[PATCH 1/8] drivers: rollback: Add rollback devices to driver model

From: Stephen Carlson Rollback devices currently implement operations to store an OS anti-rollback monotonic counter. Existing devices such as the Trusted Platform Module (TPM) already support this operation, but this uclass provides abstraction for current and future devices that may support

[PATCH 4/8] common: Add OS anti-rollback grace version

From: Stephen Carlson New config CONFIG_FIT_ROLLBACK_CHECK_GRACE to add a one unit grace version to OS anti-rollback protection, allowing images with anti-rollback counters exactly one less than the platform value to still be loaded. No update to the platform anti-rollback counter will be

[PATCH 6/8] tpm: Fix issues relating to NV Indexes

From: Sean Edmond The TPM 2.0 command reference states that "auth" (type TPM2B_AUTH) should come before "publicInfo" (type TPM2B_NV_PUBLIC) in the "TPM2_NV_DefineSpace" command. Let's add an empty "auth" (size 0), so that this can work with compliant TPMs. Make sure that NV index used in

[PATCH 0/5] Add anti-rollback validation feature

From: Sean Edmond Adds Add anti-rollback version protection. Images with an anti-rollback counter value "rollback" declared in the kernel FDT will be compared against the current device anti-rollback counter value, and older images will not pass signature validation. If the image is newer,

[PATCH 3/8] common: Add OS anti-rollback validation using rollback devices

From: Stephen Carlson New config CONFIG_ROLLBACK_CHECK to enable enforcement of OS anti-rollback counter during image loading. Images with an anti-rollback counter value "rollback" declared in the FDT will be compared against the current device anti-rollback counter value, and older images will

[PATCH 2/8] drivers: rollback: Add TPM2 implementation of rollback devices

From: Stephen Carlson This implementation of the rollback uclass driver allows existing TPM2 devices declared in the device tree to be referenced for storing the OS anti-rollback counter, using the TPM2 non-volatile storage API. The rollback device must be a child of the TPM device. For

[PATCH 8/8] doc: rollback: anti-rollback verification

From: Sean Edmond Add documentation for anti-rollback verification, optional properties in FIT image, and UCLASS_ROLLBACK device. Signed-off-by: Sean Edmond --- doc/develop/driver-model/index.rst | 1 + doc/develop/driver-model/rollback-info.rst | 42 +

[PATCH 7/8] sandbox: tpm: Fix TPM2_CC_NV_DEFINE_SPACE command

From: Sean Edmond The TPM 2.0 command reference shows "auth" (type TPM2B_AUTH) before "publicInfo" (type TPM2B_NV_PUBLIC). The TPM v2 driver was updated to add this field. The sandbox driver needs to be updated to match the driver implementation. Signed-off-by: Sean Edmond ---

[PATCH 5/8] dm: test: Add a test for rollback driver

From: Sean Edmond Adds a test for a sandbox and TPM backed rollback driver. Allows for testing of anti-rollback version number get/set API using the rollback driver. Signed-off-by: Sean Edmond --- arch/sandbox/dts/test.dts | 9 + configs/sandbox_defconfig | 3 ++ test/dm/Makefile

[PATCH v3 1/5] fdt: common API to populate kaslr seed

From: Dhananjay Phadke fdt_fixup_kaslr_seed() will update given ofnode with random seed value. Source for random seed can be TPM or RNG driver in u-boot or sec firmware (ARM). Signed-off-by: Dhananjay Phadke Signed-off-by: Sean Edmond --- arch/arm/cpu/armv8/sec_firmware.c | 39

[PATCH v3 5/5] fdt: Fix compile error for !OFNODE_MULTI_TREE

From: Sean Edmond Required to fix the following compile error when building sandbox: /tmp/cci9ibby.ltrans21.ltrans.o: In function `do_cedit_load': :(.text+0x601d): undefined reference to `oftree_dispose' Signed-off-by: Sean Edmond --- drivers/core/ofnode.c | 12 ++-- 1 file changed, 6

[PATCH v3 2/5] fdt: kaslr seed from RNG device

From: Dhananjay Phadke Add support for KASLR seed from the RNG device. Invokes dm_rng_read() API to read 8-bytes of random bytes. Performs the FDT fixup using event spy. To enable use CONFIG_KASLR_RNG_SEED Signed-off-by: Dhananjay Phadke Signed-off-by: Drew Kluemke Signed-off-by: Sean

[PATCH v3 0/5] Populate kaslr seed with RNG

From: Sean Edmond This patch series creates a common API (fdt_fixup_kaslr_seed()) for populating the kaslr seed in the DTB. Existing users (kaslrseed, and ARMv8 sec firmware) have been updated to use this common API. New functionality has been introduced to populate the kaslr using the RNG.

[PATCH v3 4/5] dm: core: Modify default for OFNODE_MULTI_TREE

From: Sean Edmond There is a preference to use the "ofnode" API for FDT fixups moving forward. The FDT fixup will usually be for the kernel FDT. To fixup the kernel FDT with the ofnode API, it's required to set the OFNODE_MULTI_TREE option. To ensure existing users of kaslr fdt fixup are not

[PATCH v3 3/5] cmd: kaslrseed: Use common API to fixup FDT

From: Sean Edmond Use the newly introduced common API fdt_fixup_kaslr_seed() in the kaslrseed command. Signed-off-by: Sean Edmond --- cmd/kaslrseed.c | 22 -- 1 file changed, 8 insertions(+), 14 deletions(-) diff --git a/cmd/kaslrseed.c b/cmd/kaslrseed.c index

[PATCH 3/4] cmd: kaslrseed: Use common API to fixup FDT

From: Sean Edmond Use the newly introduced common API fdt_fixup_kaslr_seed() in the kaslrseed command. Signed-off-by: Sean Edmond --- cmd/kaslrseed.c | 22 -- 1 file changed, 8 insertions(+), 14 deletions(-) diff --git a/cmd/kaslrseed.c b/cmd/kaslrseed.c index

[PATCH 1/4] fdt: common API to populate kaslr seed

From: Dhananjay Phadke fdt_fixup_kaslr_seed() will update given FDT with random seed value. Source for random seed can be TPM or RNG driver in u-boot or sec firmware (ARM). Signed-off-by: Dhananjay Phadke Signed-off-by: Sean Edmond --- arch/arm/cpu/armv8/sec_firmware.c | 39

[PATCH v2 3/4] cmd: kaslrseed: Use common API to fixup FDT

From: Sean Edmond Use the newly introduced common API fdt_fixup_kaslr_seed() in the kaslrseed command. Signed-off-by: Sean Edmond --- cmd/kaslrseed.c | 22 -- 1 file changed, 8 insertions(+), 14 deletions(-) diff --git a/cmd/kaslrseed.c b/cmd/kaslrseed.c index

[PATCH v2 2/4] fdt: kaslr seed from tpm entropy

From: Dhananjay Phadke Add support for KASLR seed from TPM device. Invokes tpm_get_random() API to read 8-bytes of random bytes for KASLR. Signed-off-by: Dhananjay Phadke Signed-off-by: Drew Kluemke Signed-off-by: Sean Edmond --- boot/image-fdt.c | 15 +++

[PATCH v2 0/4] Populate kaslr seed with TPM

From: Sean Edmond This patch series creates a common API (fdt_fixup_kaslr_seed()) for populating the kaslr seed in the DTB. Existing users (kaslrseed, and ARMv8 sec firmware) have been updated to use this common API. New functionality has been introduced to populate the kaslr using the TPM

[PATCH 2/4] fdt: kaslr seed from tpm entropy

From: Dhananjay Phadke Add support for KASLR seed from TPM device. Invokes tpm_get_random() API to read 8-bytes of random bytes for KASLR. Signed-off-by: Dhananjay Phadke Signed-off-by: Drew Kluemke Signed-off-by: Sean Edmond --- boot/image-fdt.c | 15 +++

[PATCH 4/4] dm: core: Modify default for OFNODE_MULTI_TREE

From: Sean Edmond There is a preference to use the "ofnode" API for FDT fixups moving forward. The FDT fixup will usually be for the kernel FDT. To fixup the kernel FDT with the ofnode API, it's required to set the OFNODE_MULTI_TREE option. To ensure exisiting users on kasls fixup are not

[PATCH v2 4/4] dm: core: Modify default for OFNODE_MULTI_TREE

From: Sean Edmond There is a preference to use the "ofnode" API for FDT fixups moving forward. The FDT fixup will usually be for the kernel FDT. To fixup the kernel FDT with the ofnode API, it's required to set the OFNODE_MULTI_TREE option. To ensure existing users of kaslr fdt fixup are not

[PATCH v2 0/4] Populate kaslr seed with TPM

From: Sean Edmond This patch series creates a common API (fdt_fixup_kaslr_seed()) for populating the kaslr seed in the DTB. Existing users (kaslrseed, and ARMv8 sec firmware) have been updated to use this common API. New functionality has been introduced to populate the kaslr using the TPM

[PATCH v2 1/4] fdt: common API to populate kaslr seed

From: Dhananjay Phadke fdt_fixup_kaslr_seed() will update given ofnode with random seed value. Source for random seed can be TPM or RNG driver in u-boot or sec firmware (ARM). Signed-off-by: Dhananjay Phadke Signed-off-by: Sean Edmond --- arch/arm/cpu/armv8/sec_firmware.c | 39

[PATCH v2 3/4] cmd: kaslrseed: Use common API to fixup FDT

From: Sean Edmond Use the newly introduced common API fdt_fixup_kaslr_seed() in the kaslrseed command. Signed-off-by: Sean Edmond --- cmd/kaslrseed.c | 22 -- 1 file changed, 8 insertions(+), 14 deletions(-) diff --git a/cmd/kaslrseed.c b/cmd/kaslrseed.c index

[PATCH v2 1/4] fdt: common API to populate kaslr seed

From: Dhananjay Phadke fdt_fixup_kaslr_seed() will update given ofnode with random seed value. Source for random seed can be TPM or RNG driver in u-boot or sec firmware (ARM). Signed-off-by: Dhananjay Phadke Signed-off-by: Sean Edmond --- arch/arm/cpu/armv8/sec_firmware.c | 39

[PATCH v2 4/4] dm: core: Modify default for OFNODE_MULTI_TREE

From: Sean Edmond There is a preference to use the "ofnode" API for FDT fixups moving forward. The FDT fixup will usually be for the kernel FDT. To fixup the kernel FDT with the ofnode API, it's required to set the OFNODE_MULTI_TREE option. To ensure existing users of kaslr fdt fixup are not

[PATCH v2 2/4] fdt: kaslr seed from tpm entropy

From: Dhananjay Phadke Add support for KASLR seed from TPM device. Invokes tpm_get_random() API to read 8-bytes of random bytes for KASLR. Signed-off-by: Dhananjay Phadke Signed-off-by: Drew Kluemke Signed-off-by: Sean Edmond --- boot/image-fdt.c | 15 +++

[PATCH v3 2/3] net: bootp: BOOTP/DHCPv4 retransmission improvements

From: Sean Edmond This patch introduces 3 improvements to align with RFC 951: - retransmission backoff interval maximum is configurable - initial retranmission backoff interval is configurable - transaction ID is kept the same for each BOOTP/DHCPv4 request In applications where thousands of

[PATCH v3 1/3] net: Get pxe config file from dhcp option 209

From: Sean Edmond Allow dhcp server pass pxe config file full path by using option 209 as specified in RFC5071. Signed-off-by: Sean Edmond --- cmd/Kconfig | 4 cmd/pxe.c | 10 ++ net/bootp.c | 21 + net/bootp.h | 2 ++ 4 files changed, 37 insertions(+)

[PATCH v3 3/3] net: bootp: add config option BOOTP_RANDOM_XID

From: Sean Edmond The new config option BOOTP_RANDOM_XID will randomize the transaction ID for each new BOOT/DHCPv4 exchange. Signed-off-by: Sean Edmond --- cmd/Kconfig | 7 +++ net/bootp.c | 31 +-- 2 files changed, 24 insertions(+), 14 deletions(-) diff

[PATCH v3 0/3] BOOTP/DHCPv4 enhancements

From: Sean Edmond In our datacenter application, a single DHCP server is servicing 36000+ clients. Improvements are required to the DHCPv4 retransmission behavior to align with RFC and ensure less pressure is exerted on the server: - retransmission backoff interval maximum is configurable

[PATCH v4 1/5] fdt: common API to populate kaslr seed

From: Dhananjay Phadke fdt_fixup_kaslr_seed() will update given ofnode with random seed value. Source for random seed can be TPM or RNG driver in u-boot or sec firmware (ARM). Signed-off-by: Dhananjay Phadke Signed-off-by: Sean Edmond --- arch/arm/cpu/armv8/sec_firmware.c | 39

[PATCH v4 5/5] fdt: Fix compile error for !OFNODE_MULTI_TREE

From: Sean Edmond Required to fix the following compile error when building sandbox: /tmp/cci9ibby.ltrans21.ltrans.o: In function `do_cedit_load': :(.text+0x601d): undefined reference to `oftree_dispose' Signed-off-by: Sean Edmond --- drivers/core/ofnode.c | 12 ++-- 1 file changed, 6

[PATCH v4 3/5] cmd: kaslrseed: Use common API to fixup FDT

From: Sean Edmond Use the newly introduced common API fdt_fixup_kaslr_seed() in the kaslrseed command. Signed-off-by: Sean Edmond --- cmd/kaslrseed.c | 22 -- 1 file changed, 8 insertions(+), 14 deletions(-) diff --git a/cmd/kaslrseed.c b/cmd/kaslrseed.c index

[PATCH v4 0/5] Populate kaslr seed with RNG

From: Sean Edmond This patch series creates a common API (fdt_fixup_kaslr_seed()) for populating the kaslr seed in the DTB. Existing users (kaslrseed, and ARMv8 sec firmware) have been updated to use this common API. New functionality has been introduced to populate the kaslr using the RNG.

[PATCH v4 2/5] fdt: kaslr seed from RNG device

From: Dhananjay Phadke Add support for KASLR seed from the RNG device. Invokes dm_rng_read() API to read 8-bytes of random bytes. Performs the FDT fixup using event spy. To enable use CONFIG_KASLR_RNG_SEED Signed-off-by: Dhananjay Phadke Signed-off-by: Drew Kluemke Signed-off-by: Sean

[PATCH v4 4/5] dm: core: Modify default for OFNODE_MULTI_TREE

From: Sean Edmond There is a preference to use the "ofnode" API for FDT fixups moving forward. The FDT fixup will usually be for the kernel FDT. To fixup the kernel FDT with the ofnode API, it's required to set the OFNODE_MULTI_TREE option. To ensure existing users of kaslr fdt fixup are not

[PATCH 1/3] net: Get pxe config file from dhcp option 209

From: Sean Edmond Allow dhcp server pass pxe config file full path by using option 209 Signed-off-by: Sean Edmond --- cmd/Kconfig | 4 cmd/pxe.c | 10 ++ net/bootp.c | 21 + 3 files changed, 35 insertions(+) diff --git a/cmd/Kconfig b/cmd/Kconfig index

[PATCH 3/3] net: bootp: add config option BOOTP_RANDOM_XID

From: Sean Edmond The new config option BOOTP_RANDOM_XID will randomize the transaction ID for each new BOOT/DHCPv4 exchange. Signed-off-by: Sean Edmond --- cmd/Kconfig | 7 +++ net/bootp.c | 31 +-- 2 files changed, 24 insertions(+), 14 deletions(-) diff

[PATCH 2/3] net: bootp: BOOTP/DHCPv4 retransmission improvements

From: Sean Edmond This patch introduces 3 improvements to align with RFC 951: - retransmission backoff interval maximum is configurable - initial retranmission backoff interval is configurable - transaction ID is kept the same for each BOOTP/DHCPv4 request In applications where thousands of

[PATCH 0/3] BOOTP/DHCPv4 enhancements

From: Sean Edmond In our datacenter application, a single DHCP server is servicing 36000+ clients. Improvements are required to the DHCPv4 retransmission behavior to align with RFC and ensure less pressure is exerted on the server: - retransmission backoff interval maximum is configurable

[PATCH v2 1/3] net: Get pxe config file from dhcp option 209

From: Sean Edmond Allow dhcp server pass pxe config file full path by using option 209 Signed-off-by: Sean Edmond --- cmd/Kconfig | 4 cmd/pxe.c | 10 ++ net/bootp.c | 21 + 3 files changed, 35 insertions(+) diff --git a/cmd/Kconfig b/cmd/Kconfig index

[PATCH v2 2/3] net: bootp: BOOTP/DHCPv4 retransmission improvements

From: Sean Edmond This patch introduces 3 improvements to align with RFC 951: - retransmission backoff interval maximum is configurable - initial retranmission backoff interval is configurable - transaction ID is kept the same for each BOOTP/DHCPv4 request In applications where thousands of

[PATCH v2 0/3] BOOTP/DHCPv4 enhancements

From: Sean Edmond In our datacenter application, a single DHCP server is servicing 36000+ clients. Improvements are required to the DHCPv4 retransmission behavior to align with RFC and ensure less pressure is exerted on the server: - retransmission backoff interval maximum is configurable

[PATCH v2 3/3] net: bootp: add config option BOOTP_RANDOM_XID

From: Sean Edmond The new config option BOOTP_RANDOM_XID will randomize the transaction ID for each new BOOT/DHCPv4 exchange. Signed-off-by: Sean Edmond --- cmd/Kconfig | 7 +++ net/bootp.c | 31 +-- 2 files changed, 24 insertions(+), 14 deletions(-) diff

[PATCH] net: tftp: Fix for DATA ACK for block count out of order

From: Sean Edmond In rfc7440, if an ACK is not received by the server or if the last data block in a window is dropped, the server will timeout and retransmit the window. In this case, the block count received will be less than the internal block count. In this case, the client should not ACK.

[PATCH] net: tftp: Fix for DATA ACK for block count out of order

From: Sean Edmond In rfc7440, if an ACK is not received by the server or if the last data block in a window is dropped, the server will timeout and retransmit the window. In this case, the block count received will be less than the internal block count. In this case, the client should not ACK.

[PATCH] net: ipv6: Fix IPv6 netmask parsing

From: Sean Edmond It should be possible to specify a netmask when setting a static IPv6 address. For example: setenv ip6addr 2001:cafe:cafe:cafe::100/64 The net_prefix_length and net_ip6 should be updated properly. Signed-off-by: Sean Edmond --- net/net6.c | 9 ++--- 1 file changed, 6

[PATCH 1/2] net: dhcp6: Add DHCPv6 (DHCP for IPv6)

From: Sean Edmond Adds DHCPv6 protocol to u-boot. Allows for address assignement with DHCPv6 4-message exchange (SOLICIT->ADVERTISE->REQUEST->REPLY). Includes DHCPv6 options required by RFC 8415. Also adds DHCPv6 options required for PXE boot. New configs added: - CMD_DHCP6 -

[PATCH 2/2] net: dhcp6: pxe: Add DHCP/PXE commands for IPv6

From: Sean Edmond Adds commands to support DHCP and PXE with IPv6. New commands added (when IPv6 is enabled): - dhcp6 - pxe get -ipv6 - pxe boot -ipv6 Signed-off-by: Sean Edmond --- boot/bootmeth_distro.c | 2 +- boot/bootmeth_pxe.c| 4 +- boot/pxe_utils.c | 3 +- cmd/net.c

[PATCH 0/2] net: DHCPv6 protocol and commands

From: Sean Edmond The recently integrated IPv6 patch series relies on the link-local address, or a statically assigned IPv6 address for network operations. This patch series adds IPv6 address assignment through DHCPv6. The implementation meets the requirements in RFC 8415 for "Client/Server

[PATCH] net: ipv6: IPv6 environment variable cleanup

From: Sean Edmond Fix "setenv gatewayip6". Synchronize IPv6 local variables with environment variables in netboot_update_env() Signed-off-by: Sean Edmond --- cmd/net.c | 23 ++- include/env_flags.h | 2 +- 2 files changed, 23 insertions(+), 2 deletions(-) diff

[PATCH v3 2/3] net: dhcp6: pxe: Add DHCP/PXE commands for IPv6

From: Sean Edmond Adds commands to support DHCP and PXE with IPv6. New configs added: - CMD_DHCP6 - DHCP6_PXE_CLIENTARCH - DHCP6_PXE_DHCP_OPTION - DHCP6_ENTERPRISE_ID New commands added (when IPv6 is enabled): - dhcp6 - pxe get -ipv6 - pxe boot -ipv6 Signed-off-by: Sean Edmond ---

[PATCH v3 1/3] net: dhcp6: Add DHCPv6 (DHCP for IPv6)

From: Sean Edmond Adds DHCPv6 protocol to u-boot. Allows for address assignement with DHCPv6 4-message exchange (SOLICIT->ADVERTISE->REQUEST->REPLY). Includes DHCPv6 options required by RFC 8415. Also adds DHCPv6 options required for PXE boot. Possible enhancements: - Duplicate address

[PATCH v3 0/3] net: DHCPv6 protocol and commands

From: Sean Edmond The recently integrated IPv6 patch series relies on the link-local address, or a statically assigned IPv6 address for network operations. This patch series adds IPv6 address assignment through DHCPv6. The implementation meets the requirements in RFC 8415 for "Client/Server

[PATCH v3 3/3] net: dhcp6: Add a sandbox test for dhcp6

From: Sean Edmond Requires proper environment with DHCP6 server provisioned. Signed-off-by: Sean Edmond --- configs/sandbox_defconfig | 1 + test/py/tests/test_net.py | 25 + 2 files changed, 26 insertions(+) diff --git a/configs/sandbox_defconfig

[PATCH v2 1/3] net: dhcp6: Add DHCPv6 (DHCP for IPv6)

From: Sean Edmond Adds DHCPv6 protocol to u-boot. Allows for address assignement with DHCPv6 4-message exchange (SOLICIT->ADVERTISE->REQUEST->REPLY). Includes DHCPv6 options required by RFC 8415. Also adds DHCPv6 options required for PXE boot. Possible enhancements: - Duplicate address

[PATCH v2 2/3] net: dhcp6: pxe: Add DHCP/PXE commands for IPv6

From: Sean Edmond Adds commands to support DHCP and PXE with IPv6. New configs added: - CMD_DHCP6 - DHCP6_PXE_CLIENTARCH - DHCP6_PXE_DHCP_OPTION - DHCP6_ENTERPRISE_ID New commands added (when IPv6 is enabled): - dhcp6 - pxe get -ipv6 - pxe boot -ipv6 Signed-off-by: Sean Edmond ---

[PATCH v2 3/3] net: dhcp6: Add a sandbox test for dhcp6

From: Sean Edmond Requires proper environment with DHCP6 server provisioned. Signed-off-by: Sean Edmond --- configs/sandbox_defconfig | 1 + test/py/tests/test_net.py | 25 + 2 files changed, 26 insertions(+) diff --git a/configs/sandbox_defconfig

[PATCH v2 0/3] *** net: DHCPv6 protocol and commands ***

From: Sean Edmond The recently integrated IPv6 patch series relies on the link-local address, or a statically assigned IPv6 address for network operations. This patch series adds IPv6 address assignment through DHCPv6. The implementation meets the requirements in RFC 8415 for "Client/Server

[PATCH] net: dhcp6: Fix OPT_BOOTFILE_PARAM parsing

From: Sean Edmond RFC 5970 states that OPT_BOOTFILE_PARAM (option 60) can be multiple parameters that start with a 16-bit length field followed by the parameter. For example: [ param-len 1 (16-bits) ] [ parameter 1 (variable length) ] This fix ensure we're considering "param-len 1" in the

[PATCH] net: Get pxe config file from dhcp option 209

From: Sean Edmond Allow dhcp server pass pxe config file full path by using option 209 Signed-off-by: Sean Edmond --- cmd/Kconfig | 4 cmd/pxe.c | 8 net/bootp.c | 21 + 3 files changed, 33 insertions(+) diff --git a/cmd/Kconfig b/cmd/Kconfig index

[PATCH 1/5] drivers: security: Add security devices to driver model

From: Stephen Carlson Security devices currently implement operations to store an OS anti-rollback monotonic counter. Existing devices such as the Trusted Platform Module (TPM) already support this operation, but this uclass provides abstraction for current and future devices that may support

[PATCH 5/5] dm: test: Add a test for security driver

From: Sean Edmond Adds a test for a sandbox and TPM backed security driver. Allows for testing of anti-rollback version number get/set API using the security driver. Signed-off-by: Sean Edmond --- arch/sandbox/dts/test.dts | 8 configs/sandbox_defconfig | 3 ++ test/dm/Makefile

[PATCH 3/5] common: Add OS anti-rollback validation using security devices

From: Stephen Carlson New config CONFIG_ARBP to enable enforcement of OS anti-rollback counter during image loading. Images with an anti-rollback counter value "arbvn" declared in the FDT will be compared against the current device anti-rollback counter value, and older images will not pass

[PATCH 2/5] drivers: security: Add TPM2 implementation of security devices

From: Stephen Carlson This implementation of the security uclass driver allows existing TPM2 devices declared in the device tree to be referenced for storing the OS anti-rollback counter, using the TPM2 non-volatile storage API. Signed-off-by: Stephen Carlson --- MAINTAINERS

[PATCH 4/5] common: Add OS anti-rollback grace period

From: Stephen Carlson New config CONFIG_FIT_ARBVP_GRACE to add a one unit grace period to OS anti-rollback protection, allowing images with anti-rollback counters exactly one less than the platform value to still be loaded. No update to the platform anti-rollback counter will be performed in

[PATCH 0/5] Add anti-rollback validation feature

From: Sean Edmond Adds Add anti-rollback version protection. Images with an anti-rollback counter value "arbvn" declared in the FDT will be compared against the current device anti-rollback counter value, and older images will not pass signature validation. If the image is newer, the device

[PATCH] drivers: mtd: Add MT25QU128AB params

From: Godfrey Mwangi Add Micron MT25QU128AB flash. Signed-off-by: Godfrey Mwangi --- drivers/mtd/spi/spi-nor-ids.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/mtd/spi/spi-nor-ids.c b/drivers/mtd/spi/spi-nor-ids.c index 4587215984..a99bb6125b 100644 ---

[PATCH 1/3] fdt: common API to populate kaslr seed

From: Dhananjay Phadke fdt_fixup_kaslr_seed() will update given FDT with random seed value. Source for random seed can be TPM or RNG driver in u-boot or sec firmware (ARM). Signed-off-by: Dhananjay Phadke --- arch/arm/cpu/armv8/sec_firmware.c | 32 +++

[PATCH 3/3] cmd: kaslrseed: Use common API to fixup FDT

From: Sean Edmond Use the newly introduced common API fdt_fixup_kaslr_seed() in the kaslrseed command. Signed-off-by: Sean Edmond --- cmd/kaslrseed.c | 18 +++--- 1 file changed, 3 insertions(+), 15 deletions(-) diff --git a/cmd/kaslrseed.c b/cmd/kaslrseed.c index

[PATCH 0/3] Populate kaslr seed with TPM

From: Sean Edmond This patch series creates a common API (fdt_fixup_kaslr_seed()) for populating the kaslr seed in the DTB. Existing users (kaslrseed, and ARMv8 sec firmware) have been updated to use this common API. New functionality has been introduced to populate the kaslr using the TPM

[PATCH 2/3] fdt: kaslr seed from tpm entropy

From: Dhananjay Phadke Add support for KASLR seed from TPM device. Invokes tpm_get_random() API to read 8-bytes of random bytes for KASLR. Signed-off-by: Dhananjay Phadke Signed-off-by: Drew Kluemke Signed-off-by: Sean Edmond --- boot/image-fdt.c | 3 +++ common/fdt_support.c | 39

[PATCH] usb: xhci: pet watchdog during transfers

From: Godfrey Mwangi On some platforms with low USB throughput, tranfers of huge files take a long time and watchdog timer can expire resulting in hardware reset. Avoid this by petting the watchdog as long as we have pending transfers. Signed-off-by: Godfrey Mwangi ---

[PATCH 0/2] *** minor fixes in DHCP6 ***

From: Sean Edmond Resolves 2 issues: - coverity CID 453851 and 436278 - Change DHCP6 VCI string from "U-boot" to "U-Boot" (this was found by more detailed testing on our end) Sean Edmond (2): net: ipv6: Fix CID 453851 and CID 436278 net: dhcp6: Fix VCI string cmd/net.c| 12

[PATCH 1/2] net: ipv6: Fix CID 453851 and CID 436278

From: Sean Edmond CID 453851 : sprintf() shouldn't copy from/to tmp CID 436278 : DHCP6 option_len should be checked before use Signed-off-by: Sean Edmond --- cmd/net.c| 12 ++-- net/dhcpv6.c | 5 + 2 files changed, 11 insertions(+), 6 deletions(-) diff --git a/cmd/net.c

[PATCH 2/2] net: dhcp6: Fix VCI string

From: Sean Edmond Change VCI string from "U-boot" to "U-Boot". Signed-off-by: Sean Edmond --- net/dhcpv6.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/dhcpv6.h b/net/dhcpv6.h index 80ca520432..65c8e4c71d 100644 --- a/net/dhcpv6.h +++ b/net/dhcpv6.h @@ -38,7 +38,7

[PATCH v5 2/5] fdt: kaslr seed from RNG device

From: Dhananjay Phadke Add support for KASLR seed from the RNG device. Invokes dm_rng_read() API to read 8-bytes of random bytes. Performs the FDT fixup using event spy. To enable use CONFIG_KASLR_RNG_SEED Signed-off-by: Dhananjay Phadke Signed-off-by: Drew Kluemke Signed-off-by: Sean

[PATCH v5 1/5] fdt: common API to populate kaslr seed

From: Dhananjay Phadke fdt_fixup_kaslr_seed() will update given ofnode with random seed value. Source for random seed can be TPM or RNG driver in u-boot or sec firmware (ARM). Signed-off-by: Dhananjay Phadke Signed-off-by: Sean Edmond --- arch/arm/cpu/armv8/sec_firmware.c | 39

[PATCH v5 0/5] Populate kaslr seed with RNG

From: Sean Edmond This patch series creates a common API (fdt_fixup_kaslr_seed()) for populating the kaslr seed in the DTB. Existing users (kaslrseed, and ARMv8 sec firmware) have been updated to use this common API. New functionality has been introduced to populate the kaslr using the RNG.

[PATCH v5 3/5] cmd: kaslrseed: Use common API to fixup FDT

From: Sean Edmond Use the newly introduced common API fdt_fixup_kaslr_seed() in the kaslrseed command. Signed-off-by: Sean Edmond --- cmd/kaslrseed.c | 22 -- 1 file changed, 8 insertions(+), 14 deletions(-) diff --git a/cmd/kaslrseed.c b/cmd/kaslrseed.c index

[PATCH v5 4/5] dm: core: Modify default for OFNODE_MULTI_TREE

From: Sean Edmond There is a preference to use the "ofnode" API for FDT fixups moving forward. The FDT fixup will usually be for the kernel FDT. To fixup the kernel FDT with the ofnode API, it's required to set the OFNODE_MULTI_TREE option. To ensure existing users of kaslr fdt fixup are not

[PATCH v5 5/5] fdt: Fix compile error for !OFNODE_MULTI_TREE

From: Sean Edmond Required to fix the following compile error when building sandbox: /tmp/cci9ibby.ltrans21.ltrans.o: In function `do_cedit_load': :(.text+0x601d): undefined reference to `oftree_dispose' Signed-off-by: Sean Edmond --- drivers/core/ofnode.c | 12 ++-- 1 file changed, 6

[PATCH v5 2/3] net: bootp: BOOTP/DHCPv4 retransmission improvements

From: Sean Edmond This patch introduces 3 improvements to align with RFC 951: - retransmission backoff interval maximum is configurable - initial retranmission backoff interval is configurable - transaction ID is kept the same for each BOOTP/DHCPv4 request In applications where thousands of

[PATCH v5 1/3] net: Additional fixes for dhcp option 209

From: Sean Edmond Addresses feedback from latest review: - Enable option 209 by default - Set pxelinux_configfile to NULL to avoid potential double free - change hardcoced 209 to a define Signed-off-by: Sean Edmond --- changes in v4: - rebase master and resolve conflicts - change commit

[PATCH v5 0/3] BOOTP/DHCPv4 enhancements

From: Sean Edmond In our datacenter application, a single DHCP server is servicing 36000+ clients. Improvements are required to the DHCPv4 retransmission behavior to align with RFC and ensure less pressure is exerted on the server: - retransmission backoff interval maximum is configurable

[PATCH v5 3/3] net: bootp: add config option BOOTP_RANDOM_XID

From: Sean Edmond The new config option BOOTP_RANDOM_XID will randomize the transaction ID for each new BOOT/DHCPv4 exchange. Signed-off-by: Sean Edmond --- changes in v5: - fix depends for BOOTP_RANDOM_XID: "depends on CMD_BOOTP && (LIB_RAND || LIB_HW_RAND)" changes in v3: - Add depends

[PATCH v4 2/3] net: bootp: BOOTP/DHCPv4 retransmission improvements

From: Sean Edmond This patch introduces 3 improvements to align with RFC 951: - retransmission backoff interval maximum is configurable - initial retranmission backoff interval is configurable - transaction ID is kept the same for each BOOTP/DHCPv4 request In applications where thousands of

[PATCH v4 1/3] net: Additional fixes for dhcp option 209

From: Sean Edmond Addresses feedback from latest review: - Enable option 209 by default - Set pxelinux_configfile to NULL to avoid potential double free - change hardcoced 209 to a define Signed-off-by: Sean Edmond --- cmd/Kconfig | 1 + cmd/pxe.c | 2 ++ net/bootp.c | 4 ++-- net/bootp.h |

[PATCH v4 3/3] net: bootp: add config option BOOTP_RANDOM_XID

From: Sean Edmond The new config option BOOTP_RANDOM_XID will randomize the transaction ID for each new BOOT/DHCPv4 exchange. Signed-off-by: Sean Edmond --- cmd/Kconfig | 7 +++ net/bootp.c | 31 +-- 2 files changed, 24 insertions(+), 14 deletions(-) diff

[PATCH v4 0/3] [PATCH v4 0/3] [PATCH v3 0/3] BOOTP/DHCPv4 enhancements

From: Sean Edmond In our datacenter application, a single DHCP server is servicing 36000+ clients. Improvements are required to the DHCPv4 retransmission behavior to align with RFC and ensure less pressure is exerted on the server: - retransmission backoff interval maximum is configurable

[PATCH] Fix neighbor discovery ethernet address saving

From: Sean Edmond When a successful neighbor advertisement is received, the ethernet address should be saved for later use to avoid having to redo the neighbor discovery process. For example, with TFTP the address should get saved into "net_server_ethaddr". This is being done correctly with