autoboot, thus stopping booting process.
This can happen if the serial cable is not connected. There are hardware
pull-ups on the board connected to serial cable VBUS.
To solve this when the cable is not plugged, enable internal pull-ups as well
for the tx/rx lines.
Signed-off-by: NEugen Hristev <eugen.hristev@microchip.com>

- MediaTek updates
- xhci fixes
- dwc2 stm32 compatible update

The Linux kernel v5.7-rc1 introduced the compatible "st,stm32mp15-hsotg".

See Linux kernel commit d49850110434 ("dt-bindings: usb: dwc2: add
support for STM32MP15 SoCs USB OTG HS and FS")

This patch updates the supported compatible in DWC2 driver,
removes the add-on done in U-Boot dtsi and keeps the compatible
defined in SOC dtsi arch/arm/dts/stm32mp151.dtsi:

usbotg_hs: usb-otg@49000000 {
	compatible = "st,stm32mp15-hsotg", "snps,dwc2";
	reg = <0x49000000 0x10000>;
...
};
Signed-off-by: NPatrick Delaunay <patrick.delaunay@foss.st.com>

Testing with v2021.01 on MIPS Octeon has shown, that the latest patch
for the "short packet event trb handling" did introduce a bug on
platforms with virtual address != physical address. This patch fixes
this issue by using the correct address types in the compare (both
physical in this case).
Signed-off-by: NStefan Roese <sr@denx.de>
Cc: Aaron Williams <awilliams@marvell.com>
Cc: Chandrakala Chavva <cchavva@marvell.com>
Cc: Ran Wang <ran.wang_1@nxp.com>
Cc: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
Cc: Marek Vasut <marex@denx.de>
Cc: Bin Meng <bmeng.cn@gmail.com>

Function dm_pci_map_bar() may fail and returns NULL. Check this to prevent
dereferencing a NULL pointer.

In xhci-pci this may happen when board does not enable CONFIG_PCI_PNP and
PCI_BASE_ADDRESS_0 contains unconfigured zero address.
Signed-off-by: NPali Rohár <pali@kernel.org>

Add optional properies to disable usb2 or usb3 ports, they are used
when provided ports are not used on some special platforms.
Signed-off-by: NChunfeng Yun <chunfeng.yun@mediatek.com>

Add support to disable specific ports, it's useful for some
scenarios:
1. usb3 PHY is shared whith PCIe or SATA, the corresponding
   usb3 port can be disabled;
2. some usb2 or usb3 ports are not used on special platforms,
   they should be disabled to save power.
Signed-off-by: NChunfeng Yun <chunfeng.yun@mediatek.com>

- Add configuration helpers for MIPI D-PHY
- generic-phy: add configure op
- Add Amlogic AXG MIPI D-PHY driver & MIPI PCIe Analog PHY driver
- odroid: add runtime detection of the N2/N2+/C4/HC4 variants

Use the ADC channel 1 to check the hardware revision of the board and
detect the N2 vs. N2+ and the C4 vs. HC4 variants. Each of them use
different dtb file, so adjust fdtfile environment variable to the
detected variant.

The ADC min/max values for each variant are taken from the vendor code,
adjusted to the 12-bit ADC driver operation mode (vendor code use 10-bit
mode).
Signed-off-by: NMarek Szyprowski <m.szyprowski@samsung.com>
Reviewed-by: NJaehoon Chung <jh80.chung@samsung.com>
Signed-off-by: NNeil Armstrong <narmstrong@baylibre.com>

The Amlogic AXG MIPI + PCIe Analog PHY provides function for both PCIe and
MIPI DSI at the same time, and provides the Analog part of MIPI DSI transmission
and Analog part of the PCIe lines.
Signed-off-by: NNeil Armstrong <narmstrong@baylibre.com>

The Amlogic AXG SoCs embeds a MIPI D-PHY used to communicate with DSI
panels.

This D-PHY depends on a separate analog PHY.
Signed-off-by: NNeil Armstrong <narmstrong@baylibre.com>
Signed-off-by: NNeil Armstrong <narmstrong@baylibre.com>