summaryrefslogtreecommitdiff
path: root/lib
diff options
context:
space:
mode:
Diffstat (limited to 'lib')
-rw-r--r--lib/binman.c1
-rw-r--r--lib/efi_loader/Kconfig11
-rw-r--r--lib/efi_loader/Makefile1
-rw-r--r--lib/efi_loader/efi_bootbin.c1
-rw-r--r--lib/efi_loader/efi_bootmgr.c10
-rw-r--r--lib/efi_loader/efi_boottime.c2
-rw-r--r--lib/efi_loader/efi_device_path.c7
-rw-r--r--lib/efi_loader/efi_helper.c71
-rw-r--r--lib/efi_loader/efi_memory.c26
-rw-r--r--lib/efi_loader/efi_tcg2.c5
-rw-r--r--lib/efi_loader/testapp.c56
-rw-r--r--lib/lmb.c584
-rw-r--r--lib/lwip/Makefile3
-rw-r--r--lib/lwip/lwip/src/apps/altcp_tls/altcp_tls_mbedtls.c49
-rw-r--r--lib/lwip/lwip/src/core/tcp_out.c8
-rw-r--r--lib/lwip/lwip/src/include/lwip/altcp_tls.h2
-rw-r--r--lib/lwip/u-boot/arch/cc.h5
-rw-r--r--lib/lwip/u-boot/lwipopts.h6
-rw-r--r--lib/mbedtls/Kconfig12
-rw-r--r--lib/mbedtls/Makefile31
-rw-r--r--lib/mbedtls/mbedtls_def_config.h52
-rw-r--r--lib/rsa/rsa-sign.c9
-rw-r--r--lib/strto.c5
-rw-r--r--lib/tpm-v2.c2
-rw-r--r--lib/uuid.c5
-rw-r--r--lib/vsprintf.c2
26 files changed, 668 insertions, 298 deletions
diff --git a/lib/binman.c b/lib/binman.c
index 93d85548116..9047f5275f3 100644
--- a/lib/binman.c
+++ b/lib/binman.c
@@ -137,7 +137,6 @@ int binman_init(void)
{
int ret;
- return 0;
binman = malloc(sizeof(struct binman_info));
if (!binman)
return log_msg_ret("space for binman", -ENOMEM);
diff --git a/lib/efi_loader/Kconfig b/lib/efi_loader/Kconfig
index 066f0ca0da7..d93f28b8422 100644
--- a/lib/efi_loader/Kconfig
+++ b/lib/efi_loader/Kconfig
@@ -481,7 +481,6 @@ endmenu
menu "Misc options"
config EFI_LOADER_BOUNCE_BUFFER
bool "EFI Applications use bounce buffers for DMA operations"
- depends on ARM64
help
Some hardware does not support DMA to full 64bit addresses. For this
hardware we can create a bounce buffer so that payloads don't have to
@@ -567,6 +566,16 @@ config BOOTEFI_HELLO_COMPILE
No additional space will be required in the resulting U-Boot binary
when this option is enabled.
+config BOOTEFI_TESTAPP_COMPILE
+ bool "Compile an EFI test app for testing"
+ default y
+ help
+ This compiles an app designed for testing. It is packed into an image
+ by the test.py testing frame in the setup_efi_image() function.
+
+ No additional space will be required in the resulting U-Boot binary
+ when this option is enabled.
+
endif
source "lib/efi/Kconfig"
diff --git a/lib/efi_loader/Makefile b/lib/efi_loader/Makefile
index 00d18966f9e..87131ab911d 100644
--- a/lib/efi_loader/Makefile
+++ b/lib/efi_loader/Makefile
@@ -20,6 +20,7 @@ apps-$(CONFIG_EFI_LOAD_FILE2_INITRD) += initrddump
ifeq ($(CONFIG_GENERATE_ACPI_TABLE),)
apps-y += dtbdump
endif
+apps-$(CONFIG_BOOTEFI_TESTAPP_COMPILE) += testapp
obj-$(CONFIG_CMD_BOOTEFI_HELLO) += helloworld_efi.o
obj-$(CONFIG_EFI_BOOTMGR) += efi_bootmgr.o
diff --git a/lib/efi_loader/efi_bootbin.c b/lib/efi_loader/efi_bootbin.c
index bf38392fac3..a87006b3c0e 100644
--- a/lib/efi_loader/efi_bootbin.c
+++ b/lib/efi_loader/efi_bootbin.c
@@ -137,7 +137,6 @@ efi_status_t efi_run_image(void *source_buffer, efi_uintn_t source_size)
*/
file_path = efi_dp_from_mem(EFI_RESERVED_MEMORY_TYPE,
(uintptr_t)source_buffer,
- (uintptr_t)source_buffer +
source_size);
/*
* Make sure that device for device_path exist
diff --git a/lib/efi_loader/efi_bootmgr.c b/lib/efi_loader/efi_bootmgr.c
index f9b5988a06e..8c51a6ef2ed 100644
--- a/lib/efi_loader/efi_bootmgr.c
+++ b/lib/efi_loader/efi_bootmgr.c
@@ -11,10 +11,10 @@
#include <blkmap.h>
#include <charset.h>
#include <dm.h>
+#include <efi.h>
#include <log.h>
#include <malloc.h>
#include <net.h>
-#include <efi_default_filename.h>
#include <efi_loader.h>
#include <efi_variable.h>
#include <asm/unaligned.h>
@@ -82,8 +82,12 @@ struct efi_device_path *expand_media_path(struct efi_device_path *device_path)
&efi_simple_file_system_protocol_guid, &rem);
if (handle) {
if (rem->type == DEVICE_PATH_TYPE_END) {
- full_path = efi_dp_from_file(device_path,
- "/EFI/BOOT/" BOOTEFI_NAME);
+ char fname[30];
+
+ snprintf(fname, sizeof(fname), "/EFI/BOOT/%s",
+ efi_get_basename());
+ full_path = efi_dp_from_file(device_path, fname);
+
} else {
full_path = efi_dp_dup(device_path);
}
diff --git a/lib/efi_loader/efi_boottime.c b/lib/efi_loader/efi_boottime.c
index 4f52284b4c6..080e7f78ae3 100644
--- a/lib/efi_loader/efi_boottime.c
+++ b/lib/efi_loader/efi_boottime.c
@@ -2234,7 +2234,7 @@ static efi_status_t EFIAPI efi_exit_boot_services(efi_handle_t image_handle,
if (IS_ENABLED(CONFIG_USB_DEVICE))
udc_disconnect();
board_quiesce_devices();
- dm_remove_devices_flags(DM_REMOVE_ACTIVE_ALL);
+ dm_remove_devices_active();
}
/* Patch out unsupported runtime function */
diff --git a/lib/efi_loader/efi_device_path.c b/lib/efi_loader/efi_device_path.c
index d7444588aa0..ee387e1dfd4 100644
--- a/lib/efi_loader/efi_device_path.c
+++ b/lib/efi_loader/efi_device_path.c
@@ -977,7 +977,7 @@ struct efi_device_path __maybe_unused *efi_dp_from_eth(void)
/* Construct a device-path for memory-mapped image */
struct efi_device_path *efi_dp_from_mem(uint32_t memory_type,
uint64_t start_address,
- uint64_t end_address)
+ size_t size)
{
struct efi_device_path_memory *mdp;
void *buf, *start;
@@ -992,7 +992,7 @@ struct efi_device_path *efi_dp_from_mem(uint32_t memory_type,
mdp->dp.length = sizeof(*mdp);
mdp->memory_type = memory_type;
mdp->start_address = start_address;
- mdp->end_address = end_address;
+ mdp->end_address = start_address + size;
buf = &mdp[1];
*((struct efi_device_path *)buf) = END;
@@ -1073,8 +1073,7 @@ efi_status_t efi_dp_from_name(const char *dev, const char *devnr,
efi_get_image_parameters(&image_addr, &image_size);
dp = efi_dp_from_mem(EFI_RESERVED_MEMORY_TYPE,
- (uintptr_t)image_addr,
- (uintptr_t)image_addr + image_size);
+ (uintptr_t)image_addr, image_size);
} else if (IS_ENABLED(CONFIG_NETDEVICES) && !strcmp(dev, "Net")) {
dp = efi_dp_from_eth();
} else if (!strcmp(dev, "Uart")) {
diff --git a/lib/efi_loader/efi_helper.c b/lib/efi_loader/efi_helper.c
index 00167bd2a10..bf96f61d3d0 100644
--- a/lib/efi_loader/efi_helper.c
+++ b/lib/efi_loader/efi_helper.c
@@ -12,18 +12,89 @@
#include <mapmem.h>
#include <dm.h>
#include <fs.h>
+#include <efi.h>
#include <efi_api.h>
#include <efi_load_initrd.h>
#include <efi_loader.h>
#include <efi_variable.h>
+#include <host_arch.h>
#include <linux/libfdt.h>
#include <linux/list.h>
+#undef BOOTEFI_NAME
+
+#if HOST_ARCH == HOST_ARCH_X86_64
+#define HOST_BOOTEFI_NAME "BOOTX64.EFI"
+#define HOST_PXE_ARCH 0x6
+#elif HOST_ARCH == HOST_ARCH_X86
+#define HOST_BOOTEFI_NAME "BOOTIA32.EFI"
+#define HOST_PXE_ARCH 0x7
+#elif HOST_ARCH == HOST_ARCH_AARCH64
+#define HOST_BOOTEFI_NAME "BOOTAA64.EFI"
+#define HOST_PXE_ARCH 0xb
+#elif HOST_ARCH == HOST_ARCH_ARM
+#define HOST_BOOTEFI_NAME "BOOTARM.EFI"
+#define HOST_PXE_ARCH 0xa
+#elif HOST_ARCH == HOST_ARCH_RISCV32
+#define HOST_BOOTEFI_NAME "BOOTRISCV32.EFI"
+#define HOST_PXE_ARCH 0x19
+#elif HOST_ARCH == HOST_ARCH_RISCV64
+#define HOST_BOOTEFI_NAME "BOOTRISCV64.EFI"
+#define HOST_PXE_ARCH 0x1b
+#else
+#error Unsupported Host architecture
+#endif
+
+#if defined(CONFIG_SANDBOX)
+#define BOOTEFI_NAME "BOOTSBOX.EFI"
+#elif defined(CONFIG_ARM64)
+#define BOOTEFI_NAME "BOOTAA64.EFI"
+#elif defined(CONFIG_ARM)
+#define BOOTEFI_NAME "BOOTARM.EFI"
+#elif defined(CONFIG_X86_64)
+#define BOOTEFI_NAME "BOOTX64.EFI"
+#elif defined(CONFIG_X86)
+#define BOOTEFI_NAME "BOOTIA32.EFI"
+#elif defined(CONFIG_ARCH_RV32I)
+#define BOOTEFI_NAME "BOOTRISCV32.EFI"
+#elif defined(CONFIG_ARCH_RV64I)
+#define BOOTEFI_NAME "BOOTRISCV64.EFI"
+#else
+#error Unsupported UEFI architecture
+#endif
+
#if defined(CONFIG_CMD_EFIDEBUG) || defined(CONFIG_EFI_LOAD_FILE2_INITRD)
/* GUID used by Linux to identify the LoadFile2 protocol with the initrd */
const efi_guid_t efi_lf2_initrd_guid = EFI_INITRD_MEDIA_GUID;
#endif
+const char *efi_get_basename(void)
+{
+ return efi_use_host_arch() ? HOST_BOOTEFI_NAME : BOOTEFI_NAME;
+}
+
+int efi_get_pxe_arch(void)
+{
+ if (efi_use_host_arch())
+ return HOST_PXE_ARCH;
+
+ /* http://www.iana.org/assignments/dhcpv6-parameters/dhcpv6-parameters.xml */
+ if (IS_ENABLED(CONFIG_ARM64))
+ return 0xb;
+ else if (IS_ENABLED(CONFIG_ARM))
+ return 0xa;
+ else if (IS_ENABLED(CONFIG_X86_64))
+ return 0x6;
+ else if (IS_ENABLED(CONFIG_X86))
+ return 0x7;
+ else if (IS_ENABLED(CONFIG_ARCH_RV32I))
+ return 0x19;
+ else if (IS_ENABLED(CONFIG_ARCH_RV64I))
+ return 0x1b;
+
+ return -EINVAL;
+}
+
/**
* efi_create_current_boot_var() - Return Boot#### name were #### is replaced by
* the value of BootCurrent
diff --git a/lib/efi_loader/efi_memory.c b/lib/efi_loader/efi_memory.c
index d2f5d563f2a..edd7da7d8c6 100644
--- a/lib/efi_loader/efi_memory.c
+++ b/lib/efi_loader/efi_memory.c
@@ -451,7 +451,7 @@ efi_status_t efi_allocate_pages(enum efi_allocate_type type,
enum efi_memory_type memory_type,
efi_uintn_t pages, uint64_t *memory)
{
- u64 len;
+ u64 efi_addr, len;
uint flags;
efi_status_t ret;
phys_addr_t addr;
@@ -499,14 +499,17 @@ efi_status_t efi_allocate_pages(enum efi_allocate_type type,
return EFI_INVALID_PARAMETER;
}
- addr = (u64)(uintptr_t)map_sysmem(addr, 0);
+ efi_addr = (u64)(uintptr_t)map_sysmem(addr, 0);
/* Reserve that map in our memory maps */
- ret = efi_add_memory_map_pg(addr, pages, memory_type, true);
- if (ret != EFI_SUCCESS)
+ ret = efi_add_memory_map_pg(efi_addr, pages, memory_type, true);
+ if (ret != EFI_SUCCESS) {
/* Map would overlap, bail out */
+ lmb_free_flags(addr, (u64)pages << EFI_PAGE_SHIFT, flags);
+ unmap_sysmem((void *)(uintptr_t)efi_addr);
return EFI_OUT_OF_RESOURCES;
+ }
- *memory = addr;
+ *memory = efi_addr;
return EFI_SUCCESS;
}
@@ -546,6 +549,8 @@ efi_status_t efi_free_pages(uint64_t memory, efi_uintn_t pages)
if (status)
return EFI_NOT_FOUND;
+ unmap_sysmem((void *)(uintptr_t)memory);
+
return ret;
}
@@ -809,7 +814,16 @@ static void add_u_boot_and_runtime(void)
{
unsigned long runtime_start, runtime_end, runtime_pages;
unsigned long runtime_mask = EFI_PAGE_MASK;
-
+ unsigned long uboot_start, uboot_pages;
+ unsigned long uboot_stack_size = CONFIG_STACK_SIZE;
+
+ /* Add U-Boot */
+ uboot_start = ((uintptr_t)map_sysmem(gd->start_addr_sp, 0) -
+ uboot_stack_size) & ~EFI_PAGE_MASK;
+ uboot_pages = ((uintptr_t)map_sysmem(gd->ram_top - 1, 0) -
+ uboot_start + EFI_PAGE_MASK) >> EFI_PAGE_SHIFT;
+ efi_add_memory_map_pg(uboot_start, uboot_pages, EFI_BOOT_SERVICES_CODE,
+ false);
#if defined(__aarch64__)
/*
* Runtime Services must be 64KiB aligned according to the
diff --git a/lib/efi_loader/efi_tcg2.c b/lib/efi_loader/efi_tcg2.c
index 866a529857e..572c6b5bf63 100644
--- a/lib/efi_loader/efi_tcg2.c
+++ b/lib/efi_loader/efi_tcg2.c
@@ -607,12 +607,9 @@ efi_tcg2_hash_log_extend_event(struct efi_tcg2_protocol *this, u64 flags,
* Format"
*/
if (flags & PE_COFF_IMAGE) {
- IMAGE_NT_HEADERS32 *nt;
-
ret = efi_check_pe((void *)(uintptr_t)data_to_hash,
- data_to_hash_len, (void **)&nt);
+ data_to_hash_len, NULL);
if (ret != EFI_SUCCESS) {
- log_err("Not a valid PE-COFF file\n");
ret = EFI_UNSUPPORTED;
goto out;
}
diff --git a/lib/efi_loader/testapp.c b/lib/efi_loader/testapp.c
new file mode 100644
index 00000000000..804ca7e4679
--- /dev/null
+++ b/lib/efi_loader/testapp.c
@@ -0,0 +1,56 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * EFI test application
+ *
+ * Copyright 2024 Google LLC
+ * Written by Simon Glass <sjg@chromium.org>
+ *
+ * This test program is used to test the invocation of an EFI application.
+ * It writes a few messages to the console and then exits boot services
+ */
+
+#include <efi_api.h>
+
+static const efi_guid_t loaded_image_guid = EFI_LOADED_IMAGE_PROTOCOL_GUID;
+
+static struct efi_system_table *systable;
+static struct efi_boot_services *boottime;
+static struct efi_simple_text_output_protocol *con_out;
+
+/**
+ * efi_main() - entry point of the EFI application.
+ *
+ * @handle: handle of the loaded image
+ * @systab: system table
+ * Return: status code
+ */
+efi_status_t EFIAPI efi_main(efi_handle_t handle,
+ struct efi_system_table *systab)
+{
+ struct efi_loaded_image *loaded_image;
+ efi_status_t ret;
+
+ systable = systab;
+ boottime = systable->boottime;
+ con_out = systable->con_out;
+
+ /* Get the loaded image protocol */
+ ret = boottime->open_protocol(handle, &loaded_image_guid,
+ (void **)&loaded_image, NULL, NULL,
+ EFI_OPEN_PROTOCOL_GET_PROTOCOL);
+ if (ret != EFI_SUCCESS) {
+ con_out->output_string
+ (con_out, u"Cannot open loaded image protocol\r\n");
+ goto out;
+ }
+
+ /* UEFI requires CR LF */
+ con_out->output_string(con_out, u"U-Boot test app for EFI_LOADER\r\n");
+
+out:
+ con_out->output_string(con_out, u"Exiting test app\n");
+ ret = boottime->exit(handle, ret, 0, NULL);
+
+ /* We should never arrive here */
+ return ret;
+}
diff --git a/lib/lmb.c b/lib/lmb.c
index 2ed0da21b45..14b9b8466ff 100644
--- a/lib/lmb.c
+++ b/lib/lmb.c
@@ -27,96 +27,11 @@ DECLARE_GLOBAL_DATA_PTR;
#define MAP_OP_FREE (u8)0x2
#define MAP_OP_ADD (u8)0x3
-static struct lmb lmb;
-
-static bool lmb_should_notify(enum lmb_flags flags)
-{
- return !lmb.test && !(flags & LMB_NONOTIFY) &&
- CONFIG_IS_ENABLED(EFI_LOADER);
-}
-
-static int lmb_map_update_notify(phys_addr_t addr, phys_size_t size, u8 op,
- enum lmb_flags flags)
-{
- u64 efi_addr;
- u64 pages;
- efi_status_t status;
-
- if (op != MAP_OP_RESERVE && op != MAP_OP_FREE && op != MAP_OP_ADD) {
- log_err("Invalid map update op received (%d)\n", op);
- return -1;
- }
-
- if (!lmb_should_notify(flags))
- return 0;
-
- efi_addr = (uintptr_t)map_sysmem(addr, 0);
- pages = efi_size_in_pages(size + (efi_addr & EFI_PAGE_MASK));
- efi_addr &= ~EFI_PAGE_MASK;
-
- status = efi_add_memory_map_pg(efi_addr, pages,
- op == MAP_OP_RESERVE ?
- EFI_BOOT_SERVICES_DATA :
- EFI_CONVENTIONAL_MEMORY,
- false);
- if (status != EFI_SUCCESS) {
- log_err("%s: LMB Map notify failure %lu\n", __func__,
- status & ~EFI_ERROR_MASK);
- return -1;
- }
- unmap_sysmem((void *)(uintptr_t)efi_addr);
-
- return 0;
-}
-
-static void lmb_print_region_flags(enum lmb_flags flags)
-{
- u64 bitpos;
- const char *flag_str[] = { "none", "no-map", "no-overwrite", "no-notify" };
-
- do {
- bitpos = flags ? fls(flags) - 1 : 0;
- assert_noisy(bitpos < ARRAY_SIZE(flag_str));
- printf("%s", flag_str[bitpos]);
- flags &= ~(1ull << bitpos);
- puts(flags ? ", " : "\n");
- } while (flags);
-}
-
-static void lmb_dump_region(struct alist *lmb_rgn_lst, char *name)
-{
- struct lmb_region *rgn = lmb_rgn_lst->data;
- unsigned long long base, size, end;
- enum lmb_flags flags;
- int i;
-
- printf(" %s.count = 0x%x\n", name, lmb_rgn_lst->count);
-
- for (i = 0; i < lmb_rgn_lst->count; i++) {
- base = rgn[i].base;
- size = rgn[i].size;
- end = base + size - 1;
- flags = rgn[i].flags;
-
- printf(" %s[%d]\t[0x%llx-0x%llx], 0x%08llx bytes flags: ",
- name, i, base, end, size);
- lmb_print_region_flags(flags);
- }
-}
-
-void lmb_dump_all_force(void)
-{
- printf("lmb_dump_all:\n");
- lmb_dump_region(&lmb.free_mem, "memory");
- lmb_dump_region(&lmb.used_mem, "reserved");
-}
-
-void lmb_dump_all(void)
-{
-#ifdef DEBUG
- lmb_dump_all_force();
-#endif
-}
+/*
+ * The following low level LMB functions must not access the global LMB memory
+ * map since they are also used to manage IOVA memory maps in iommu drivers like
+ * apple_dart.
+ */
static long lmb_addrs_overlap(phys_addr_t base1, phys_size_t size1,
phys_addr_t base2, phys_size_t size2)
@@ -205,117 +120,6 @@ static void lmb_fix_over_lap_regions(struct alist *lmb_rgn_lst,
lmb_remove_region(lmb_rgn_lst, r2);
}
-static void lmb_reserve_uboot_region(void)
-{
- int bank;
- ulong end, bank_end;
- phys_addr_t rsv_start;
-
- rsv_start = gd->start_addr_sp - CONFIG_STACK_SIZE;
- end = gd->ram_top;
-
- /*
- * Reserve memory from aligned address below the bottom of U-Boot stack
- * until end of RAM area to prevent LMB from overwriting that memory.
- */
- debug("## Current stack ends at 0x%08lx ", (ulong)rsv_start);
-
- /* adjust sp by 16K to be safe */
- rsv_start -= SZ_16K;
- for (bank = 0; bank < CONFIG_NR_DRAM_BANKS; bank++) {
- if (!gd->bd->bi_dram[bank].size ||
- rsv_start < gd->bd->bi_dram[bank].start)
- continue;
- /* Watch out for RAM at end of address space! */
- bank_end = gd->bd->bi_dram[bank].start +
- gd->bd->bi_dram[bank].size - 1;
- if (rsv_start > bank_end)
- continue;
- if (bank_end > end)
- bank_end = end - 1;
-
- lmb_reserve_flags(rsv_start, bank_end - rsv_start + 1,
- LMB_NOOVERWRITE);
-
- if (gd->flags & GD_FLG_SKIP_RELOC)
- lmb_reserve_flags((phys_addr_t)(uintptr_t)_start,
- gd->mon_len, LMB_NOOVERWRITE);
-
- break;
- }
-}
-
-static void lmb_reserve_common(void *fdt_blob)
-{
- lmb_reserve_uboot_region();
-
- if (CONFIG_IS_ENABLED(OF_LIBFDT) && fdt_blob)
- boot_fdt_add_mem_rsv_regions(fdt_blob);
-}
-
-static __maybe_unused void lmb_reserve_common_spl(void)
-{
- phys_addr_t rsv_start;
- phys_size_t rsv_size;
-
- /*
- * Assume a SPL stack of 16KB. This must be
- * more than enough for the SPL stage.
- */
- if (IS_ENABLED(CONFIG_SPL_STACK_R_ADDR)) {
- rsv_start = gd->start_addr_sp - 16384;
- rsv_size = 16384;
- lmb_reserve_flags(rsv_start, rsv_size, LMB_NOOVERWRITE);
- }
-
- if (IS_ENABLED(CONFIG_SPL_SEPARATE_BSS)) {
- /* Reserve the bss region */
- rsv_start = (phys_addr_t)(uintptr_t)__bss_start;
- rsv_size = (phys_addr_t)(uintptr_t)__bss_end -
- (phys_addr_t)(uintptr_t)__bss_start;
- lmb_reserve_flags(rsv_start, rsv_size, LMB_NOOVERWRITE);
- }
-}
-
-/**
- * lmb_add_memory() - Add memory range for LMB allocations
- *
- * Add the entire available memory range to the pool of memory that
- * can be used by the LMB module for allocations.
- *
- * Return: None
- */
-void lmb_add_memory(void)
-{
- int i;
- phys_size_t size;
- u64 ram_top = gd->ram_top;
- struct bd_info *bd = gd->bd;
-
- if (CONFIG_IS_ENABLED(LMB_ARCH_MEM_MAP))
- return lmb_arch_add_memory();
-
- /* Assume a 4GB ram_top if not defined */
- if (!ram_top)
- ram_top = 0x100000000ULL;
-
- for (i = 0; i < CONFIG_NR_DRAM_BANKS; i++) {
- size = bd->bi_dram[i].size;
- if (size) {
- lmb_add(bd->bi_dram[i].start, size);
-
- /*
- * Reserve memory above ram_top as
- * no-overwrite so that it cannot be
- * allocated
- */
- if (bd->bi_dram[i].start >= ram_top)
- lmb_reserve_flags(bd->bi_dram[i].start, size,
- LMB_NOOVERWRITE);
- }
- }
-}
-
static long lmb_resize_regions(struct alist *lmb_rgn_lst,
unsigned long idx_start,
phys_addr_t base, phys_size_t size)
@@ -475,29 +279,10 @@ static long lmb_add_region_flags(struct alist *lmb_rgn_lst, phys_addr_t base,
return 0;
}
-static long lmb_add_region(struct alist *lmb_rgn_lst, phys_addr_t base,
- phys_size_t size)
-{
- return lmb_add_region_flags(lmb_rgn_lst, base, size, LMB_NONE);
-}
-
-/* This routine may be called with relocation disabled. */
-long lmb_add(phys_addr_t base, phys_size_t size)
-{
- long ret;
- struct alist *lmb_rgn_lst = &lmb.free_mem;
-
- ret = lmb_add_region(lmb_rgn_lst, base, size);
- if (ret)
- return ret;
-
- return lmb_map_update_notify(base, size, MAP_OP_ADD, LMB_NONE);
-}
-
-static long _lmb_free(phys_addr_t base, phys_size_t size)
+static long _lmb_free(struct alist *lmb_rgn_lst, phys_addr_t base,
+ phys_size_t size)
{
struct lmb_region *rgn;
- struct alist *lmb_rgn_lst = &lmb.used_mem;
phys_addr_t rgnbegin, rgnend;
phys_addr_t end = base + size - 1;
int i;
@@ -545,6 +330,338 @@ static long _lmb_free(phys_addr_t base, phys_size_t size)
rgn[i].flags);
}
+static long lmb_overlaps_region(struct alist *lmb_rgn_lst, phys_addr_t base,
+ phys_size_t size)
+{
+ unsigned long i;
+ struct lmb_region *rgn = lmb_rgn_lst->data;
+
+ for (i = 0; i < lmb_rgn_lst->count; i++) {
+ phys_addr_t rgnbase = rgn[i].base;
+ phys_size_t rgnsize = rgn[i].size;
+ if (lmb_addrs_overlap(base, size, rgnbase, rgnsize))
+ break;
+ }
+
+ return (i < lmb_rgn_lst->count) ? i : -1;
+}
+
+static phys_addr_t lmb_align_down(phys_addr_t addr, phys_size_t size)
+{
+ return addr & ~(size - 1);
+}
+
+/*
+ * IOVA LMB memory maps using lmb pointers instead of the global LMB memory map.
+ */
+
+int io_lmb_setup(struct lmb *io_lmb)
+{
+ int ret;
+
+ ret = alist_init(&io_lmb->free_mem, sizeof(struct lmb_region),
+ (uint)LMB_ALIST_INITIAL_SIZE);
+ if (!ret) {
+ log_debug("Unable to initialise the list for LMB free IOVA\n");
+ return -ENOMEM;
+ }
+
+ ret = alist_init(&io_lmb->used_mem, sizeof(struct lmb_region),
+ (uint)LMB_ALIST_INITIAL_SIZE);
+ if (!ret) {
+ log_debug("Unable to initialise the list for LMB used IOVA\n");
+ return -ENOMEM;
+ }
+
+ io_lmb->test = false;
+
+ return 0;
+}
+
+void io_lmb_teardown(struct lmb *io_lmb)
+{
+ alist_uninit(&io_lmb->free_mem);
+ alist_uninit(&io_lmb->used_mem);
+}
+
+long io_lmb_add(struct lmb *io_lmb, phys_addr_t base, phys_size_t size)
+{
+ return lmb_add_region_flags(&io_lmb->free_mem, base, size, LMB_NONE);
+}
+
+/* derived and simplified from _lmb_alloc_base() */
+phys_addr_t io_lmb_alloc(struct lmb *io_lmb, phys_size_t size, ulong align)
+{
+ long i, rgn;
+ phys_addr_t base = 0;
+ phys_addr_t res_base;
+ struct lmb_region *lmb_used = io_lmb->used_mem.data;
+ struct lmb_region *lmb_memory = io_lmb->free_mem.data;
+
+ for (i = io_lmb->free_mem.count - 1; i >= 0; i--) {
+ phys_addr_t lmbbase = lmb_memory[i].base;
+ phys_size_t lmbsize = lmb_memory[i].size;
+
+ if (lmbsize < size)
+ continue;
+ base = lmb_align_down(lmbbase + lmbsize - size, align);
+
+ while (base && lmbbase <= base) {
+ rgn = lmb_overlaps_region(&io_lmb->used_mem, base, size);
+ if (rgn < 0) {
+ /* This area isn't reserved, take it */
+ if (lmb_add_region_flags(&io_lmb->used_mem, base,
+ size, LMB_NONE) < 0)
+ return 0;
+
+ return base;
+ }
+
+ res_base = lmb_used[rgn].base;
+ if (res_base < size)
+ break;
+ base = lmb_align_down(res_base - size, align);
+ }
+ }
+ return 0;
+}
+
+long io_lmb_free(struct lmb *io_lmb, phys_addr_t base, phys_size_t size)
+{
+ return _lmb_free(&io_lmb->used_mem, base, size);
+}
+
+/*
+ * Low level LMB functions are used to manage IOVA memory maps for the Apple
+ * dart iommu. They must not access the global LMB memory map.
+ * So keep the global LMB variable declaration unreachable from them.
+ */
+
+static struct lmb lmb;
+
+static bool lmb_should_notify(enum lmb_flags flags)
+{
+ return !lmb.test && !(flags & LMB_NONOTIFY) &&
+ CONFIG_IS_ENABLED(EFI_LOADER);
+}
+
+static int lmb_map_update_notify(phys_addr_t addr, phys_size_t size, u8 op,
+ enum lmb_flags flags)
+{
+ u64 efi_addr;
+ u64 pages;
+ efi_status_t status;
+
+ if (op != MAP_OP_RESERVE && op != MAP_OP_FREE && op != MAP_OP_ADD) {
+ log_err("Invalid map update op received (%d)\n", op);
+ return -1;
+ }
+
+ if (!lmb_should_notify(flags))
+ return 0;
+
+ efi_addr = (uintptr_t)map_sysmem(addr, 0);
+ pages = efi_size_in_pages(size + (efi_addr & EFI_PAGE_MASK));
+ efi_addr &= ~EFI_PAGE_MASK;
+
+ status = efi_add_memory_map_pg(efi_addr, pages,
+ op == MAP_OP_RESERVE ?
+ EFI_BOOT_SERVICES_DATA :
+ EFI_CONVENTIONAL_MEMORY,
+ false);
+ if (status != EFI_SUCCESS) {
+ log_err("%s: LMB Map notify failure %lu\n", __func__,
+ status & ~EFI_ERROR_MASK);
+ return -1;
+ }
+ unmap_sysmem((void *)(uintptr_t)efi_addr);
+
+ return 0;
+}
+
+static void lmb_print_region_flags(enum lmb_flags flags)
+{
+ const char *flag_str[] = { "none", "no-map", "no-overwrite", "no-notify" };
+ unsigned int pflags = flags &
+ (LMB_NOMAP | LMB_NOOVERWRITE | LMB_NONOTIFY);
+
+ if (flags != pflags) {
+ printf("invalid %#x\n", flags);
+ return;
+ }
+
+ do {
+ int bitpos = pflags ? fls(pflags) - 1 : 0;
+
+ printf("%s", flag_str[bitpos]);
+ pflags &= ~(1u << bitpos);
+ puts(pflags ? ", " : "\n");
+ } while (pflags);
+}
+
+static void lmb_dump_region(struct alist *lmb_rgn_lst, char *name)
+{
+ struct lmb_region *rgn = lmb_rgn_lst->data;
+ unsigned long long base, size, end;
+ enum lmb_flags flags;
+ int i;
+
+ printf(" %s.count = %#x\n", name, lmb_rgn_lst->count);
+
+ for (i = 0; i < lmb_rgn_lst->count; i++) {
+ base = rgn[i].base;
+ size = rgn[i].size;
+ end = base + size - 1;
+ flags = rgn[i].flags;
+
+ printf(" %s[%d]\t[%#llx-%#llx], %#llx bytes, flags: ",
+ name, i, base, end, size);
+ lmb_print_region_flags(flags);
+ }
+}
+
+void lmb_dump_all_force(void)
+{
+ printf("lmb_dump_all:\n");
+ lmb_dump_region(&lmb.free_mem, "memory");
+ lmb_dump_region(&lmb.used_mem, "reserved");
+}
+
+void lmb_dump_all(void)
+{
+#ifdef DEBUG
+ lmb_dump_all_force();
+#endif
+}
+
+static void lmb_reserve_uboot_region(void)
+{
+ int bank;
+ ulong end, bank_end;
+ phys_addr_t rsv_start;
+
+ rsv_start = gd->start_addr_sp - CONFIG_STACK_SIZE;
+ end = gd->ram_top;
+
+ /*
+ * Reserve memory from aligned address below the bottom of U-Boot stack
+ * until end of RAM area to prevent LMB from overwriting that memory.
+ */
+ debug("## Current stack ends at 0x%08lx ", (ulong)rsv_start);
+
+ for (bank = 0; bank < CONFIG_NR_DRAM_BANKS; bank++) {
+ if (!gd->bd->bi_dram[bank].size ||
+ rsv_start < gd->bd->bi_dram[bank].start)
+ continue;
+ /* Watch out for RAM at end of address space! */
+ bank_end = gd->bd->bi_dram[bank].start +
+ gd->bd->bi_dram[bank].size - 1;
+ if (rsv_start > bank_end)
+ continue;
+ if (bank_end > end)
+ bank_end = end - 1;
+
+ lmb_reserve_flags(rsv_start, bank_end - rsv_start + 1,
+ LMB_NOOVERWRITE);
+
+ if (gd->flags & GD_FLG_SKIP_RELOC)
+ lmb_reserve_flags((phys_addr_t)(uintptr_t)_start,
+ gd->mon_len, LMB_NOOVERWRITE);
+
+ break;
+ }
+}
+
+static void lmb_reserve_common(void *fdt_blob)
+{
+ lmb_reserve_uboot_region();
+
+ if (CONFIG_IS_ENABLED(OF_LIBFDT) && fdt_blob)
+ boot_fdt_add_mem_rsv_regions(fdt_blob);
+}
+
+static __maybe_unused void lmb_reserve_common_spl(void)
+{
+ phys_addr_t rsv_start;
+ phys_size_t rsv_size;
+
+ /*
+ * Assume a SPL stack of 16KB. This must be
+ * more than enough for the SPL stage.
+ */
+ if (IS_ENABLED(CONFIG_SPL_STACK_R_ADDR)) {
+ rsv_start = gd->start_addr_sp - 16384;
+ rsv_size = 16384;
+ lmb_reserve_flags(rsv_start, rsv_size, LMB_NOOVERWRITE);
+ }
+
+ if (IS_ENABLED(CONFIG_SPL_SEPARATE_BSS)) {
+ /* Reserve the bss region */
+ rsv_start = (phys_addr_t)(uintptr_t)__bss_start;
+ rsv_size = (phys_addr_t)(uintptr_t)__bss_end -
+ (phys_addr_t)(uintptr_t)__bss_start;
+ lmb_reserve_flags(rsv_start, rsv_size, LMB_NOOVERWRITE);
+ }
+}
+
+/**
+ * lmb_add_memory() - Add memory range for LMB allocations
+ *
+ * Add the entire available memory range to the pool of memory that
+ * can be used by the LMB module for allocations.
+ *
+ * Return: None
+ */
+void lmb_add_memory(void)
+{
+ int i;
+ phys_size_t size;
+ u64 ram_top = gd->ram_top;
+ struct bd_info *bd = gd->bd;
+
+ if (CONFIG_IS_ENABLED(LMB_ARCH_MEM_MAP))
+ return lmb_arch_add_memory();
+
+ /* Assume a 4GB ram_top if not defined */
+ if (!ram_top)
+ ram_top = 0x100000000ULL;
+
+ for (i = 0; i < CONFIG_NR_DRAM_BANKS; i++) {
+ size = bd->bi_dram[i].size;
+ if (size) {
+ lmb_add(bd->bi_dram[i].start, size);
+
+ /*
+ * Reserve memory above ram_top as
+ * no-overwrite so that it cannot be
+ * allocated
+ */
+ if (bd->bi_dram[i].start >= ram_top)
+ lmb_reserve_flags(bd->bi_dram[i].start, size,
+ LMB_NOOVERWRITE);
+ }
+ }
+}
+
+static long lmb_add_region(struct alist *lmb_rgn_lst, phys_addr_t base,
+ phys_size_t size)
+{
+ return lmb_add_region_flags(lmb_rgn_lst, base, size, LMB_NONE);
+}
+
+/* This routine may be called with relocation disabled. */
+long lmb_add(phys_addr_t base, phys_size_t size)
+{
+ long ret;
+ struct alist *lmb_rgn_lst = &lmb.free_mem;
+
+ ret = lmb_add_region(lmb_rgn_lst, base, size);
+ if (ret)
+ return ret;
+
+ return lmb_map_update_notify(base, size, MAP_OP_ADD, LMB_NONE);
+}
+
/**
* lmb_free_flags() - Free up a region of memory
* @base: Base Address of region to be freed
@@ -560,7 +677,7 @@ long lmb_free_flags(phys_addr_t base, phys_size_t size,
{
long ret;
- ret = _lmb_free(base, size);
+ ret = _lmb_free(&lmb.used_mem, base, size);
if (ret < 0)
return ret;
@@ -589,27 +706,6 @@ long lmb_reserve(phys_addr_t base, phys_size_t size)
return lmb_reserve_flags(base, size, LMB_NONE);
}
-static long lmb_overlaps_region(struct alist *lmb_rgn_lst, phys_addr_t base,
- phys_size_t size)
-{
- unsigned long i;
- struct lmb_region *rgn = lmb_rgn_lst->data;
-
- for (i = 0; i < lmb_rgn_lst->count; i++) {
- phys_addr_t rgnbase = rgn[i].base;
- phys_size_t rgnsize = rgn[i].size;
- if (lmb_addrs_overlap(base, size, rgnbase, rgnsize))
- break;
- }
-
- return (i < lmb_rgn_lst->count) ? i : -1;
-}
-
-static phys_addr_t lmb_align_down(phys_addr_t addr, phys_size_t size)
-{
- return addr & ~(size - 1);
-}
-
static phys_addr_t _lmb_alloc_base(phys_size_t size, ulong align,
phys_addr_t max_addr, enum lmb_flags flags)
{
diff --git a/lib/lwip/Makefile b/lib/lwip/Makefile
index dfcd700ca47..19e5c6897f5 100644
--- a/lib/lwip/Makefile
+++ b/lib/lwip/Makefile
@@ -53,3 +53,6 @@ obj-y += \
lwip/src/core/timeouts.o \
lwip/src/core/udp.o \
lwip/src/netif/ethernet.o
+
+obj-$(CONFIG_MBEDTLS_LIB_TLS) += lwip/src/apps/altcp_tls/altcp_tls_mbedtls.o \
+ lwip/src/apps/altcp_tls/altcp_tls_mbedtls_mem.o
diff --git a/lib/lwip/lwip/src/apps/altcp_tls/altcp_tls_mbedtls.c b/lib/lwip/lwip/src/apps/altcp_tls/altcp_tls_mbedtls.c
index a8c2fc2ee2c..6643b05ee94 100644
--- a/lib/lwip/lwip/src/apps/altcp_tls/altcp_tls_mbedtls.c
+++ b/lib/lwip/lwip/src/apps/altcp_tls/altcp_tls_mbedtls.c
@@ -70,7 +70,6 @@
/* @todo: which includes are really needed? */
#include "mbedtls/entropy.h"
#include "mbedtls/ctr_drbg.h"
-#include "mbedtls/certs.h"
#include "mbedtls/x509.h"
#include "mbedtls/ssl.h"
#include "mbedtls/net_sockets.h"
@@ -81,8 +80,6 @@
#include "mbedtls/ssl_cache.h"
#include "mbedtls/ssl_ticket.h"
-#include "mbedtls/ssl_internal.h" /* to call mbedtls_flush_output after ERR_MEM */
-
#include <string.h>
#ifndef ALTCP_MBEDTLS_ENTROPY_PTR
@@ -109,6 +106,7 @@ struct altcp_tls_config {
u8_t pkey_count;
u8_t pkey_max;
mbedtls_x509_crt *ca;
+ char host[256];
#if defined(MBEDTLS_SSL_CACHE_C) && ALTCP_MBEDTLS_USE_SESSION_CACHE
/** Inter-connection cache for fast connection startup */
struct mbedtls_ssl_cache_context cache;
@@ -132,6 +130,16 @@ static err_t altcp_mbedtls_lower_recv_process(struct altcp_pcb *conn, altcp_mbed
static err_t altcp_mbedtls_handle_rx_appldata(struct altcp_pcb *conn, altcp_mbedtls_state_t *state);
static int altcp_mbedtls_bio_send(void *ctx, const unsigned char *dataptr, size_t size);
+static void
+altcp_mbedtls_flush_output(altcp_mbedtls_state_t *state)
+{
+ if (state->ssl_context.MBEDTLS_PRIVATE(out_left) != 0) {
+ int flushed = mbedtls_ssl_send_alert_message(&state->ssl_context, 0, 0);
+ if (flushed) {
+ LWIP_DEBUGF(ALTCP_MBEDTLS_DEBUG, ("mbedtls_ssl_send_alert_message failed: %d\n", flushed));
+ }
+ }
+}
/* callback functions from inner/lower connection: */
@@ -524,14 +532,14 @@ altcp_mbedtls_lower_sent(void *arg, struct altcp_pcb *inner_conn, u16_t len)
LWIP_ASSERT("state", state != NULL);
LWIP_ASSERT("pcb mismatch", conn->inner_conn == inner_conn);
/* calculate TLS overhead part to not send it to application */
- overhead = state->overhead_bytes_adjust + state->ssl_context.out_left;
+ overhead = state->overhead_bytes_adjust + state->ssl_context.MBEDTLS_PRIVATE(out_left);
if ((unsigned)overhead > len) {
overhead = len;
}
/* remove ACKed bytes from overhead adjust counter */
state->overhead_bytes_adjust -= len;
/* try to send more if we failed before (may increase overhead adjust counter) */
- mbedtls_ssl_flush_output(&state->ssl_context);
+ altcp_mbedtls_flush_output(state);
/* remove calculated overhead from ACKed bytes len */
app_len = len - (u16_t)overhead;
/* update application write counter and inform application */
@@ -559,7 +567,7 @@ altcp_mbedtls_lower_poll(void *arg, struct altcp_pcb *inner_conn)
if (conn->state) {
altcp_mbedtls_state_t *state = (altcp_mbedtls_state_t *)conn->state;
/* try to send more if we failed before */
- mbedtls_ssl_flush_output(&state->ssl_context);
+ altcp_mbedtls_flush_output(state);
if (altcp_mbedtls_handle_rx_appldata(conn, state) == ERR_ABRT) {
return ERR_ABRT;
}
@@ -635,6 +643,7 @@ altcp_mbedtls_setup(void *conf, struct altcp_pcb *conn, struct altcp_pcb *inner_
/* tell mbedtls about our I/O functions */
mbedtls_ssl_set_bio(&state->ssl_context, conn, altcp_mbedtls_bio_send, altcp_mbedtls_bio_recv, NULL);
+ mbedtls_ssl_set_hostname(&state->ssl_context, config->host);
altcp_mbedtls_setup_callbacks(conn, inner_conn);
conn->inner_conn = inner_conn;
conn->fns = &altcp_mbedtls_functions;
@@ -683,7 +692,7 @@ altcp_tls_set_session(struct altcp_pcb *conn, struct altcp_tls_session *session)
if (session && conn && conn->state) {
altcp_mbedtls_state_t *state = (altcp_mbedtls_state_t *)conn->state;
int ret = -1;
- if (session->data.start)
+ if (session->data.MBEDTLS_PRIVATE(start))
ret = mbedtls_ssl_set_session(&state->ssl_context, &session->data);
return ret < 0 ? ERR_VAL : ERR_OK;
}
@@ -776,7 +785,7 @@ altcp_tls_create_config(int is_server, u8_t cert_count, u8_t pkey_count, int hav
struct altcp_tls_config *conf;
mbedtls_x509_crt *mem;
- if (TCP_WND < MBEDTLS_SSL_MAX_CONTENT_LEN) {
+ if (TCP_WND < MBEDTLS_SSL_IN_CONTENT_LEN || TCP_WND < MBEDTLS_SSL_OUT_CONTENT_LEN) {
LWIP_DEBUGF(ALTCP_MBEDTLS_DEBUG|LWIP_DBG_LEVEL_SERIOUS,
("altcp_tls: TCP_WND is smaller than the RX decrypion buffer, connection RX might stall!\n"));
}
@@ -900,7 +909,7 @@ err_t altcp_tls_config_server_add_privkey_cert(struct altcp_tls_config *config,
return ERR_VAL;
}
- ret = mbedtls_pk_parse_key(pkey, (const unsigned char *) privkey, privkey_len, privkey_pass, privkey_pass_len);
+ ret = mbedtls_pk_parse_key(pkey, (const unsigned char *) privkey, privkey_len, privkey_pass, privkey_pass_len, mbedtls_ctr_drbg_random, &altcp_tls_entropy_rng->ctr_drbg);
if (ret != 0) {
LWIP_DEBUGF(ALTCP_MBEDTLS_DEBUG, ("mbedtls_pk_parse_public_key failed: %d\n", ret));
mbedtls_x509_crt_free(srvcert);
@@ -944,7 +953,7 @@ altcp_tls_create_config_server_privkey_cert(const u8_t *privkey, size_t privkey_
}
static struct altcp_tls_config *
-altcp_tls_create_config_client_common(const u8_t *ca, size_t ca_len, int is_2wayauth)
+altcp_tls_create_config_client_common(const u8_t *ca, size_t ca_len, int is_2wayauth, char *host)
{
int ret;
struct altcp_tls_config *conf = altcp_tls_create_config(0, (is_2wayauth) ? 1 : 0, (is_2wayauth) ? 1 : 0, ca != NULL);
@@ -966,13 +975,15 @@ altcp_tls_create_config_client_common(const u8_t *ca, size_t ca_len, int is_2way
mbedtls_ssl_conf_ca_chain(&conf->conf, conf->ca, NULL);
}
+ strlcpy(conf->host, host, sizeof(conf->host));
+
return conf;
}
struct altcp_tls_config *
-altcp_tls_create_config_client(const u8_t *ca, size_t ca_len)
+altcp_tls_create_config_client(const u8_t *ca, size_t ca_len, char *host)
{
- return altcp_tls_create_config_client_common(ca, ca_len, 0);
+ return altcp_tls_create_config_client_common(ca, ca_len, 0, host);
}
struct altcp_tls_config *
@@ -988,7 +999,7 @@ altcp_tls_create_config_client_2wayauth(const u8_t *ca, size_t ca_len, const u8_
return NULL;
}
- conf = altcp_tls_create_config_client_common(ca, ca_len, 1);
+ conf = altcp_tls_create_config_client_common(ca, ca_len, 1, NULL);
if (conf == NULL) {
return NULL;
}
@@ -1003,7 +1014,7 @@ altcp_tls_create_config_client_2wayauth(const u8_t *ca, size_t ca_len, const u8_
}
mbedtls_pk_init(conf->pkey);
- ret = mbedtls_pk_parse_key(conf->pkey, privkey, privkey_len, privkey_pass, privkey_pass_len);
+ ret = mbedtls_pk_parse_key(conf->pkey, privkey, privkey_len, privkey_pass, privkey_pass_len, mbedtls_ctr_drbg_random, &altcp_tls_entropy_rng->ctr_drbg);
if (ret != 0) {
LWIP_DEBUGF(ALTCP_MBEDTLS_DEBUG, ("mbedtls_pk_parse_key failed: %d 0x%x\n", ret, -1*ret));
altcp_tls_free_config(conf);
@@ -1189,7 +1200,7 @@ altcp_mbedtls_sndbuf(struct altcp_pcb *conn)
size_t ret;
#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
/* @todo: adjust ssl_added to real value related to negotiated cipher */
- size_t max_frag_len = mbedtls_ssl_get_max_frag_len(&state->ssl_context);
+ size_t max_frag_len = mbedtls_ssl_get_max_in_record_payload(&state->ssl_context);
max_len = LWIP_MIN(max_frag_len, max_len);
#endif
/* Adjust sndbuf of inner_conn with what added by SSL */
@@ -1232,9 +1243,9 @@ altcp_mbedtls_write(struct altcp_pcb *conn, const void *dataptr, u16_t len, u8_t
/* HACK: if there is something left to send, try to flush it and only
allow sending more if this succeeded (this is a hack because neither
returning 0 nor MBEDTLS_ERR_SSL_WANT_WRITE worked for me) */
- if (state->ssl_context.out_left) {
- mbedtls_ssl_flush_output(&state->ssl_context);
- if (state->ssl_context.out_left) {
+ if (state->ssl_context.MBEDTLS_PRIVATE(out_left)) {
+ altcp_mbedtls_flush_output(state);
+ if (state->ssl_context.MBEDTLS_PRIVATE(out_left)) {
return ERR_MEM;
}
}
@@ -1284,6 +1295,8 @@ altcp_mbedtls_bio_send(void *ctx, const unsigned char *dataptr, size_t size)
while (size_left) {
u16_t write_len = (u16_t)LWIP_MIN(size_left, 0xFFFF);
err_t err = altcp_write(conn->inner_conn, (const void *)dataptr, write_len, apiflags);
+ /* try to send data... */
+ altcp_output(conn->inner_conn);
if (err == ERR_OK) {
written += write_len;
size_left -= write_len;
diff --git a/lib/lwip/lwip/src/core/tcp_out.c b/lib/lwip/lwip/src/core/tcp_out.c
index 64579ee5cbd..6dbc5f96b60 100644
--- a/lib/lwip/lwip/src/core/tcp_out.c
+++ b/lib/lwip/lwip/src/core/tcp_out.c
@@ -1255,14 +1255,6 @@ tcp_output(struct tcp_pcb *pcb)
LWIP_ASSERT("don't call tcp_output for listen-pcbs",
pcb->state != LISTEN);
- /* First, check if we are invoked by the TCP input processing
- code. If so, we do not output anything. Instead, we rely on the
- input processing code to call us when input processing is done
- with. */
- if (tcp_input_pcb == pcb) {
- return ERR_OK;
- }
-
wnd = LWIP_MIN(pcb->snd_wnd, pcb->cwnd);
seg = pcb->unsent;
diff --git a/lib/lwip/lwip/src/include/lwip/altcp_tls.h b/lib/lwip/lwip/src/include/lwip/altcp_tls.h
index fcb784d89d7..fb061823448 100644
--- a/lib/lwip/lwip/src/include/lwip/altcp_tls.h
+++ b/lib/lwip/lwip/src/include/lwip/altcp_tls.h
@@ -92,7 +92,7 @@ struct altcp_tls_config *altcp_tls_create_config_server_privkey_cert(const u8_t
/** @ingroup altcp_tls
* Create an ALTCP_TLS client configuration handle
*/
-struct altcp_tls_config *altcp_tls_create_config_client(const u8_t *cert, size_t cert_len);
+struct altcp_tls_config *altcp_tls_create_config_client(const u8_t *cert, size_t cert_len, char *host);
/** @ingroup altcp_tls
* Create an ALTCP_TLS client configuration handle with two-way server/client authentication
diff --git a/lib/lwip/u-boot/arch/cc.h b/lib/lwip/u-boot/arch/cc.h
index 563d3bfa98b..de138846358 100644
--- a/lib/lwip/u-boot/arch/cc.h
+++ b/lib/lwip/u-boot/arch/cc.h
@@ -29,8 +29,9 @@
#define LWIP_DONT_PROVIDE_BYTEORDER_FUNCTIONS
-#define LWIP_PLATFORM_ASSERT(x) do {printf("Assertion \"%s\" failed at line %d in %s\n", \
- x, __LINE__, __FILE__); } while (0)
+#define LWIP_PLATFORM_ASSERT(x) do { \
+ printf("Assertion \"%s\" failed at line %d in %s\n", \
+ x, __LINE__, __FILE__); } while (0)
#define atoi(str) (int)dectoul(str, NULL)
#define lwip_strnstr(a, b, c) strstr(a, b)
diff --git a/lib/lwip/u-boot/lwipopts.h b/lib/lwip/u-boot/lwipopts.h
index 9d618625fac..88d6faf327a 100644
--- a/lib/lwip/u-boot/lwipopts.h
+++ b/lib/lwip/u-boot/lwipopts.h
@@ -154,4 +154,10 @@
#define MEMP_MEM_INIT 1
#define MEM_LIBC_MALLOC 1
+#if defined(CONFIG_MBEDTLS_LIB_TLS)
+#define LWIP_ALTCP 1
+#define LWIP_ALTCP_TLS 1
+#define LWIP_ALTCP_TLS_MBEDTLS 1
+#endif
+
#endif /* LWIP_UBOOT_LWIPOPTS_H */
diff --git a/lib/mbedtls/Kconfig b/lib/mbedtls/Kconfig
index d71adc3648a..78167ffa252 100644
--- a/lib/mbedtls/Kconfig
+++ b/lib/mbedtls/Kconfig
@@ -430,4 +430,16 @@ endif # SPL
endif # MBEDTLS_LIB_X509
+config MBEDTLS_LIB_TLS
+ bool "MbedTLS TLS library"
+ depends on RSA_PUBLIC_KEY_PARSER_MBEDTLS
+ depends on X509_CERTIFICATE_PARSER_MBEDTLS
+ depends on ASYMMETRIC_PUBLIC_KEY_MBEDTLS
+ depends on ASN1_DECODER_MBEDTLS
+ depends on ASYMMETRIC_PUBLIC_KEY_MBEDTLS
+ depends on MBEDTLS_LIB_CRYPTO
+ help
+ Enable MbedTLS TLS library. Required for HTTPs support
+ in wget
+
endif # MBEDTLS_LIB
diff --git a/lib/mbedtls/Makefile b/lib/mbedtls/Makefile
index 83cb3c2fa70..ce0a61e4054 100644
--- a/lib/mbedtls/Makefile
+++ b/lib/mbedtls/Makefile
@@ -26,6 +26,7 @@ mbedtls_lib_crypto-y := \
$(MBEDTLS_LIB_DIR)/platform_util.o \
$(MBEDTLS_LIB_DIR)/constant_time.o \
$(MBEDTLS_LIB_DIR)/md.o
+
mbedtls_lib_crypto-$(CONFIG_$(SPL_)MD5_MBEDTLS) += $(MBEDTLS_LIB_DIR)/md5.o
mbedtls_lib_crypto-$(CONFIG_$(SPL_)SHA1_MBEDTLS) += $(MBEDTLS_LIB_DIR)/sha1.o
mbedtls_lib_crypto-$(CONFIG_$(SPL_)SHA256_MBEDTLS) += \
@@ -54,3 +55,33 @@ mbedtls_lib_x509-$(CONFIG_$(SPL_)X509_CERTIFICATE_PARSER_MBEDTLS) += \
$(MBEDTLS_LIB_DIR)/x509_crt.o
mbedtls_lib_x509-$(CONFIG_$(SPL_)PKCS7_MESSAGE_PARSER_MBEDTLS) += \
$(MBEDTLS_LIB_DIR)/pkcs7.o
+
+#mbedTLS TLS support
+obj-$(CONFIG_MBEDTLS_LIB_TLS) += mbedtls_lib_tls.o
+mbedtls_lib_tls-y := \
+ $(MBEDTLS_LIB_DIR)/mps_reader.o \
+ $(MBEDTLS_LIB_DIR)/mps_trace.o \
+ $(MBEDTLS_LIB_DIR)/net_sockets.o \
+ $(MBEDTLS_LIB_DIR)/pk_ecc.o \
+ $(MBEDTLS_LIB_DIR)/ssl_cache.o \
+ $(MBEDTLS_LIB_DIR)/ssl_ciphersuites.o \
+ $(MBEDTLS_LIB_DIR)/ssl_client.o \
+ $(MBEDTLS_LIB_DIR)/ssl_cookie.o \
+ $(MBEDTLS_LIB_DIR)/ssl_debug_helpers_generated.o \
+ $(MBEDTLS_LIB_DIR)/ssl_msg.o \
+ $(MBEDTLS_LIB_DIR)/ssl_ticket.o \
+ $(MBEDTLS_LIB_DIR)/ssl_tls.o \
+ $(MBEDTLS_LIB_DIR)/ssl_tls12_client.o \
+ $(MBEDTLS_LIB_DIR)/hmac_drbg.o \
+ $(MBEDTLS_LIB_DIR)/ctr_drbg.o \
+ $(MBEDTLS_LIB_DIR)/entropy.o \
+ $(MBEDTLS_LIB_DIR)/entropy_poll.o \
+ $(MBEDTLS_LIB_DIR)/aes.o \
+ $(MBEDTLS_LIB_DIR)/cipher.o \
+ $(MBEDTLS_LIB_DIR)/cipher_wrap.o \
+ $(MBEDTLS_LIB_DIR)/ecdh.o \
+ $(MBEDTLS_LIB_DIR)/ecdsa.o \
+ $(MBEDTLS_LIB_DIR)/ecp.o \
+ $(MBEDTLS_LIB_DIR)/ecp_curves.o \
+ $(MBEDTLS_LIB_DIR)/ecp_curves_new.o \
+ $(MBEDTLS_LIB_DIR)/gcm.o \
diff --git a/lib/mbedtls/mbedtls_def_config.h b/lib/mbedtls/mbedtls_def_config.h
index 1af911c2003..d27f017d084 100644
--- a/lib/mbedtls/mbedtls_def_config.h
+++ b/lib/mbedtls/mbedtls_def_config.h
@@ -87,4 +87,56 @@
#endif /* #if defined CONFIG_MBEDTLS_LIB_X509 */
+#if IS_ENABLED(CONFIG_MBEDTLS_LIB_TLS)
+#include "rtc.h"
+
+/* Generic options */
+#define MBEDTLS_ENTROPY_HARDWARE_ALT
+#define MBEDTLS_HAVE_TIME
+#define MBEDTLS_PLATFORM_MS_TIME_ALT
+#define MBEDTLS_PLATFORM_TIME_MACRO rtc_mktime
+#define MBEDTLS_PLATFORM_C
+#define MBEDTLS_SSL_CLI_C
+#define MBEDTLS_SSL_TLS_C
+#define MBEDTLS_CIPHER_C
+#define MBEDTLS_MD_C
+#define MBEDTLS_CTR_DRBG_C
+#define MBEDTLS_AES_C
+#define MBEDTLS_ENTROPY_C
+#define MBEDTLS_NO_PLATFORM_ENTROPY
+#define MBEDTLS_SSL_PROTO_TLS1_2
+#define MBEDTLS_SSL_SERVER_NAME_INDICATION
+#define MBEDTLS_KEY_EXCHANGE_PSK_ENABLED
+
+/* RSA */
+#define MBEDTLS_KEY_EXCHANGE_RSA_ENABLED
+#define MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
+#define MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED
+#define MBEDTLS_GCM_C
+
+/* ECDSA */
+#define MBEDTLS_ECDSA_C
+#define MBEDTLS_ECDH_C
+#define MBEDTLS_ECDSA_DETERMINISTIC
+#define MBEDTLS_HMAC_DRBG_C
+#define MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
+#define MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED
+#define MBEDTLS_CAN_ECDH
+#define MBEDTLS_PK_CAN_ECDSA_SIGN
+#define MBEDTLS_ECP_C
+#define MBEDTLS_ECP_DP_SECP256K1_ENABLED
+#define MBEDTLS_ECP_DP_SECP192R1_ENABLED
+#define MBEDTLS_ECP_DP_SECP224R1_ENABLED
+#define MBEDTLS_ECP_DP_SECP256R1_ENABLED
+#define MBEDTLS_ECP_DP_SECP384R1_ENABLED
+#define MBEDTLS_ECP_DP_SECP521R1_ENABLED
+#define MBEDTLS_ECP_DP_SECP192K1_ENABLED
+#define MBEDTLS_ECP_DP_SECP224K1_ENABLED
+#define MBEDTLS_ECP_DP_SECP256K1_ENABLED
+#define MBEDTLS_ECP_DP_BP256R1_ENABLED
+#define MBEDTLS_ECP_DP_BP384R1_ENABLED
+#define MBEDTLS_ECP_DP_BP512R1_ENABLED
+
+#endif /* #if defined CONFIG_MBEDTLS_LIB_TLS */
+
#endif /* #if defined CONFIG_MBEDTLS_LIB */
diff --git a/lib/rsa/rsa-sign.c b/lib/rsa/rsa-sign.c
index 2304030e32f..fa9e143b4ca 100644
--- a/lib/rsa/rsa-sign.c
+++ b/lib/rsa/rsa-sign.c
@@ -428,6 +428,15 @@ static int rsa_sign_with_key(EVP_PKEY *pkey, struct padding_algo *padding_algo,
ret = rsa_err("Signer padding setup failed");
goto err_sign;
}
+
+ /* Per RFC 3447 (and convention) the Typical salt length is the
+ * length of the output of the digest algorithm.
+ */
+ if (EVP_PKEY_CTX_set_rsa_pss_saltlen(ckey,
+ checksum_algo->checksum_len) <= 0) {
+ ret = rsa_err("Signer salt length setup failed");
+ goto err_sign;
+ }
}
for (i = 0; i < region_count; i++) {
diff --git a/lib/strto.c b/lib/strto.c
index f83ac67c666..206d1e91847 100644
--- a/lib/strto.c
+++ b/lib/strto.c
@@ -78,6 +78,11 @@ ulong hextoul(const char *cp, char **endp)
return simple_strtoul(cp, endp, 16);
}
+unsigned long long hextoull(const char *cp, char **endp)
+{
+ return simple_strtoull(cp, endp, 16);
+}
+
ulong dectoul(const char *cp, char **endp)
{
return simple_strtoul(cp, endp, 10);
diff --git a/lib/tpm-v2.c b/lib/tpm-v2.c
index 59e6cbafafa..ad2b5ab0c32 100644
--- a/lib/tpm-v2.c
+++ b/lib/tpm-v2.c
@@ -821,7 +821,7 @@ u32 tpm2_report_state(struct udevice *dev, uint vendor_cmd, uint vendor_subcmd,
if (*recv_size < 12)
return -ENODATA;
*recv_size -= 12;
- memcpy(recvbuf, recvbuf + 12, *recv_size);
+ memmove(recvbuf, recvbuf + 12, *recv_size);
return 0;
}
diff --git a/lib/uuid.c b/lib/uuid.c
index c6a27b7d044..538a1ba6aa8 100644
--- a/lib/uuid.c
+++ b/lib/uuid.c
@@ -35,6 +35,7 @@
#ifdef USE_HOSTCC
/* polyfill hextoul to avoid pulling in strto.c */
#define hextoul(cp, endp) strtoul(cp, endp, 16)
+#define hextoull(cp, endp) strtoull(cp, endp, 16)
#endif
int uuid_str_valid(const char *uuid)
@@ -312,7 +313,7 @@ int uuid_str_to_bin(const char *uuid_str, unsigned char *uuid_bin,
tmp16 = cpu_to_be16(hextoul(uuid_str + 19, NULL));
memcpy(uuid_bin + 8, &tmp16, 2);
- tmp64 = cpu_to_be64(hextoul(uuid_str + 24, NULL));
+ tmp64 = cpu_to_be64(hextoull(uuid_str + 24, NULL));
memcpy(uuid_bin + 10, (char *)&tmp64 + 2, 6);
return 0;
@@ -339,7 +340,7 @@ int uuid_str_to_le_bin(const char *uuid_str, unsigned char *uuid_bin)
tmp16 = cpu_to_le16(hextoul(uuid_str + 19, NULL));
memcpy(uuid_bin + 8, &tmp16, 2);
- tmp64 = cpu_to_le64(hextoul(uuid_str + 24, NULL));
+ tmp64 = cpu_to_le64(hextoull(uuid_str + 24, NULL));
memcpy(uuid_bin + 10, &tmp64, 6);
return 0;
diff --git a/lib/vsprintf.c b/lib/vsprintf.c
index e5802866632..c7340a047b2 100644
--- a/lib/vsprintf.c
+++ b/lib/vsprintf.c
@@ -308,7 +308,7 @@ static __maybe_unused char *string16(char *buf, char *end, u16 *s,
return buf;
}
-#if CONFIG_IS_ENABLED(EFI_DEVICE_PATH_TO_TEXT)
+#if CONFIG_IS_ENABLED(EFI_DEVICE_PATH_TO_TEXT) && !defined(API_BUILD)
static char *device_path_string(char *buf, char *end, void *dp, int field_width,
int precision, int flags)
{
generated by cgit v1.2.3 (git 2.0.4) at 2025-09-19 19:09:05 +0000