mirror of
				https://github.com/smaeul/u-boot.git
				synced 2025-11-03 21:48:15 +00:00 
			
		
		
		
	Patch resolves two kind of bugs, one of which is vulnerability related
to KASLR.
=== Issue briefly ===
  Working with FDT (via non-relocated gd::fdt_blob) from inside bootm
command may lead to the reading the garbage instead of FDT nodes. And
this can result in various side-effects depending on DTS nodes, being
parsed during bootm.
  But below is my specific story how I faced with this issue due to
MESON_RNG probing failure.
=== Bugs description ===
1) Bug is revealed on:
* configuration below
* U-boot 2024.10 - f919c3a889f ("Prepare v2024.10")
  It seems, the following patch is a trigger:
ea955eea4f ("fdt: automatically add /chosen/kaslr-seed if DM_RNG is enabled")
  Generally, CONFIG_OF_EMBED=y & CONFIG_RNG_MESON=y are the most
valuable ones for reproducing the issue.
```
  CONFIG_ARCH_FIXUP_FDT_MEMORY=y
  CONFIG_CMD_FDT=y
  CONFIG_DEFAULT_FDT_FILE=""
  CONFIG_FDT_64BIT=y
  CONFIG_OF_BOARD_SETUP=y
  CONFIG_OF_CONTROL=y
  CONFIG_OF_EMBED=y
  CONFIG_OF_LIBFDT_ASSUME_MASK=0x0
  CONFIG_OF_LIBFDT_OVERLAY=y
  CONFIG_OF_LIBFDT=y
  CONFIG_OF_LIST="meson-axg-our-device-name"
  CONFIG_OF_REAL=y
  CONFIG_OF_TRANSLATE=y
  CONFIG_SUPPORT_OF_CONTROL=y
  CONFIG_SYS_FDT_PAD=0x3000
  CONFIG_TOOLS_OF_LIBFDT=y
  CONFIG_DM_RNG=y
  CONFIG_RNG_MESON=y
```
2) Due to CONFIG_OF_EMBED, the DTS is embedded into U-boot ELF and
accessible via __dtb_dt_begin symbol.
  On early boot stage (board_f.c) the fdtdec_setup() is called only
once before U-boot's relocation into top of RAM. fdtdec_setup()
initializes gd::fdt_blob for FDTSRC_EMBED case:
```
  gd->fdt_blob = dtb_dt_embedded();
  gd->fdt_src = FDTSRC_EMBED;
```
3) Then reloc_fdt() is called in board_f.c
  But due to CONFIG_OF_EMBED=y the reloc_fdt() does not update
gd::fdt_blob value (strictly speaking, it is impossible for
CONFIG_OF_EMBED=y, because U-boot ELF has not been relocated yet
at this moment).
  As a result after relocation we get fdt_blob, pointing to DTS address
before relocation:
```
   # bdinfo
  <...>
  relocaddr = 0x000000000fedf000
  reloc off = 0x000000000eedf000
  <...>
  fdt_blob = 0x010ce6c0 << points to __dtb_dt_begin before relocation
  new_fdt = 0x0000000000000000  << empty erroneously
  fdt_size = 0x0000000000000000 << zero erroneously
```
4) During bootm command (according to our ITS-config file) the Linux
is loaded into 0x01080000 (which is very close to fdt_blob addr
0x010ce6c0).
```
  ## Loading kernel from FIT Image at 04000000 ...
     Trying 'kernel' kernel subimage
       <...>
       Load Address: 0x01080000
```
  So Linux image overwrites the gd::fdt_blob memory location
in RAM (0x010ce6c0).
5) Issue:
  Hence any manipulation with DTS (say, via FDT API) inside
implementation of bootm command leads to accessing the fdt_blob area
with garbage, that can lead to two situations:
5.1) Abort.
  Call to fdt_off_dt_struct() from fdt_next_tag() :: fdt_offset_ptr()::
fdt_offset_ptr_() returns with garbage, that leads to tagp value
being out of RAM top addr (256 Mb in our board), causing the abort:
```
  Boot cmd: bootm 0x4000000#boot_evt1
  bootm_run_states()
  <...>
  image_setup_libfdt()
   fdt_chosen()
    fdt_kaslrseed()
     uclass_get_device()
      uclass_get_device_tail()
       device_probe()
        device_of_to_plat()
        meson_rng_of_to_plat()
         clk_get_by_name_optional()
          clk_get_by_name()
           clk_get_by_name_nodev()
            ofnode_stringlist_search()
             fdt_stringlist_search()
              fdt_getprop()
               fdt_get_property_namelen_()
                fdt_first_property_offset()
                 fdt_check_node_offset_()
                  fdt_next_tag():
                    ```
                      tagp = fdt_offset_ptr(fdt, offset, FDT_TAGSIZE);
                    ```
                  fdt_next_tag() tagp:0x22890766
                  fdt_next_tag() ram_top:0x10000000 (tagp OUT of RAM)
  "Synchronous Abort" handler, esr 0x96000010, far 0x22890766
  elr: 000000000108be24 lr : 000000000108be24 (reloc)
  elr: 000000000ff6fe24 lr : 000000000ff6fe24
  x0 : 0000000000000041 x1 : 0000000000000000
  x2 : 000000000ff3b57c x3 : 0000000000000012
  x4 : 000000000ded2ad5 x5 : 0000000000000020
  x6 : 00000000ffffffe8 x7 : 000000000ded2f40
  x8 : 00000000ffffffd8 x9 : 000000000000000d
  x10: 0000000000000006 x11: 000000000001869f
  x12: 000000000fffffff x13: 000000000fffffff
  x14: 0000000000000000 x15: 000000000ded2abb
  x16: 000000000ff3b080 x17: 0000000000000001
  x18: 000000000ded3dc0 x19: 0000000022890766
  x20: 00000000010cb0f0 x21: 00000000000015e4
  x22: 000000000ff8f4d8 x23: 000000000000000b
  x24: 000000000ded2fbc x25: 000000000ffe2000
  x22: 000000000ff8f4d8 x23: 000000000000000b
  x24: 000000000ded2fbc x25: 000000000ffe2000
  x26: 000000000ffe2000 x27: 000000000000000b
  x28: 000000000ff9cf2d x29: 000000000ded2f40
  Code: aa1603e1 91197484 52801742 94004de8 (b9400276)
```
5.2) Vulnerability situation "KASLR is disabled".
Almost the same as in (5.1), but 2 situations happen (depending on
the value of garbage):
  * call to fdt_offset_ptr_() :: fdt_off_dt_struct(fdt)
    returns not so big garbage, leading to tagp, being inside RAM.
  * or calculations of absoffset inside fdt_offset_ptr() leads to
    failure of the one of if() conditions with NULL as retval.
  Result is fdt_next_tag() interprets the tagp as FDT_END. And we are
returning from our callstack via functions' error paths, leading to
"No RNG device" and "KASLR disabled due to lack of seed":
```
  fdt_kaslrseed()
   uclass_get_device()
   <...>
    device_probe()
     device_of_to_plat()
      meson_rng_of_to_plat()
       clk_get_by_name()
        clk_get_by_name_nodev()
        <...>
         fdt_stringlist_search()
          fdt_getprop()
           fdt_get_property_namelen_()
            fdt_first_property_offset()
             fdt_check_node_offset_()
              fdt_next_tag():
                ```
                  tagp = fdt_offset_ptr(fdt, offset, FDT_TAGSIZE);
                ```
              fdt_next_tag() tagp:0000000001890677
              fdt_next_tag() ram_top:0x10000000 (tagp is inside RAM)
      uclass_get_device_tail():486 device_probe() ret:-22
  No RNG device
 Starting kernel ...
  [ 0.000000] Linux version 6.9.12
  [ 0.000000] KASLR disabled due to lack of seed
```
Signed-off-by: Evgeny Bachinin <EABachinin@salutedevices.com>
		
	
			
		
			
				
	
	
		
			806 lines
		
	
	
		
			17 KiB
		
	
	
	
		
			C
		
	
	
	
	
	
			
		
		
	
	
			806 lines
		
	
	
		
			17 KiB
		
	
	
	
		
			C
		
	
	
	
	
	
// SPDX-License-Identifier: GPL-2.0+
 | 
						|
/*
 | 
						|
 * Copyright (c) 2011 The Chromium OS Authors.
 | 
						|
 * (C) Copyright 2002-2006
 | 
						|
 * Wolfgang Denk, DENX Software Engineering, wd@denx.de.
 | 
						|
 *
 | 
						|
 * (C) Copyright 2002
 | 
						|
 * Sysgo Real-Time Solutions, GmbH <www.elinos.com>
 | 
						|
 * Marius Groeger <mgroeger@sysgo.de>
 | 
						|
 */
 | 
						|
 | 
						|
#include <config.h>
 | 
						|
#include <api.h>
 | 
						|
#include <bootstage.h>
 | 
						|
#include <cpu_func.h>
 | 
						|
#include <cyclic.h>
 | 
						|
#include <display_options.h>
 | 
						|
#include <exports.h>
 | 
						|
#ifdef CONFIG_MTD_NOR_FLASH
 | 
						|
#include <flash.h>
 | 
						|
#endif
 | 
						|
#include <hang.h>
 | 
						|
#include <image.h>
 | 
						|
#include <irq_func.h>
 | 
						|
#include <lmb.h>
 | 
						|
#include <log.h>
 | 
						|
#include <net.h>
 | 
						|
#include <asm/cache.h>
 | 
						|
#include <asm/global_data.h>
 | 
						|
#include <u-boot/crc.h>
 | 
						|
#include <binman.h>
 | 
						|
#include <command.h>
 | 
						|
#include <console.h>
 | 
						|
#include <dm.h>
 | 
						|
#include <efi_loader.h>
 | 
						|
#include <env.h>
 | 
						|
#include <env_internal.h>
 | 
						|
#include <fdtdec.h>
 | 
						|
#include <ide.h>
 | 
						|
#include <init.h>
 | 
						|
#include <initcall.h>
 | 
						|
#include <kgdb.h>
 | 
						|
#include <irq_func.h>
 | 
						|
#include <led.h>
 | 
						|
#include <malloc.h>
 | 
						|
#include <mapmem.h>
 | 
						|
#include <miiphy.h>
 | 
						|
#include <mmc.h>
 | 
						|
#include <mux.h>
 | 
						|
#include <nand.h>
 | 
						|
#include <of_live.h>
 | 
						|
#include <onenand_uboot.h>
 | 
						|
#include <pvblock.h>
 | 
						|
#include <scsi.h>
 | 
						|
#include <serial.h>
 | 
						|
#include <status_led.h>
 | 
						|
#include <stdio_dev.h>
 | 
						|
#include <timer.h>
 | 
						|
#include <trace.h>
 | 
						|
#include <watchdog.h>
 | 
						|
#include <xen.h>
 | 
						|
#include <asm/sections.h>
 | 
						|
#include <dm/root.h>
 | 
						|
#include <dm/ofnode.h>
 | 
						|
#include <linux/compiler.h>
 | 
						|
#include <linux/err.h>
 | 
						|
#include <wdt.h>
 | 
						|
#include <asm-generic/gpio.h>
 | 
						|
#include <relocate.h>
 | 
						|
 | 
						|
DECLARE_GLOBAL_DATA_PTR;
 | 
						|
 | 
						|
ulong monitor_flash_len;
 | 
						|
 | 
						|
__weak int board_flash_wp_on(void)
 | 
						|
{
 | 
						|
	/*
 | 
						|
	 * Most flashes can't be detected when write protection is enabled,
 | 
						|
	 * so provide a way to let U-Boot gracefully ignore write protected
 | 
						|
	 * devices.
 | 
						|
	 */
 | 
						|
	return 0;
 | 
						|
}
 | 
						|
 | 
						|
__weak int cpu_secondary_init_r(void)
 | 
						|
{
 | 
						|
	return 0;
 | 
						|
}
 | 
						|
 | 
						|
static int initr_trace(void)
 | 
						|
{
 | 
						|
#ifdef CONFIG_TRACE
 | 
						|
	trace_init(gd->trace_buff, CONFIG_TRACE_BUFFER_SIZE);
 | 
						|
#endif
 | 
						|
 | 
						|
	return 0;
 | 
						|
}
 | 
						|
 | 
						|
static int initr_reloc(void)
 | 
						|
{
 | 
						|
	/* tell others: relocation done */
 | 
						|
	gd->flags |= GD_FLG_RELOC | GD_FLG_FULL_MALLOC_INIT;
 | 
						|
 | 
						|
	return 0;
 | 
						|
}
 | 
						|
 | 
						|
#if defined(CONFIG_ARM) || defined(CONFIG_RISCV)
 | 
						|
/*
 | 
						|
 * Some of these functions are needed purely because the functions they
 | 
						|
 * call return void. If we change them to return 0, these stubs can go away.
 | 
						|
 */
 | 
						|
static int initr_caches(void)
 | 
						|
{
 | 
						|
	/* Enable caches */
 | 
						|
	enable_caches();
 | 
						|
	return 0;
 | 
						|
}
 | 
						|
#endif
 | 
						|
 | 
						|
__weak int fixup_cpu(void)
 | 
						|
{
 | 
						|
	return 0;
 | 
						|
}
 | 
						|
 | 
						|
static int initr_reloc_global_data(void)
 | 
						|
{
 | 
						|
#ifdef __ARM__
 | 
						|
	monitor_flash_len = _end - __image_copy_start;
 | 
						|
#elif defined(CONFIG_RISCV)
 | 
						|
	monitor_flash_len = (ulong)_end - (ulong)_start;
 | 
						|
#elif !defined(CONFIG_SANDBOX) && !defined(CONFIG_NIOS2)
 | 
						|
	monitor_flash_len = (ulong)__init_end - gd->relocaddr;
 | 
						|
#endif
 | 
						|
#if defined(CONFIG_MPC85xx) || defined(CONFIG_MPC86xx)
 | 
						|
	/*
 | 
						|
	 * The gd->cpu pointer is set to an address in flash before relocation.
 | 
						|
	 * We need to update it to point to the same CPU entry in RAM.
 | 
						|
	 * TODO: why not just add gd->reloc_ofs?
 | 
						|
	 */
 | 
						|
	gd->arch.cpu += gd->relocaddr - CONFIG_SYS_MONITOR_BASE;
 | 
						|
 | 
						|
	/*
 | 
						|
	 * If we didn't know the cpu mask & # cores, we can save them of
 | 
						|
	 * now rather than 'computing' them constantly
 | 
						|
	 */
 | 
						|
	fixup_cpu();
 | 
						|
#endif
 | 
						|
#ifdef CONFIG_SYS_RELOC_GD_ENV_ADDR
 | 
						|
	/*
 | 
						|
	 * Relocate the early env_addr pointer unless we know it is not inside
 | 
						|
	 * the binary. Some systems need this and for the rest, it doesn't hurt.
 | 
						|
	 */
 | 
						|
	gd->env_addr += gd->reloc_off;
 | 
						|
#endif
 | 
						|
 | 
						|
	/*
 | 
						|
	 * For CONFIG_OF_EMBED case the FDT is embedded into ELF, available by
 | 
						|
	 * __dtb_dt_begin. After U-boot ELF self-relocation to RAM top address
 | 
						|
	 * it is worth to update fdt_blob in global_data
 | 
						|
	 */
 | 
						|
	if (IS_ENABLED(CONFIG_OF_EMBED))
 | 
						|
		gd->fdt_blob = dtb_dt_embedded();
 | 
						|
 | 
						|
#ifdef CONFIG_EFI_LOADER
 | 
						|
	/*
 | 
						|
	 * On the ARM architecture gd is mapped to a fixed register (r9 or x18).
 | 
						|
	 * As this register may be overwritten by an EFI payload we save it here
 | 
						|
	 * and restore it on every callback entered.
 | 
						|
	 */
 | 
						|
	efi_save_gd();
 | 
						|
 | 
						|
	efi_runtime_relocate(gd->relocaddr, NULL);
 | 
						|
#endif
 | 
						|
 | 
						|
	return 0;
 | 
						|
}
 | 
						|
 | 
						|
__weak int arch_initr_trap(void)
 | 
						|
{
 | 
						|
	return 0;
 | 
						|
}
 | 
						|
 | 
						|
#if defined(CONFIG_SYS_INIT_RAM_LOCK) && defined(CONFIG_E500)
 | 
						|
static int initr_unlock_ram_in_cache(void)
 | 
						|
{
 | 
						|
	unlock_ram_in_cache();	/* it's time to unlock D-cache in e500 */
 | 
						|
	return 0;
 | 
						|
}
 | 
						|
#endif
 | 
						|
 | 
						|
static int initr_barrier(void)
 | 
						|
{
 | 
						|
#ifdef CONFIG_PPC
 | 
						|
	/* TODO: Can we not use dmb() macros for this? */
 | 
						|
	asm("sync ; isync");
 | 
						|
#endif
 | 
						|
	return 0;
 | 
						|
}
 | 
						|
 | 
						|
static int initr_malloc(void)
 | 
						|
{
 | 
						|
	ulong start;
 | 
						|
 | 
						|
#if CONFIG_IS_ENABLED(SYS_MALLOC_F)
 | 
						|
	debug("Pre-reloc malloc() used %#x bytes (%d KB)\n", gd->malloc_ptr,
 | 
						|
	      gd->malloc_ptr / 1024);
 | 
						|
#endif
 | 
						|
	/* The malloc area is immediately below the monitor copy in DRAM */
 | 
						|
	/*
 | 
						|
	 * This value MUST match the value of gd->start_addr_sp in board_f.c:
 | 
						|
	 * reserve_noncached().
 | 
						|
	 */
 | 
						|
	start = gd->relocaddr - TOTAL_MALLOC_LEN;
 | 
						|
	gd_set_malloc_start(start);
 | 
						|
	mem_malloc_init(start, TOTAL_MALLOC_LEN);
 | 
						|
	return 0;
 | 
						|
}
 | 
						|
 | 
						|
static int initr_of_live(void)
 | 
						|
{
 | 
						|
	if (CONFIG_IS_ENABLED(OF_LIVE)) {
 | 
						|
		int ret;
 | 
						|
 | 
						|
		bootstage_start(BOOTSTAGE_ID_ACCUM_OF_LIVE, "of_live");
 | 
						|
		ret = of_live_build(gd->fdt_blob,
 | 
						|
				    (struct device_node **)gd_of_root_ptr());
 | 
						|
		bootstage_accum(BOOTSTAGE_ID_ACCUM_OF_LIVE);
 | 
						|
		if (ret)
 | 
						|
			return ret;
 | 
						|
	}
 | 
						|
 | 
						|
	return 0;
 | 
						|
}
 | 
						|
 | 
						|
#ifdef CONFIG_DM
 | 
						|
static int initr_dm(void)
 | 
						|
{
 | 
						|
	int ret;
 | 
						|
 | 
						|
	oftree_reset();
 | 
						|
 | 
						|
	/* Drop the pre-reloc driver model and start a new one */
 | 
						|
	gd->dm_root = NULL;
 | 
						|
#ifdef CONFIG_TIMER
 | 
						|
	gd->timer = NULL;
 | 
						|
#endif
 | 
						|
	bootstage_start(BOOTSTAGE_ID_ACCUM_DM_R, "dm_r");
 | 
						|
	ret = dm_init_and_scan(false);
 | 
						|
	bootstage_accum(BOOTSTAGE_ID_ACCUM_DM_R);
 | 
						|
	if (ret)
 | 
						|
		return ret;
 | 
						|
 | 
						|
	return 0;
 | 
						|
}
 | 
						|
#endif
 | 
						|
 | 
						|
static int initr_dm_devices(void)
 | 
						|
{
 | 
						|
	int ret;
 | 
						|
 | 
						|
	if (IS_ENABLED(CONFIG_TIMER_EARLY)) {
 | 
						|
		ret = dm_timer_init();
 | 
						|
		if (ret)
 | 
						|
			return ret;
 | 
						|
	}
 | 
						|
 | 
						|
	if (IS_ENABLED(CONFIG_MULTIPLEXER)) {
 | 
						|
		/*
 | 
						|
		 * Initialize the multiplexer controls to their default state.
 | 
						|
		 * This must be done early as other drivers may unknowingly
 | 
						|
		 * rely on it.
 | 
						|
		 */
 | 
						|
		ret = dm_mux_init();
 | 
						|
		if (ret)
 | 
						|
			return ret;
 | 
						|
	}
 | 
						|
 | 
						|
	return 0;
 | 
						|
}
 | 
						|
 | 
						|
static int initr_bootstage(void)
 | 
						|
{
 | 
						|
	bootstage_mark_name(BOOTSTAGE_ID_START_UBOOT_R, "board_init_r");
 | 
						|
 | 
						|
	return 0;
 | 
						|
}
 | 
						|
 | 
						|
__weak int power_init_board(void)
 | 
						|
{
 | 
						|
	return 0;
 | 
						|
}
 | 
						|
 | 
						|
static int initr_announce(void)
 | 
						|
{
 | 
						|
	debug("Now running in RAM - U-Boot at: %08lx\n", gd->relocaddr);
 | 
						|
	return 0;
 | 
						|
}
 | 
						|
 | 
						|
static int initr_binman(void)
 | 
						|
{
 | 
						|
	int ret;
 | 
						|
 | 
						|
	if (!CONFIG_IS_ENABLED(BINMAN_FDT))
 | 
						|
		return 0;
 | 
						|
 | 
						|
	ret = binman_init();
 | 
						|
	if (ret)
 | 
						|
		printf("binman_init failed:%d\n", ret);
 | 
						|
 | 
						|
	return ret;
 | 
						|
}
 | 
						|
 | 
						|
#if defined(CONFIG_MTD_NOR_FLASH)
 | 
						|
__weak int is_flash_available(void)
 | 
						|
{
 | 
						|
	return 1;
 | 
						|
}
 | 
						|
 | 
						|
static int initr_flash(void)
 | 
						|
{
 | 
						|
	ulong flash_size = 0;
 | 
						|
	struct bd_info *bd = gd->bd;
 | 
						|
 | 
						|
	if (!is_flash_available())
 | 
						|
		return 0;
 | 
						|
 | 
						|
	puts("Flash: ");
 | 
						|
 | 
						|
	if (board_flash_wp_on())
 | 
						|
		printf("Uninitialized - Write Protect On\n");
 | 
						|
	else
 | 
						|
		flash_size = flash_init();
 | 
						|
 | 
						|
	print_size(flash_size, "");
 | 
						|
#ifdef CONFIG_SYS_FLASH_CHECKSUM
 | 
						|
	/*
 | 
						|
	 * Compute and print flash CRC if flashchecksum is set to 'y'
 | 
						|
	 *
 | 
						|
	 * NOTE: Maybe we should add some schedule()? XXX
 | 
						|
	 */
 | 
						|
	if (env_get_yesno("flashchecksum") == 1) {
 | 
						|
		const uchar *flash_base = (const uchar *)CFG_SYS_FLASH_BASE;
 | 
						|
 | 
						|
		printf("  CRC: %08X", crc32(0,
 | 
						|
					    flash_base,
 | 
						|
					    flash_size));
 | 
						|
	}
 | 
						|
#endif /* CONFIG_SYS_FLASH_CHECKSUM */
 | 
						|
	putc('\n');
 | 
						|
 | 
						|
	/* update start of FLASH memory    */
 | 
						|
#ifdef CFG_SYS_FLASH_BASE
 | 
						|
	bd->bi_flashstart = CFG_SYS_FLASH_BASE;
 | 
						|
#endif
 | 
						|
	/* size of FLASH memory (final value) */
 | 
						|
	bd->bi_flashsize = flash_size;
 | 
						|
 | 
						|
#if defined(CONFIG_SYS_UPDATE_FLASH_SIZE)
 | 
						|
	/* Make a update of the Memctrl. */
 | 
						|
	update_flash_size(flash_size);
 | 
						|
#endif
 | 
						|
 | 
						|
#if defined(CONFIG_OXC) || defined(CONFIG_RMU)
 | 
						|
	/* flash mapped at end of memory map */
 | 
						|
	bd->bi_flashoffset = CONFIG_TEXT_BASE + flash_size;
 | 
						|
#elif CONFIG_SYS_MONITOR_BASE == CFG_SYS_FLASH_BASE
 | 
						|
	bd->bi_flashoffset = monitor_flash_len;	/* reserved area for monitor */
 | 
						|
#endif
 | 
						|
	return 0;
 | 
						|
}
 | 
						|
#endif
 | 
						|
 | 
						|
#ifdef CONFIG_CMD_NAND
 | 
						|
/* go init the NAND */
 | 
						|
static int initr_nand(void)
 | 
						|
{
 | 
						|
	puts("NAND:  ");
 | 
						|
	nand_init();
 | 
						|
	printf("%lu MiB\n", nand_size() / 1024);
 | 
						|
	return 0;
 | 
						|
}
 | 
						|
#endif
 | 
						|
 | 
						|
#if defined(CONFIG_CMD_ONENAND)
 | 
						|
/* go init the NAND */
 | 
						|
static int initr_onenand(void)
 | 
						|
{
 | 
						|
	puts("NAND:  ");
 | 
						|
	onenand_init();
 | 
						|
	return 0;
 | 
						|
}
 | 
						|
#endif
 | 
						|
 | 
						|
#ifdef CONFIG_MMC
 | 
						|
static int initr_mmc(void)
 | 
						|
{
 | 
						|
	puts("MMC:   ");
 | 
						|
	mmc_initialize(gd->bd);
 | 
						|
	return 0;
 | 
						|
}
 | 
						|
#endif
 | 
						|
 | 
						|
#ifdef CONFIG_PVBLOCK
 | 
						|
static int initr_pvblock(void)
 | 
						|
{
 | 
						|
	puts("PVBLOCK: ");
 | 
						|
	pvblock_init();
 | 
						|
	return 0;
 | 
						|
}
 | 
						|
#endif
 | 
						|
 | 
						|
/*
 | 
						|
 * Tell if it's OK to load the environment early in boot.
 | 
						|
 *
 | 
						|
 * If CONFIG_OF_CONTROL is defined, we'll check with the FDT to see
 | 
						|
 * if this is OK (defaulting to saying it's OK).
 | 
						|
 *
 | 
						|
 * NOTE: Loading the environment early can be a bad idea if security is
 | 
						|
 *       important, since no verification is done on the environment.
 | 
						|
 *
 | 
						|
 * Return: 0 if environment should not be loaded, !=0 if it is ok to load
 | 
						|
 */
 | 
						|
static int should_load_env(void)
 | 
						|
{
 | 
						|
	if (IS_ENABLED(CONFIG_OF_CONTROL))
 | 
						|
		return ofnode_conf_read_int("load-environment", 1);
 | 
						|
 | 
						|
	if (IS_ENABLED(CONFIG_DELAY_ENVIRONMENT))
 | 
						|
		return 0;
 | 
						|
 | 
						|
	return 1;
 | 
						|
}
 | 
						|
 | 
						|
static int initr_env(void)
 | 
						|
{
 | 
						|
	/* initialize environment */
 | 
						|
	if (should_load_env())
 | 
						|
		env_relocate();
 | 
						|
	else
 | 
						|
		env_set_default(NULL, 0);
 | 
						|
 | 
						|
	env_import_fdt();
 | 
						|
 | 
						|
	if (IS_ENABLED(CONFIG_OF_CONTROL))
 | 
						|
		env_set_hex("fdtcontroladdr",
 | 
						|
			    (unsigned long)map_to_sysmem(gd->fdt_blob));
 | 
						|
 | 
						|
	#if (IS_ENABLED(CONFIG_SAVE_PREV_BL_INITRAMFS_START_ADDR) || \
 | 
						|
						IS_ENABLED(CONFIG_SAVE_PREV_BL_FDT_ADDR))
 | 
						|
		save_prev_bl_data();
 | 
						|
	#endif
 | 
						|
 | 
						|
	/* Initialize from environment */
 | 
						|
	image_load_addr = env_get_ulong("loadaddr", 16, image_load_addr);
 | 
						|
 | 
						|
	return 0;
 | 
						|
}
 | 
						|
 | 
						|
#ifdef CONFIG_SYS_MALLOC_BOOTPARAMS
 | 
						|
static int initr_malloc_bootparams(void)
 | 
						|
{
 | 
						|
	gd->bd->bi_boot_params = (ulong)malloc(CONFIG_SYS_BOOTPARAMS_LEN);
 | 
						|
	if (!gd->bd->bi_boot_params) {
 | 
						|
		puts("WARNING: Cannot allocate space for boot parameters\n");
 | 
						|
		return -ENOMEM;
 | 
						|
	}
 | 
						|
	return 0;
 | 
						|
}
 | 
						|
#endif
 | 
						|
 | 
						|
static int initr_status_led(void)
 | 
						|
{
 | 
						|
	status_led_init();
 | 
						|
 | 
						|
	return 0;
 | 
						|
}
 | 
						|
 | 
						|
static int initr_boot_led_blink(void)
 | 
						|
{
 | 
						|
	status_led_boot_blink();
 | 
						|
 | 
						|
	led_boot_blink();
 | 
						|
 | 
						|
	return 0;
 | 
						|
}
 | 
						|
 | 
						|
static int initr_boot_led_on(void)
 | 
						|
{
 | 
						|
	led_boot_on();
 | 
						|
 | 
						|
	return 0;
 | 
						|
}
 | 
						|
 | 
						|
#if defined(CONFIG_CMD_NET)
 | 
						|
static int initr_net(void)
 | 
						|
{
 | 
						|
	puts("Net:   ");
 | 
						|
	eth_initialize();
 | 
						|
#if defined(CONFIG_RESET_PHY_R)
 | 
						|
	debug("Reset Ethernet PHY\n");
 | 
						|
	reset_phy();
 | 
						|
#endif
 | 
						|
	return 0;
 | 
						|
}
 | 
						|
#endif
 | 
						|
 | 
						|
#ifdef CONFIG_POST
 | 
						|
static int initr_post(void)
 | 
						|
{
 | 
						|
	post_run(NULL, POST_RAM | post_bootmode_get(0));
 | 
						|
	return 0;
 | 
						|
}
 | 
						|
#endif
 | 
						|
 | 
						|
#if defined(CFG_PRAM)
 | 
						|
/*
 | 
						|
 * Export available size of memory for Linux, taking into account the
 | 
						|
 * protected RAM at top of memory
 | 
						|
 */
 | 
						|
int initr_mem(void)
 | 
						|
{
 | 
						|
	ulong pram = 0;
 | 
						|
	char memsz[32];
 | 
						|
 | 
						|
	pram = env_get_ulong("pram", 10, CFG_PRAM);
 | 
						|
	sprintf(memsz, "%ldk", (long int)((gd->ram_size / 1024) - pram));
 | 
						|
	env_set("mem", memsz);
 | 
						|
 | 
						|
	return 0;
 | 
						|
}
 | 
						|
#endif
 | 
						|
 | 
						|
static int initr_lmb(void)
 | 
						|
{
 | 
						|
	if (CONFIG_IS_ENABLED(LMB))
 | 
						|
		return lmb_init();
 | 
						|
	else
 | 
						|
		return 0;
 | 
						|
}
 | 
						|
 | 
						|
static int dm_announce(void)
 | 
						|
{
 | 
						|
	int device_count;
 | 
						|
	int uclass_count;
 | 
						|
 | 
						|
	if (IS_ENABLED(CONFIG_DM)) {
 | 
						|
		dm_get_stats(&device_count, &uclass_count);
 | 
						|
		printf("Core:  %d devices, %d uclasses", device_count,
 | 
						|
		       uclass_count);
 | 
						|
		if (CONFIG_IS_ENABLED(OF_REAL))
 | 
						|
			printf(", devicetree: %s", fdtdec_get_srcname());
 | 
						|
		if (CONFIG_IS_ENABLED(UPL))
 | 
						|
			printf(", universal payload active");
 | 
						|
		printf("\n");
 | 
						|
		if (IS_ENABLED(CONFIG_OF_HAS_PRIOR_STAGE) &&
 | 
						|
		    (gd->fdt_src == FDTSRC_SEPARATE ||
 | 
						|
		     gd->fdt_src == FDTSRC_EMBED)) {
 | 
						|
			printf("Warning: Unexpected devicetree source (not from a prior stage)");
 | 
						|
			printf("Warning: U-Boot may not function properly\n");
 | 
						|
		}
 | 
						|
		if (IS_ENABLED(CONFIG_OF_TAG_MIGRATE) &&
 | 
						|
		    (gd->flags & GD_FLG_OF_TAG_MIGRATE))
 | 
						|
			/*
 | 
						|
			 * U-Boot will silently fail to work after 2023.07 if
 | 
						|
			 * there are old tags present
 | 
						|
			 */
 | 
						|
			printf("Warning: Device tree includes old 'u-boot,dm-' tags: please fix by 2023.07!\n");
 | 
						|
	}
 | 
						|
 | 
						|
	return 0;
 | 
						|
}
 | 
						|
 | 
						|
static int run_main_loop(void)
 | 
						|
{
 | 
						|
#ifdef CONFIG_SANDBOX
 | 
						|
	sandbox_main_loop_init();
 | 
						|
#endif
 | 
						|
 | 
						|
	event_notify_null(EVT_MAIN_LOOP);
 | 
						|
 | 
						|
	/* main_loop() can return to retry autoboot, if so just run it again */
 | 
						|
	for (;;)
 | 
						|
		main_loop();
 | 
						|
	return 0;
 | 
						|
}
 | 
						|
 | 
						|
/*
 | 
						|
 * Over time we hope to remove these functions with code fragments and
 | 
						|
 * stub functions, and instead call the relevant function directly.
 | 
						|
 *
 | 
						|
 * We also hope to remove most of the driver-related init and do it if/when
 | 
						|
 * the driver is later used.
 | 
						|
 *
 | 
						|
 * TODO: perhaps reset the watchdog in the initcall function after each call?
 | 
						|
 */
 | 
						|
static init_fnc_t init_sequence_r[] = {
 | 
						|
	initr_trace,
 | 
						|
	initr_reloc,
 | 
						|
	event_init,
 | 
						|
	/* TODO: could x86/PPC have this also perhaps? */
 | 
						|
#if defined(CONFIG_ARM) || defined(CONFIG_RISCV)
 | 
						|
	initr_caches,
 | 
						|
	/* Note: For Freescale LS2 SoCs, new MMU table is created in DDR.
 | 
						|
	 *	 A temporary mapping of IFC high region is since removed,
 | 
						|
	 *	 so environmental variables in NOR flash is not available
 | 
						|
	 *	 until board_init() is called below to remap IFC to high
 | 
						|
	 *	 region.
 | 
						|
	 */
 | 
						|
#endif
 | 
						|
	initr_reloc_global_data,
 | 
						|
#if defined(CONFIG_SYS_INIT_RAM_LOCK) && defined(CONFIG_E500)
 | 
						|
	initr_unlock_ram_in_cache,
 | 
						|
#endif
 | 
						|
	initr_barrier,
 | 
						|
	initr_malloc,
 | 
						|
	log_init,
 | 
						|
	initr_bootstage,	/* Needs malloc() but has its own timer */
 | 
						|
#if defined(CONFIG_CONSOLE_RECORD)
 | 
						|
	console_record_init,
 | 
						|
#endif
 | 
						|
#ifdef CONFIG_SYS_NONCACHED_MEMORY
 | 
						|
	noncached_init,
 | 
						|
#endif
 | 
						|
	initr_of_live,
 | 
						|
#ifdef CONFIG_DM
 | 
						|
	initr_dm,
 | 
						|
#endif
 | 
						|
#ifdef CONFIG_ADDR_MAP
 | 
						|
	init_addr_map,
 | 
						|
#endif
 | 
						|
#if defined(CONFIG_ARM) || defined(CONFIG_RISCV) || defined(CONFIG_SANDBOX)
 | 
						|
	board_init,	/* Setup chipselects */
 | 
						|
#endif
 | 
						|
	/*
 | 
						|
	 * TODO: printing of the clock inforamtion of the board is now
 | 
						|
	 * implemented as part of bdinfo command. Currently only support for
 | 
						|
	 * davinci SOC's is added. Remove this check once all the board
 | 
						|
	 * implement this.
 | 
						|
	 */
 | 
						|
#ifdef CONFIG_CLOCKS
 | 
						|
	set_cpu_clk_info, /* Setup clock information */
 | 
						|
#endif
 | 
						|
	initr_lmb,
 | 
						|
#ifdef CONFIG_EFI_LOADER
 | 
						|
	efi_memory_init,
 | 
						|
#endif
 | 
						|
	initr_binman,
 | 
						|
#ifdef CONFIG_FSP_VERSION2
 | 
						|
	arch_fsp_init_r,
 | 
						|
#endif
 | 
						|
	initr_dm_devices,
 | 
						|
	stdio_init_tables,
 | 
						|
	serial_initialize,
 | 
						|
	initr_announce,
 | 
						|
	dm_announce,
 | 
						|
#if CONFIG_IS_ENABLED(WDT)
 | 
						|
	initr_watchdog,
 | 
						|
#endif
 | 
						|
	INIT_FUNC_WATCHDOG_RESET
 | 
						|
	arch_initr_trap,
 | 
						|
#if defined(CONFIG_BOARD_EARLY_INIT_R)
 | 
						|
	board_early_init_r,
 | 
						|
#endif
 | 
						|
	INIT_FUNC_WATCHDOG_RESET
 | 
						|
#ifdef CONFIG_POST
 | 
						|
	post_output_backlog,
 | 
						|
#endif
 | 
						|
	INIT_FUNC_WATCHDOG_RESET
 | 
						|
#if defined(CONFIG_PCI_INIT_R) && defined(CONFIG_SYS_EARLY_PCI_INIT)
 | 
						|
	/*
 | 
						|
	 * Do early PCI configuration _before_ the flash gets initialised,
 | 
						|
	 * because PCU resources are crucial for flash access on some boards.
 | 
						|
	 */
 | 
						|
	pci_init,
 | 
						|
#endif
 | 
						|
#ifdef CONFIG_ARCH_EARLY_INIT_R
 | 
						|
	arch_early_init_r,
 | 
						|
#endif
 | 
						|
	power_init_board,
 | 
						|
#ifdef CONFIG_MTD_NOR_FLASH
 | 
						|
	initr_flash,
 | 
						|
#endif
 | 
						|
	INIT_FUNC_WATCHDOG_RESET
 | 
						|
#if defined(CONFIG_PPC) || defined(CONFIG_M68K) || defined(CONFIG_X86)
 | 
						|
	/* initialize higher level parts of CPU like time base and timers */
 | 
						|
	cpu_init_r,
 | 
						|
#endif
 | 
						|
#ifdef CONFIG_EFI_LOADER
 | 
						|
	efi_init_early,
 | 
						|
#endif
 | 
						|
#ifdef CONFIG_CMD_NAND
 | 
						|
	initr_nand,
 | 
						|
#endif
 | 
						|
#ifdef CONFIG_CMD_ONENAND
 | 
						|
	initr_onenand,
 | 
						|
#endif
 | 
						|
#ifdef CONFIG_MMC
 | 
						|
	initr_mmc,
 | 
						|
#endif
 | 
						|
#ifdef CONFIG_XEN
 | 
						|
	xen_init,
 | 
						|
#endif
 | 
						|
#ifdef CONFIG_PVBLOCK
 | 
						|
	initr_pvblock,
 | 
						|
#endif
 | 
						|
	initr_env,
 | 
						|
#ifdef CONFIG_SYS_MALLOC_BOOTPARAMS
 | 
						|
	initr_malloc_bootparams,
 | 
						|
#endif
 | 
						|
	INIT_FUNC_WATCHDOG_RESET
 | 
						|
	cpu_secondary_init_r,
 | 
						|
#if defined(CONFIG_ID_EEPROM)
 | 
						|
	mac_read_from_eeprom,
 | 
						|
#endif
 | 
						|
	INITCALL_EVENT(EVT_SETTINGS_R),
 | 
						|
	INIT_FUNC_WATCHDOG_RESET
 | 
						|
#if defined(CONFIG_PCI_INIT_R) && !defined(CONFIG_SYS_EARLY_PCI_INIT)
 | 
						|
	/*
 | 
						|
	 * Do pci configuration
 | 
						|
	 */
 | 
						|
	pci_init,
 | 
						|
#endif
 | 
						|
	stdio_add_devices,
 | 
						|
	jumptable_init,
 | 
						|
#ifdef CONFIG_API
 | 
						|
	api_init,
 | 
						|
#endif
 | 
						|
	console_init_r,		/* fully init console as a device */
 | 
						|
#ifdef CONFIG_DISPLAY_BOARDINFO_LATE
 | 
						|
	console_announce_r,
 | 
						|
	show_board_info,
 | 
						|
#endif
 | 
						|
#ifdef CONFIG_ARCH_MISC_INIT
 | 
						|
	arch_misc_init,		/* miscellaneous arch-dependent init */
 | 
						|
#endif
 | 
						|
#ifdef CONFIG_MISC_INIT_R
 | 
						|
	misc_init_r,		/* miscellaneous platform-dependent init */
 | 
						|
#endif
 | 
						|
	INIT_FUNC_WATCHDOG_RESET
 | 
						|
#ifdef CONFIG_CMD_KGDB
 | 
						|
	kgdb_init,
 | 
						|
#endif
 | 
						|
	interrupt_init,
 | 
						|
#if defined(CONFIG_MICROBLAZE) || defined(CONFIG_M68K)
 | 
						|
	timer_init,		/* initialize timer */
 | 
						|
#endif
 | 
						|
	initr_status_led,
 | 
						|
	initr_boot_led_blink,
 | 
						|
	/* PPC has a udelay(20) here dating from 2002. Why? */
 | 
						|
#ifdef CONFIG_BOARD_LATE_INIT
 | 
						|
	board_late_init,
 | 
						|
#endif
 | 
						|
#ifdef CONFIG_BITBANGMII
 | 
						|
	bb_miiphy_init,
 | 
						|
#endif
 | 
						|
#ifdef CONFIG_PCI_ENDPOINT
 | 
						|
	pci_ep_init,
 | 
						|
#endif
 | 
						|
#if defined(CONFIG_CMD_NET)
 | 
						|
	INIT_FUNC_WATCHDOG_RESET
 | 
						|
	initr_net,
 | 
						|
#endif
 | 
						|
#ifdef CONFIG_POST
 | 
						|
	initr_post,
 | 
						|
#endif
 | 
						|
	INIT_FUNC_WATCHDOG_RESET
 | 
						|
	INITCALL_EVENT(EVT_LAST_STAGE_INIT),
 | 
						|
#if defined(CFG_PRAM)
 | 
						|
	initr_mem,
 | 
						|
#endif
 | 
						|
	initr_boot_led_on,
 | 
						|
	run_main_loop,
 | 
						|
};
 | 
						|
 | 
						|
void board_init_r(gd_t *new_gd, ulong dest_addr)
 | 
						|
{
 | 
						|
	/*
 | 
						|
	 * The pre-relocation drivers may be using memory that has now gone
 | 
						|
	 * away. Mark serial as unavailable - this will fall back to the debug
 | 
						|
	 * UART if available.
 | 
						|
	 *
 | 
						|
	 * Do the same with log drivers since the memory may not be available.
 | 
						|
	 */
 | 
						|
	gd->flags &= ~(GD_FLG_SERIAL_READY | GD_FLG_LOG_READY);
 | 
						|
 | 
						|
	/*
 | 
						|
	 * Set up the new global data pointer. So far only x86 does this
 | 
						|
	 * here.
 | 
						|
	 * TODO(sjg@chromium.org): Consider doing this for all archs, or
 | 
						|
	 * dropping the new_gd parameter.
 | 
						|
	 */
 | 
						|
	if (CONFIG_IS_ENABLED(X86_64) && !IS_ENABLED(CONFIG_EFI_APP))
 | 
						|
		arch_setup_gd(new_gd);
 | 
						|
 | 
						|
#if !defined(CONFIG_X86) && !defined(CONFIG_ARM) && !defined(CONFIG_ARM64)
 | 
						|
	gd = new_gd;
 | 
						|
#endif
 | 
						|
	gd->flags &= ~GD_FLG_LOG_READY;
 | 
						|
 | 
						|
	if (initcall_run_list(init_sequence_r))
 | 
						|
		hang();
 | 
						|
 | 
						|
	/* NOTREACHED - run_main_loop() does not return */
 | 
						|
	hang();
 | 
						|
}
 |