[PATCH master v2 1/2] ARM: MXS: fix breakage for non-DT boards

[PATCH master v2 1/2] ARM: MXS: fix breakage for non-DT boards

[Ahmad Fatoum]

boarddata, the third argument passed from barebox PBL to barebox proper,
is usually either a pointer to an optionally compressed flattened device tree
or a machien type integer casted to a pointer.

In order to support device trees located in the first 8192 bytes of
address space, barebox has been trying to dereference boarddata, before
falling back to treating it as integer.

This resulted in breakage as boarddata may be an integer not divisible
by 4 and thus an unaligned exception would occur.

The already existing barebox_arm_boarddata mechanism sidesteps this
issue: With it, the machine type integer is not passed as is, but the
address of a suitably aligned structure that contains it is passed
instead.

Searching for MACH_TYPE in arch/arm/boards shows 5 boards to be
affected in-tree, which are all fixed with this commit.

Fixes: 390bc7834ffc ("ARM: start: check for machine type last")
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
v1 -> v2:
  - Do full relocation instead of get_runtime_offset(). This is
    required, because GCC[1] generated a pc-relative reference
    to boarddata as it's in the same translation unit and as
    such get_runtime_offset() being added was wrong.
    Instead of relying on compiler whims, we instead set up
    a full C environment and play it safe.
  -  s/MACHINE_TYPE/MACH_TYPE/ (Bastian)

[1]: OSELAS.Toolchain-2021.07.0/arm-v7a-linux-gnueabihf/gcc-11.1.1
---
 arch/arm/boards/chumby_falconwing/lowlevel.c     | 11 ++++++++++-
 arch/arm/boards/crystalfontz-cfa10036/lowlevel.c | 11 ++++++++++-
 arch/arm/boards/freescale-mx23-evk/lowlevel.c    | 11 ++++++++++-
 arch/arm/boards/imx233-olinuxino/lowlevel.c      | 10 +++++++++-
 arch/arm/boards/karo-tx28/lowlevel.c             | 10 +++++++++-
 5 files changed, 48 insertions(+), 5 deletions(-)

diff --git a/arch/arm/boards/chumby_falconwing/lowlevel.c b/arch/arm/boards/chumby_falconwing/lowlevel.c
index 091dd1955260..d2059c8f7808 100644
--- a/arch/arm/boards/chumby_falconwing/lowlevel.c
+++ b/arch/arm/boards/chumby_falconwing/lowlevel.c
@@ -7,8 +7,17 @@
 #include <mach/imx23-regs.h>
 #include <generated/mach-types.h>
 
+static struct barebox_arm_boarddata boarddata = {
+	.magic = BAREBOX_ARM_BOARDDATA_MAGIC,
+	.machine = MACH_TYPE_CHUMBY,
+};
+
 ENTRY_FUNCTION(start_chumby_falconwing, r0, r1, r2)
 {
 	arm_cpu_lowlevel_init();
-	barebox_arm_entry(IMX_MEMORY_BASE, SZ_64M, (void *)MACH_TYPE_CHUMBY);
+
+	relocate_to_current_adr();
+	setup_c();
+
+	barebox_arm_entry(IMX_MEMORY_BASE, SZ_64M, &boarddata);
 }
diff --git a/arch/arm/boards/crystalfontz-cfa10036/lowlevel.c b/arch/arm/boards/crystalfontz-cfa10036/lowlevel.c
index 92b42aa89350..e3b452839c08 100644
--- a/arch/arm/boards/crystalfontz-cfa10036/lowlevel.c
+++ b/arch/arm/boards/crystalfontz-cfa10036/lowlevel.c
@@ -7,8 +7,17 @@
 #include <mach/imx28-regs.h>
 #include <generated/mach-types.h>
 
+static struct barebox_arm_boarddata boarddata = {
+	.magic = BAREBOX_ARM_BOARDDATA_MAGIC,
+	.machine = MACH_TYPE_CFA10036,
+};
+
 ENTRY_FUNCTION(start_cfa10036, r0, r1, r2)
 {
 	arm_cpu_lowlevel_init();
-	barebox_arm_entry(IMX_MEMORY_BASE, SZ_128M, (void *)MACH_TYPE_CFA10036);
+
+	relocate_to_current_adr();
+	setup_c();
+
+	barebox_arm_entry(IMX_MEMORY_BASE, SZ_128M, &boarddata);
 }
diff --git a/arch/arm/boards/freescale-mx23-evk/lowlevel.c b/arch/arm/boards/freescale-mx23-evk/lowlevel.c
index 62560bbff733..2b5a53222299 100644
--- a/arch/arm/boards/freescale-mx23-evk/lowlevel.c
+++ b/arch/arm/boards/freescale-mx23-evk/lowlevel.c
@@ -7,8 +7,17 @@
 #include <asm/barebox-arm.h>
 #include <mach/imx23-regs.h>
 
+static struct barebox_arm_boarddata boarddata = {
+	.magic = BAREBOX_ARM_BOARDDATA_MAGIC,
+	.machine = MACH_TYPE_MX23EVK,
+};
+
 ENTRY_FUNCTION(start_imx23_evk, r0, r1, r2)
 {
 	arm_cpu_lowlevel_init();
-	barebox_arm_entry(IMX_MEMORY_BASE, SZ_32M, (void *)MACH_TYPE_MX23EVK);
+
+	relocate_to_current_adr();
+	setup_c();
+
+	barebox_arm_entry(IMX_MEMORY_BASE, SZ_32M, &boarddata);
 }
diff --git a/arch/arm/boards/imx233-olinuxino/lowlevel.c b/arch/arm/boards/imx233-olinuxino/lowlevel.c
index 71fc379f0487..c8c36a947e41 100644
--- a/arch/arm/boards/imx233-olinuxino/lowlevel.c
+++ b/arch/arm/boards/imx233-olinuxino/lowlevel.c
@@ -11,9 +11,17 @@
 #include <mach/iomux.h>
 #include <generated/mach-types.h>
 
+static struct barebox_arm_boarddata boarddata = {
+	.magic = BAREBOX_ARM_BOARDDATA_MAGIC,
+	.machine = MACH_TYPE_IMX233_OLINUXINO,
+};
+
 ENTRY_FUNCTION(start_barebox_olinuxino_imx23, r0, r1, r2)
 {
-	barebox_arm_entry(IMX_MEMORY_BASE, SZ_64M, (void *)MACH_TYPE_IMX233_OLINUXINO);
+	relocate_to_current_adr();
+	setup_c();
+
+	barebox_arm_entry(IMX_MEMORY_BASE, SZ_64M, &boarddata);
 }
 
 static const uint32_t pad_setup[] = {
diff --git a/arch/arm/boards/karo-tx28/lowlevel.c b/arch/arm/boards/karo-tx28/lowlevel.c
index 28d96f3e1a5f..912043d73d1d 100644
--- a/arch/arm/boards/karo-tx28/lowlevel.c
+++ b/arch/arm/boards/karo-tx28/lowlevel.c
@@ -15,9 +15,17 @@
 #include <stmp-device.h>
 #include <generated/mach-types.h>
 
+static struct barebox_arm_boarddata boarddata = {
+	.magic = BAREBOX_ARM_BOARDDATA_MAGIC,
+	.machine = MACH_TYPE_TX28,
+};
+
 ENTRY_FUNCTION(start_barebox_karo_tx28, r0, r1, r2)
 {
-	barebox_arm_entry(IMX_MEMORY_BASE, SZ_128M, (void *)MACH_TYPE_TX28);
+	relocate_to_current_adr();
+	setup_c();
+
+	barebox_arm_entry(IMX_MEMORY_BASE, SZ_128M, &boarddata);
 }
 
 static const uint32_t iomux_pads[] = {
-- 
2.30.2

[PATCH v2 2/2] ARM: start: drop support for machine type casted to boarddata pointer

[Ahmad Fatoum]

Commit 84d28cec7f49 ("ARM: add a machine number mechanism for boarddata")
added in 2015 added a struct barebox_arm_boarddata mechanism for PBL to
pass machine type to barebox proper without going the legacy router of
casting the machine type integer to a pointer directly.

The legacy way with casting was mostly broken two years ago with commit
390bc7834ffc ("ARM: start: check for machine type last").

Only user that complained about it was using an in-tree board that has
in the meantime been fixed to use struct barebox_arm_boarddata instead.

Take this as indication that the code is dead and can be safely removed.

This may introduce regressions for boards that happened to work, despite
their machine type integer being dereferenced as a pointer. If you
happen to have such a board, please pass a pointer to a
struct barebox_arm_boarddata instead.

Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
v1 -> v2:
  - no change
---
 arch/arm/cpu/start.c | 12 ------------
 1 file changed, 12 deletions(-)

diff --git a/arch/arm/cpu/start.c b/arch/arm/cpu/start.c
index 672f26e0063c..f9b617aa855a 100644
--- a/arch/arm/cpu/start.c
+++ b/arch/arm/cpu/start.c
@@ -189,18 +189,6 @@ __noreturn __no_sanitize_address void barebox_non_pbl_start(unsigned long membas
 		} else if (blob_is_arm_boarddata(boarddata)) {
 			totalsize = sizeof(struct barebox_arm_boarddata);
 			name = "machine type";
-		} else if ((unsigned long)boarddata < 8192) {
-			struct barebox_arm_boarddata *bd;
-			uint32_t machine_type = (unsigned long)boarddata;
-			unsigned long mem = arm_mem_boarddata(membase, endmem,
-							      sizeof(*bd));
-			pr_debug("found machine type %d in boarddata\n",
-				 machine_type);
-			bd = barebox_boarddata = (void *)mem;
-			barebox_boarddata_size = sizeof(*bd);
-			bd->magic = BAREBOX_ARM_BOARDDATA_MAGIC;
-			bd->machine = machine_type;
-			malloc_end = mem;
 		}
 
 		if (totalsize) {
-- 
2.30.2

Re: [PATCH master v2 1/2] ARM: MXS: fix breakage for non-DT boards

[Sascha Hauer]

On Tue, Oct 11, 2022 at 12:33:17PM +0200, Ahmad Fatoum wrote:
> boarddata, the third argument passed from barebox PBL to barebox proper,
> is usually either a pointer to an optionally compressed flattened device tree
> or a machien type integer casted to a pointer.
> 
> In order to support device trees located in the first 8192 bytes of
> address space, barebox has been trying to dereference boarddata, before
> falling back to treating it as integer.
> 
> This resulted in breakage as boarddata may be an integer not divisible
> by 4 and thus an unaligned exception would occur.
> 
> The already existing barebox_arm_boarddata mechanism sidesteps this
> issue: With it, the machine type integer is not passed as is, but the
> address of a suitably aligned structure that contains it is passed
> instead.
> 
> Searching for MACH_TYPE in arch/arm/boards shows 5 boards to be
> affected in-tree, which are all fixed with this commit.
> 
> Fixes: 390bc7834ffc ("ARM: start: check for machine type last")
> Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
> ---
> v1 -> v2:
>   - Do full relocation instead of get_runtime_offset(). This is
>     required, because GCC[1] generated a pc-relative reference
>     to boarddata as it's in the same translation unit and as
>     such get_runtime_offset() being added was wrong.
>     Instead of relying on compiler whims, we instead set up
>     a full C environment and play it safe.
>   -  s/MACHINE_TYPE/MACH_TYPE/ (Bastian)
> 
> [1]: OSELAS.Toolchain-2021.07.0/arm-v7a-linux-gnueabihf/gcc-11.1.1
> ---
>  arch/arm/boards/chumby_falconwing/lowlevel.c     | 11 ++++++++++-
>  arch/arm/boards/crystalfontz-cfa10036/lowlevel.c | 11 ++++++++++-
>  arch/arm/boards/freescale-mx23-evk/lowlevel.c    | 11 ++++++++++-
>  arch/arm/boards/imx233-olinuxino/lowlevel.c      | 10 +++++++++-
>  arch/arm/boards/karo-tx28/lowlevel.c             | 10 +++++++++-
>  5 files changed, 48 insertions(+), 5 deletions(-)
> 
> diff --git a/arch/arm/boards/chumby_falconwing/lowlevel.c b/arch/arm/boards/chumby_falconwing/lowlevel.c
> index 091dd1955260..d2059c8f7808 100644
> --- a/arch/arm/boards/chumby_falconwing/lowlevel.c
> +++ b/arch/arm/boards/chumby_falconwing/lowlevel.c
> @@ -7,8 +7,17 @@
>  #include <mach/imx23-regs.h>
>  #include <generated/mach-types.h>
>  
> +static struct barebox_arm_boarddata boarddata = {
> +	.magic = BAREBOX_ARM_BOARDDATA_MAGIC,
> +	.machine = MACH_TYPE_CHUMBY,
> +};
> +
>  ENTRY_FUNCTION(start_chumby_falconwing, r0, r1, r2)
>  {
>  	arm_cpu_lowlevel_init();
> -	barebox_arm_entry(IMX_MEMORY_BASE, SZ_64M, (void *)MACH_TYPE_CHUMBY);
> +
> +	relocate_to_current_adr();
> +	setup_c();
> +
> +	barebox_arm_entry(IMX_MEMORY_BASE, SZ_64M, &boarddata);

Please jump to an explicitly non inlined function after setup_c() to
make sure we access &boarddata in a proper C environment. Otherwise we
do not know if the pointer is dereferenced before or after setup_c().

Sascha

-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |