November 2020 - U-Boot

[PATCH v2 1/2] smbios: add parsing API
by Christian Gmeiner 03 Nov '20

03 Nov '20

Add an very simple API to be able to access SMBIOS strings like vendor, model and bios version. Signed-off-by: Christian Gmeiner <christian.gmeiner(a)gmail.com> --- include/smbios.h | 27 +++++++++++++ lib/Kconfig | 6 +++ lib/Makefile | 1 + lib/smbios-parser.c | 96 +++++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 130 insertions(+) create mode 100644 lib/smbios-parser.c diff --git a/include/smbios.h b/include/smbios.h index 97b9ddce23..ed60c00fae 100644 --- a/include/smbios.h +++ b/include/smbios.h @@ -237,4 +237,31 @@ typedef int (*smbios_write_type)(ulong *addr, int handle); */ ulong write_smbios_table(ulong addr); +/** + * smbios_entry() - Get a vaild struct smbios_entry pointer + * + * @address: address where smbios tables is located + * @size: size of smbios table + * @return: NULL or a valid pointer to a struct smbios_entry + */ +const struct smbios_entry *smbios_entry(u64 address, u32 size); + +/** + * smbios_header() - Search for SMBIOS header type + * + * @entry: pointer to a struct smbios_entry + * @type: SMBIOS type + * @return: NULL or a valid pointer to a struct smbios_header + */ +const struct smbios_header *smbios_header(const struct smbios_entry *entry, int type); + +/** + * smbios_string() - Return string from SMBIOS + * + * @header: pointer to struct smbios_header + * @index: string index + * @return: NULL or a valid const char pointer + */ +const char *smbios_string(const struct smbios_header *header, int index); + #endif /* _SMBIOS_H_ */ diff --git a/lib/Kconfig b/lib/Kconfig index 8efb154f73..c92131b7bc 100644 --- a/lib/Kconfig +++ b/lib/Kconfig @@ -667,6 +667,12 @@ config OID_REGISTRY help Enable fast lookup object identifier registry. +config SMBIOS_PARSER + bool "SMBIOS parser" + default n + help + A simple parser for SMBIOS data. + source lib/efi/Kconfig source lib/efi_loader/Kconfig source lib/optee/Kconfig diff --git a/lib/Makefile b/lib/Makefile index 0cd7bea282..0383fddf2c 100644 --- a/lib/Makefile +++ b/lib/Makefile @@ -37,6 +37,7 @@ obj-$(CONFIG_FIT) += fdtdec_common.o obj-$(CONFIG_TEST_FDTDEC) += fdtdec_test.o obj-$(CONFIG_GZIP_COMPRESSED) += gzip.o obj-$(CONFIG_GENERATE_SMBIOS_TABLE) += smbios.o +obj-$(CONFIG_SMBIOS_PARSER) += smbios-parser.o obj-$(CONFIG_IMAGE_SPARSE) += image-sparse.o obj-y += ldiv.o obj-$(CONFIG_XXHASH) += xxhash.o diff --git a/lib/smbios-parser.c b/lib/smbios-parser.c new file mode 100644 index 0000000000..b89f988ef9 --- /dev/null +++ b/lib/smbios-parser.c @@ -0,0 +1,96 @@ +// SPDX-License-Identifier: GPL-2.0+ +/* + * Copyright (C) 2020, Bachmann electronic GmbH + */ + +#include <common.h> +#include <smbios.h> + +static inline int verify_checksum(const struct smbios_entry *e) +{ + /* + * Checksums for SMBIOS tables are calculated to have a value, so that + * the sum over all bytes yields zero (using unsigned 8 bit arithmetic). + */ + u8 *byte = (u8 *)e; + u8 sum = 0; + + for (int i = 0; i < e->length; i++) + sum += byte[i]; + + return sum; +} + +const struct smbios_entry *smbios_entry(u64 address, u32 size) +{ + const struct smbios_entry *entry = (struct smbios_entry *)(uintptr_t)address; + + if (!address | !size) + return NULL; + + if (memcmp(entry->anchor, "_SM_", 4)) + return NULL; + + if (verify_checksum(entry)) + return NULL; + + return entry; +} + +static const struct smbios_header *next_header(const struct smbios_header *curr) +{ + u8 *pos = ((u8 *)curr) + curr->length; + + /* search for _double_ NULL bytes */ + while (!((*pos == 0) && (*(pos + 1) == 0))) + pos++; + + /* step behind the double NULL bytes */ + pos += 2; + + return (struct smbios_header *)pos; +} + +const struct smbios_header *smbios_header(const struct smbios_entry *entry, int type) +{ + const unsigned int num_header = entry->struct_count; + const struct smbios_header *header = (struct smbios_header *)entry->struct_table_address; + + for (unsigned int i = 0; i < num_header; i++) { + if (header->type == type) + return header; + + header = next_header(header); + } + + return NULL; +} + +static const char *string_from_smbios_table(const struct smbios_header *header, + int idx) +{ + unsigned int i = 1; + u8 *pos; + + if (!header) + return NULL; + + pos = ((u8 *)header) + header->length; + + while (i < idx) { + if (*pos == 0x0) + i++; + + pos++; + } + + return (const char *)pos; +} + +const char *smbios_string(const struct smbios_header *header, int index) +{ + if (!header) + return NULL; + + return string_from_smbios_table(header, index); +} -- 2.28.0

2 5

[PATCH v2] mmc: fsl_esdhc_imx: add wait_dat0() support
by haibo.chen＠nxp.com 03 Nov '20

03 Nov '20

From: Haibo Chen <haibo.chen(a)nxp.com> Add wait_dat0() support, upper layer will use this callback. Signed-off-by: Haibo Chen <haibo.chen(a)nxp.com> --- drivers/mmc/fsl_esdhc_imx.c | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/drivers/mmc/fsl_esdhc_imx.c b/drivers/mmc/fsl_esdhc_imx.c index 22040c67a8..3843d61d71 100644 --- a/drivers/mmc/fsl_esdhc_imx.c +++ b/drivers/mmc/fsl_esdhc_imx.c @@ -1646,6 +1646,28 @@ static int fsl_esdhc_set_enhanced_strobe(struct udevice *dev) } #endif +static int fsl_esdhc_wait_dat0(struct udevice *dev, int state, + int timeout_us) +{ + int ret = -ETIMEDOUT; + bool dat0_high; + bool target_dat0_high = !!state; + struct fsl_esdhc_priv *priv = dev_get_priv(dev); + struct fsl_esdhc *regs = priv->esdhc_regs; + + timeout_us = DIV_ROUND_UP(timeout_us, 10); /* check every 10 us. */ + while (timeout_us--) { + dat0_high = !!(esdhc_read32(&regs->prsstat) & PRSSTAT_DAT0); + if (dat0_high == target_dat0_high) { + ret = 0; + break; + } + udelay(10); + } + + return ret; +} + static const struct dm_mmc_ops fsl_esdhc_ops = { .get_cd = fsl_esdhc_get_cd, .send_cmd = fsl_esdhc_send_cmd, @@ -1656,6 +1678,7 @@ static const struct dm_mmc_ops fsl_esdhc_ops = { #if CONFIG_IS_ENABLED(MMC_HS400_ES_SUPPORT) .set_enhanced_strobe = fsl_esdhc_set_enhanced_strobe, #endif + .wait_dat0 = fsl_esdhc_wait_dat0, }; #endif -- 2.17.1

1 0

Linking Error on env_get("loadaddr")
by Oliver Graute 03 Nov '20

03 Nov '20

Hello list, I try to use env_get("loadaddr") for a board specific CMD and included env.h. But I get the following linking error in nvedit.c. Some clue what I miss here? I still use v2020.07. start=$(aarch64-linux-gnu-nm u-boot | grep __rel_dyn_start | cut -f 1 -d ' '); end=$(aarch64-linux-gnu-nm u-boot | grep __rel_dyn_end | cut -f 1 -d ' '); tools/relocate-rela u-boot-nodtb.bin 0x80020000 $start $end CC spl/arch/arm/cpu/armv8/fwcall.o LD spl/arch/arm/cpu/armv8/built-in.o CC spl/common/spl/spl.o LD spl/common/spl/built-in.o CC spl/lib/display_options.o LD spl/lib/built-in.o LD spl/u-boot-spl cmd/built-in.o: In function `env_match': /home/graute/u-boot-test/cmd/nvedit.c:804: undefined reference to `env_get_char' /home/graute/u-boot-test/cmd/nvedit.c:808: undefined reference to `env_get_char' cmd/built-in.o: In function `env_get_f': /home/graute/u-boot-test/cmd/nvedit.c:713: undefined reference to `env_get_char' /home/graute/u-boot-test/cmd/nvedit.c:716: undefined reference to `env_get_char' /home/graute/u-boot-test/cmd/nvedit.c:729: undefined reference to `env_get_char' cmd/built-in.o: In function `env_get': /home/graute/u-boot-test/cmd/nvedit.c:677: undefined reference to `env_htab' /home/graute/u-boot-test/cmd/nvedit.c:677: undefined reference to `env_htab' lib/built-in.o: In function `hsearch_r': /home/graute/u-boot-test/lib/hashtable.c:402: undefined reference to `env_flags_init' scripts/Makefile.spl:422: recipe for target 'spl/u-boot-spl' failed make[1]: *** [spl/u-boot-spl] Error 1 Makefile:1926: recipe for target 'spl/u-boot-spl' failed make: *** [spl/u-boot-spl] Error 2 Best Regards, Oliver

3 2

[RFC PATCH] dfu: add DFU_SKIP layout concept
by Jaehoon Chung 02 Nov '20

02 Nov '20

Add DFU_SKIP layout cencept. If layout is "skip", it will be skipped after nothing to do. It's useful to support multiple board with one tar file. Signed-off-by: Jaehoon Chung <jh80.chung(a)samsung.com> --- drivers/dfu/dfu.c | 2 +- drivers/dfu/dfu_mmc.c | 9 +++++++++ include/dfu.h | 1 + 3 files changed, 11 insertions(+), 1 deletion(-) diff --git a/drivers/dfu/dfu.c b/drivers/dfu/dfu.c index a298c2c43999..f679f1fa5fe5 100644 --- a/drivers/dfu/dfu.c +++ b/drivers/dfu/dfu.c @@ -614,7 +614,7 @@ const char *dfu_get_dev_type(enum dfu_device_type t) const char *dfu_get_layout(enum dfu_layout l) { const char *const dfu_layout[] = {NULL, "RAW_ADDR", "FAT", "EXT2", - "EXT3", "EXT4", "RAM_ADDR" }; + "EXT3", "EXT4", "RAM_ADDR", "SKIP" }; return dfu_layout[l]; } diff --git a/drivers/dfu/dfu_mmc.c b/drivers/dfu/dfu_mmc.c index 691d01c7ebdf..c7c324b0a986 100644 --- a/drivers/dfu/dfu_mmc.c +++ b/drivers/dfu/dfu_mmc.c @@ -108,6 +108,8 @@ static int mmc_file_op(enum dfu_op op, struct dfu_entity *dfu, case DFU_FS_EXT4: fstype = FS_TYPE_EXT; break; + case DFU_SKIP: + return 0; default: printf("%s: Layout (%s) not (yet) supported!\n", __func__, dfu_get_layout(dfu->layout)); @@ -204,6 +206,9 @@ int dfu_write_medium_mmc(struct dfu_entity *dfu, case DFU_FS_EXT4: ret = mmc_file_buf_write(dfu, offset, buf, len); break; + case DFU_SKIP: + ret = 0; + break; default: printf("%s: Layout (%s) not (yet) supported!\n", __func__, dfu_get_layout(dfu->layout)); @@ -238,6 +243,8 @@ int dfu_get_medium_size_mmc(struct dfu_entity *dfu, u64 *size) if (ret < 0) return ret; return 0; + case DFU_SKIP: + return 0; default: printf("%s: Layout (%s) not (yet) supported!\n", __func__, dfu_get_layout(dfu->layout)); @@ -399,6 +406,8 @@ int dfu_fill_entity_mmc(struct dfu_entity *dfu, char *devstr, char *s) dfu->layout = DFU_FS_FAT; } else if (!strcmp(entity_type, "ext4")) { dfu->layout = DFU_FS_EXT4; + } else if (!strcmp(entity_type, "skip")) { + dfu->layout = DFU_SKIP; } else { pr_err("Memory layout (%s) not supported!\n", entity_type); return -ENODEV; diff --git a/include/dfu.h b/include/dfu.h index 84abdc79acd1..2e8276c69c9f 100644 --- a/include/dfu.h +++ b/include/dfu.h @@ -33,6 +33,7 @@ enum dfu_layout { DFU_FS_EXT3, DFU_FS_EXT4, DFU_RAM_ADDR, + DFU_SKIP, }; enum dfu_op { -- 2.29.0

2 2

[PATCH 1/1] efi_loader: non-volatile variable not deleted from file
by Heinrich Schuchardt 02 Nov '20

02 Nov '20

SetVariable() may be called with attributes == 0 to delete a variable. To determine if the deletion shall be persisted we have to consider the non-volatile flag in the attributes of the deleted variable and not the value passed in the call parameter. Signed-off-by: Heinrich Schuchardt <xypron.glpk(a)gmx.de> --- lib/efi_loader/efi_variable.c | 1 + 1 file changed, 1 insertion(+) diff --git a/lib/efi_loader/efi_variable.c b/lib/efi_loader/efi_variable.c index a10b9caa8b..0c689cfb47 100644 --- a/lib/efi_loader/efi_variable.c +++ b/lib/efi_loader/efi_variable.c @@ -393,6 +393,7 @@ efi_status_t efi_set_variable_int(u16 *variable_name, const efi_guid_t *vendor, if (delete) { /* EFI_NOT_FOUND has been handled before */ + attributes = var->attr; ret = EFI_SUCCESS; } else if (append) { u16 *old_data = var->name; -- 2.28.0

1 0

[PULL] u-boot-atmel-fixes-2021.01-a
by Eugen.Hristev＠microchip.com 02 Nov '20

02 Nov '20

Hello Tom, Please pull tag u-boot-atmel-fixes-2021.01-a , the first set of atmel fixes for 2021.01 cycle. This specific feature set includes the patches for DT required to fix the warnings for newer DTC version (1.6.0+), i2c and spi bus unit address. Thanks ! Eugen The following changes since commit 81a659e10a10020cfb03abd4794103194add1f3a: Prepare v2021.01-rc1 (2020-10-28 16:30:06 -0400) are available in the Git repository at: https://gitlab.denx.de/u-boot/custodians/u-boot-atmel.git tags/u-boot-atmel-fixes-2021.01-a for you to fetch changes up to ef8f34aea56465e1584ab60b6ae3f3340aab55de: ARM: dts: at91: sama5d3xmb_cmp: fix SPI bus unit address (2020-11-02 08:58:38 +0200) ---------------------------------------------------------------- First set of u-boot-atmel fixes for 2021.01 cycle ---------------------------------------------------------------- Eugen Hristev (9): ARM: dts: at91: vinco: fix I2C warning bus unit address ARM: dts: at91: at91sam9261ek: fix SPI unit address warning ARM: dts: at91: at91sam9g20-taurus: fix SPI bus unit address ARM: dts: at91: at91sam9g20ek_common: fix SPI bus unit address ARM: dts: at91: at91sam9g25ek: fix I2C bus unit address ARM: dts: at91: gurnard: fix SPI bus unit address ARM: dts: at91: sama5d3xmb: fix I2C bus unit address ARM: dts: at91: sam9260ek: fix SPI bus unit address ARM: dts: at91: sama5d3xmb_cmp: fix SPI bus unit address arch/arm/dts/at91-vinco.dts | 2 +- arch/arm/dts/at91sam9260ek.dts | 2 +- arch/arm/dts/at91sam9261ek.dts | 2 +- arch/arm/dts/at91sam9g20-taurus.dts | 2 +- arch/arm/dts/at91sam9g20ek_common.dtsi | 2 +- arch/arm/dts/at91sam9g25ek.dts | 2 +- arch/arm/dts/at91sam9g45-gurnard.dts | 2 +- arch/arm/dts/sama5d3xmb.dtsi | 2 +- arch/arm/dts/sama5d3xmb_cmp.dtsi | 2 +- 9 files changed, 9 insertions(+), 9 deletions(-)

2 1

[scan-admin@coverity.com: New Defects reported by Coverity Scan for Das U-Boot]
by Tom Rini 02 Nov '20

02 Nov '20

Here's the latest report from Coverity scan. I think it's more helpful to send these to the list so that anyone can help advise on solutions than to send it only to people that may have introduced the problem, as I have previously been forwarding to. I don't recall why I got in the habit to start with, so, breaking that habit now. ----- Forwarded message from scan-admin(a)coverity.com ----- Date: Wed, 28 Oct 2020 20:41:49 +0000 (UTC) From: scan-admin(a)coverity.com To: tom.rini(a)gmail.com Subject: New Defects reported by Coverity Scan for Das U-Boot Hi, Please find the latest report on new defect(s) introduced to Das U-Boot found with Coverity Scan. 37 new defect(s) introduced to Das U-Boot found with Coverity Scan. 5 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 20 of 37 defect(s) ** CID 312960: Integer handling issues (BAD_SHIFT) /drivers/mux/mmio.c: 107 in mmio_mux_probe() ________________________________________________________________________________________________________ *** CID 312960: Integer handling issues (BAD_SHIFT) /drivers/mux/mmio.c: 107 in mmio_mux_probe() 101 mask = mux_reg_masks[2 * i + 1]; 102 103 field.reg = reg; 104 field.msb = fls(mask) - 1; 105 field.lsb = ffs(mask) - 1; 106 >>> CID 312960: Integer handling issues (BAD_SHIFT) >>> In expression "0xffffffffffffffffUL << field.lsb", left shifting by more than 63 bits has undefined behavior. The shift amount, "field.lsb", is 4294967295. 107 if (mask != GENMASK(field.msb, field.lsb)) 108 return log_msg_ret("invalid mask", -EINVAL); 109 110 fields[i] = devm_regmap_field_alloc(dev, regmap, field); 111 if (IS_ERR(fields[i])) { 112 ret = PTR_ERR(fields[i]); ** CID 312959: (RESOURCE_LEAK) /drivers/mux/mmio.c: 113 in mmio_mux_probe() /drivers/mux/mmio.c: 108 in mmio_mux_probe() ________________________________________________________________________________________________________ *** CID 312959: (RESOURCE_LEAK) /drivers/mux/mmio.c: 113 in mmio_mux_probe() 107 if (mask != GENMASK(field.msb, field.lsb)) 108 return log_msg_ret("invalid mask", -EINVAL); 109 110 fields[i] = devm_regmap_field_alloc(dev, regmap, field); 111 if (IS_ERR(fields[i])) { 112 ret = PTR_ERR(fields[i]); >>> CID 312959: (RESOURCE_LEAK) >>> Variable "idle_states" going out of scope leaks the storage it points to. 113 return log_msg_ret("regmap_field_alloc", ret); 114 } 115 116 bits = 1 + field.msb - field.lsb; 117 mux->states = 1 << bits; 118 /drivers/mux/mmio.c: 108 in mmio_mux_probe() 102 103 field.reg = reg; 104 field.msb = fls(mask) - 1; 105 field.lsb = ffs(mask) - 1; 106 107 if (mask != GENMASK(field.msb, field.lsb)) >>> CID 312959: (RESOURCE_LEAK) >>> Variable "idle_states" going out of scope leaks the storage it points to. 108 return log_msg_ret("invalid mask", -EINVAL); 109 110 fields[i] = devm_regmap_field_alloc(dev, regmap, field); 111 if (IS_ERR(fields[i])) { 112 ret = PTR_ERR(fields[i]); 113 return log_msg_ret("regmap_field_alloc", ret); ** CID 312958: Uninitialized variables (UNINIT) /fs/btrfs/inode.c: 341 in btrfs_lookup_path() ________________________________________________________________________________________________________ *** CID 312958: Uninitialized variables (UNINIT) /fs/btrfs/inode.c: 341 in btrfs_lookup_path() 335 cur += len; 336 } 337 338 if (!ret) { 339 *root_ret = root; 340 *ino_ret = ino; >>> CID 312958: Uninitialized variables (UNINIT) >>> Using uninitialized value "type". 341 *type_ret = type; 342 } 343 344 return ret; 345 } 346 ** CID 312957: Integer handling issues (OVERFLOW_BEFORE_WIDEN) /fs/btrfs/volumes.c: 1106 in __btrfs_map_block() ________________________________________________________________________________________________________ *** CID 312957: Integer handling issues (OVERFLOW_BEFORE_WIDEN) /fs/btrfs/volumes.c: 1106 in __btrfs_map_block() 1100 stripe_nr = stripe_nr / nr_data_stripes(map); 1101 1102 /* Work out the disk rotation on this stripe-set */ 1103 rot = stripe_nr % map->num_stripes; 1104 1105 /* Fill in the logical address of each stripe */ >>> CID 312957: Integer handling issues (OVERFLOW_BEFORE_WIDEN) >>> Potentially overflowing expression "stripe_nr * nr_data_stripes(map)" with type "int" (32 bits, signed) is evaluated using 32-bit arithmetic, and then used in a context that expects an expression of type "u64" (64 bits, unsigned). 1106 tmp = stripe_nr * nr_data_stripes(map); 1107 1108 for (i = 0; i < nr_data_stripes(map); i++) 1109 raid_map[(i+rot) % map->num_stripes] = 1110 ce->start + (tmp + i) * map->stripe_len; 1111 ** CID 312956: Error handling issues (NEGATIVE_RETURNS) /tools/image-host.c: 337 in get_random_data() ________________________________________________________________________________________________________ *** CID 312956: Error handling issues (NEGATIVE_RETURNS) /tools/image-host.c: 337 in get_random_data() 331 ret = -1; 332 goto out; 333 } 334 335 ret = clock_gettime(CLOCK_MONOTONIC, &date); 336 if (ret < 0) { >>> CID 312956: Error handling issues (NEGATIVE_RETURNS) >>> "ret" is passed to a parameter that cannot be negative. 337 printf("%s: clock_gettime has failed (err=%d, str=%s)\n", 338 __func__, ret, strerror(ret)); 339 goto out; 340 } 341 342 srand(date.tv_nsec); ** CID 312955: Uninitialized variables (UNINIT) /fs/btrfs/btrfs.c: 113 in show_dir() ________________________________________________________________________________________________________ *** CID 312955: Uninitialized variables (UNINIT) /fs/btrfs/btrfs.c: 113 in show_dir() 107 printf("%24.24s %.*s", filetime, btrfs_dir_name_len(eb, di), namebuf); 108 if (type == BTRFS_FT_SYMLINK) 109 printf(" -> %s", target ? target : "?"); 110 printf("\n"); 111 out: 112 free(target); >>> CID 312955: Uninitialized variables (UNINIT) >>> Using uninitialized value "ret". 113 return ret; 114 } 115 116 int btrfs_probe(struct blk_desc *fs_dev_desc, 117 struct disk_partition *fs_partition) 118 { ** CID 312954: (DC.WEAK_CRYPTO) /test/dm/mux-cmd.c: 133 in dm_test_cmd_mux_select() /test/dm/mux-cmd.c: 129 in dm_test_cmd_mux_select() ________________________________________________________________________________________________________ *** CID 312954: (DC.WEAK_CRYPTO) /test/dm/mux-cmd.c: 133 in dm_test_cmd_mux_select() 127 ut_assertnonnull(chip); 128 129 srand(get_ticks() + rand()); 130 for (i = 0; i < chip->controllers; i++) { 131 mux = &chip->mux[i]; 132 >>> CID 312954: (DC.WEAK_CRYPTO) >>> "rand" should not be used for security-related applications, because linear congruential algorithms are too easy to break. 133 state = rand() % mux->states; 134 135 snprintf(cmd, BUF_SIZE, "mux select a-mux-controller %x %x", i, 136 state); 137 run_command(cmd, 0); 138 ut_asserteq(!!mux->in_use, true); /test/dm/mux-cmd.c: 129 in dm_test_cmd_mux_select() 123 124 ut_assertok(uclass_get_device_by_name(UCLASS_MUX, "a-mux-controller", 125 &dev)); 126 chip = dev_get_uclass_priv(dev); 127 ut_assertnonnull(chip); 128 >>> CID 312954: (DC.WEAK_CRYPTO) >>> "rand" should not be used for security-related applications, because linear congruential algorithms are too easy to break. 129 srand(get_ticks() + rand()); 130 for (i = 0; i < chip->controllers; i++) { 131 mux = &chip->mux[i]; 132 133 state = rand() % mux->states; 134 ** CID 312953: Security best practices violations (DC.WEAK_CRYPTO) /tools/image-host.c: 345 in get_random_data() ________________________________________________________________________________________________________ *** CID 312953: Security best practices violations (DC.WEAK_CRYPTO) /tools/image-host.c: 345 in get_random_data() 339 goto out; 340 } 341 342 srand(date.tv_nsec); 343 344 for (i = 0; i < size; i++) { >>> CID 312953: Security best practices violations (DC.WEAK_CRYPTO) >>> "rand" should not be used for security-related applications, because linear congruential algorithms are too easy to break. 345 *tmp = rand() & 0xff; 346 tmp++; 347 } 348 349 out: 350 return ret; ** CID 312952: Resource leaks (RESOURCE_LEAK) /drivers/reset/reset-uclass.c: 331 in devm_reset_bulk_get_by_node() ________________________________________________________________________________________________________ *** CID 312952: Resource leaks (RESOURCE_LEAK) /drivers/reset/reset-uclass.c: 331 in devm_reset_bulk_get_by_node() 325 __GFP_ZERO); 326 if (unlikely(!bulk)) 327 return ERR_PTR(-ENOMEM); 328 329 rc = __reset_get_bulk(dev, node, bulk); 330 if (rc) >>> CID 312952: Resource leaks (RESOURCE_LEAK) >>> Variable "bulk" going out of scope leaks the storage it points to. 331 return ERR_PTR(rc); 332 333 devres_add(dev, bulk); 334 return bulk; 335 } 336 ** CID 312951: (RESOURCE_LEAK) /drivers/core/regmap.c: 315 in devm_regmap_init() /drivers/core/regmap.c: 315 in devm_regmap_init() /drivers/core/regmap.c: 306 in devm_regmap_init() /drivers/core/regmap.c: 306 in devm_regmap_init() ________________________________________________________________________________________________________ *** CID 312951: (RESOURCE_LEAK) /drivers/core/regmap.c: 315 in devm_regmap_init() 309 if (config) { 310 map->width = config->width; 311 map->reg_offset_shift = config->reg_offset_shift; 312 } 313 314 devres_add(dev, mapp); >>> CID 312951: (RESOURCE_LEAK) >>> Variable "mapp" going out of scope leaks the storage it points to. 315 return *mapp; 316 } 317 #endif 318 319 void *regmap_get_range(struct regmap *map, unsigned int range_num) 320 { /drivers/core/regmap.c: 315 in devm_regmap_init() 309 if (config) { 310 map->width = config->width; 311 map->reg_offset_shift = config->reg_offset_shift; 312 } 313 314 devres_add(dev, mapp); >>> CID 312951: (RESOURCE_LEAK) >>> Variable "mapp" going out of scope leaks the storage it points to. 315 return *mapp; 316 } 317 #endif 318 319 void *regmap_get_range(struct regmap *map, unsigned int range_num) 320 { /drivers/core/regmap.c: 306 in devm_regmap_init() 300 if (config && config->r_size != 0) 301 rc = regmap_init_mem_range(dev_ofnode(dev), config->r_start, 302 config->r_size, mapp); 303 else 304 rc = regmap_init_mem(dev_ofnode(dev), mapp); 305 if (rc) >>> CID 312951: (RESOURCE_LEAK) >>> Variable "mapp" going out of scope leaks the storage it points to. 306 return ERR_PTR(rc); 307 308 map = *mapp; 309 if (config) { 310 map->width = config->width; 311 map->reg_offset_shift = config->reg_offset_shift; /drivers/core/regmap.c: 306 in devm_regmap_init() 300 if (config && config->r_size != 0) 301 rc = regmap_init_mem_range(dev_ofnode(dev), config->r_start, 302 config->r_size, mapp); 303 else 304 rc = regmap_init_mem(dev_ofnode(dev), mapp); 305 if (rc) >>> CID 312951: (RESOURCE_LEAK) >>> Variable "mapp" going out of scope leaks the storage it points to. 306 return ERR_PTR(rc); 307 308 map = *mapp; 309 if (config) { 310 map->width = config->width; 311 map->reg_offset_shift = config->reg_offset_shift; ** CID 312950: Uninitialized variables (UNINIT) ________________________________________________________________________________________________________ *** CID 312950: Uninitialized variables (UNINIT) /fs/btrfs/btrfs.c: 96 in show_dir() 90 if (type < ARRAY_SIZE(dir_item_str) && dir_item_str[type]) 91 printf("<%s> ", dir_item_str[type]); 92 else 93 printf("DIR_ITEM.%u", type); 94 if (type == BTRFS_FT_CHRDEV || type == BTRFS_FT_BLKDEV) { 95 ASSERT(key.type == BTRFS_INODE_ITEM_KEY); >>> CID 312950: Uninitialized variables (UNINIT) >>> Using uninitialized value "ii.rdev" when calling "btrfs_stack_inode_rdev". 96 printf("%4llu,%5llu ", btrfs_stack_inode_rdev(&ii) >> 20, 97 btrfs_stack_inode_rdev(&ii) & 0xfffff); 98 } else { 99 if (key.type == BTRFS_INODE_ITEM_KEY) 100 printf("%10llu ", btrfs_stack_inode_size(&ii)); 101 else ** CID 312949: (DC.WEAK_CRYPTO) /test/dm/regmap.c: 310 in dm_test_devm_regmap() /test/dm/regmap.c: 308 in dm_test_devm_regmap() ________________________________________________________________________________________________________ *** CID 312949: (DC.WEAK_CRYPTO) /test/dm/regmap.c: 310 in dm_test_devm_regmap() 304 ut_assertok(uclass_get_device_by_name(UCLASS_NOP, "regmap-test_0", 305 &dev)); 306 priv = dev_get_priv(dev); 307 308 srand(get_ticks() + rand()); 309 for (i = 0; i < REGMAP_TEST_BUF_SZ; i++) { >>> CID 312949: (DC.WEAK_CRYPTO) >>> "rand" should not be used for security-related applications, because linear congruential algorithms are too easy to break. 310 pattern[i] = rand(); 311 ut_assertok(regmap_write(priv->cfg_regmap, i, pattern[i])); 312 } 313 for (i = 0; i < REGMAP_TEST_BUF_SZ; i++) { 314 ut_assertok(regmap_read(priv->cfg_regmap, i, &val)); 315 ut_asserteq(val, buffer[i]); /test/dm/regmap.c: 308 in dm_test_devm_regmap() 302 REGMAP_TEST_BUF_SZ * 2, MAP_NOCACHE); 303 304 ut_assertok(uclass_get_device_by_name(UCLASS_NOP, "regmap-test_0", 305 &dev)); 306 priv = dev_get_priv(dev); 307 >>> CID 312949: (DC.WEAK_CRYPTO) >>> "rand" should not be used for security-related applications, because linear congruential algorithms are too easy to break. 308 srand(get_ticks() + rand()); 309 for (i = 0; i < REGMAP_TEST_BUF_SZ; i++) { 310 pattern[i] = rand(); 311 ut_assertok(regmap_write(priv->cfg_regmap, i, pattern[i])); 312 } 313 for (i = 0; i < REGMAP_TEST_BUF_SZ; i++) { ** CID 312948: Integer handling issues (OVERFLOW_BEFORE_WIDEN) /fs/btrfs/volumes.c: 1033 in __btrfs_map_block() ________________________________________________________________________________________________________ *** CID 312948: Integer handling issues (OVERFLOW_BEFORE_WIDEN) /fs/btrfs/volumes.c: 1033 in __btrfs_map_block() 1027 /* 1028 * stripe_nr counts the total number of stripes we have to stride 1029 * to get to this block 1030 */ 1031 stripe_nr = stripe_nr / map->stripe_len; 1032 >>> CID 312948: Integer handling issues (OVERFLOW_BEFORE_WIDEN) >>> Potentially overflowing expression "stripe_nr * map->stripe_len" with type "int" (32 bits, signed) is evaluated using 32-bit arithmetic, and then used in a context that expects an expression of type "u64" (64 bits, unsigned). 1033 stripe_offset = stripe_nr * map->stripe_len; 1034 BUG_ON(offset < stripe_offset); 1035 1036 /* stripe_offset is the offset of this block in its stripe*/ 1037 stripe_offset = offset - stripe_offset; 1038 ** CID 312947: Error handling issues (CHECKED_RETURN) /drivers/core/dump.c: 137 in dm_dump_drivers() ________________________________________________________________________________________________________ *** CID 312947: Error handling issues (CHECKED_RETURN) /drivers/core/dump.c: 137 in dm_dump_drivers() 131 int i; 132 133 puts("Driver uid uclass Devices\n"); 134 puts("----------------------------------------------------------\n"); 135 136 for (entry = d; entry < d + n_ents; entry++) { >>> CID 312947: Error handling issues (CHECKED_RETURN) >>> Calling "uclass_get" without checking return value (as is done elsewhere 52 out of 65 times). 137 uclass_get(entry->id, &uc); 138 139 printf("%-25.25s %-3.3d %-20.20s ", entry->name, entry->id, 140 uc ? uc->uc_drv->name : "<no uclass>"); 141 142 if (!uc) { ** CID 312946: Incorrect expression (USELESS_CALL) ________________________________________________________________________________________________________ *** CID 312946: Incorrect expression (USELESS_CALL) /drivers/clk/clk-uclass.c: 201 in clk_set_default_get_by_id() 195 if (CONFIG_IS_ENABLED(CLK_CCF)) { 196 int ret = clk_get_by_id(clk->id, &c); 197 198 if (ret) { 199 debug("%s(): could not get parent clock pointer, id %lu\n", 200 __func__, clk->id); >>> CID 312946: Incorrect expression (USELESS_CALL) >>> Calling "ERR_PTR(ret)" is only useful for its return value, which is ignored. 201 ERR_PTR(ret); 202 } 203 } 204 205 return c; 206 } ** CID 312945: Error handling issues (CHECKED_RETURN) /lib/efi_loader/efi_console.c: 272 in query_console_serial() ________________________________________________________________________________________________________ *** CID 312945: Error handling issues (CHECKED_RETURN) /lib/efi_loader/efi_console.c: 272 in query_console_serial() 266 { 267 int ret = 0; 268 int n[2]; 269 270 /* Empty input buffer */ 271 while (tstc()) >>> CID 312945: Error handling issues (CHECKED_RETURN) >>> Calling "getchar()" without checking return value. This library function may fail and return an error code. [Note: The source code implementation of the function has been overridden by a builtin model.] 272 getchar(); 273 274 /* 275 * Not all terminals understand CSI [18t for querying the console size. 276 * We should adhere to escape sequences documented in the console_codes 277 * man page and the ECMA-48 standard. ** CID 312944: Integer handling issues (BAD_SHIFT) /drivers/mux/mmio.c: 107 in mmio_mux_probe() ________________________________________________________________________________________________________ *** CID 312944: Integer handling issues (BAD_SHIFT) /drivers/mux/mmio.c: 107 in mmio_mux_probe() 101 mask = mux_reg_masks[2 * i + 1]; 102 103 field.reg = reg; 104 field.msb = fls(mask) - 1; 105 field.lsb = ffs(mask) - 1; 106 >>> CID 312944: Integer handling issues (BAD_SHIFT) >>> In expression "0xffffffffffffffffUL >> 63U - field.msb", right shifting by more than 63 bits has undefined behavior. The shift amount, "63U - field.msb", is 64. 107 if (mask != GENMASK(field.msb, field.lsb)) 108 return log_msg_ret("invalid mask", -EINVAL); 109 110 fields[i] = devm_regmap_field_alloc(dev, regmap, field); 111 if (IS_ERR(fields[i])) { 112 ret = PTR_ERR(fields[i]); ** CID 312943: (TAINTED_SCALAR) /fs/btrfs/volumes.c: 563 in read_one_chunk() /fs/btrfs/volumes.c: 549 in read_one_chunk() ________________________________________________________________________________________________________ *** CID 312943: (TAINTED_SCALAR) /fs/btrfs/volumes.c: 563 in read_one_chunk() 557 map->io_align = btrfs_chunk_io_align(leaf, chunk); 558 map->sector_size = btrfs_chunk_sector_size(leaf, chunk); 559 map->stripe_len = btrfs_chunk_stripe_len(leaf, chunk); 560 map->type = btrfs_chunk_type(leaf, chunk); 561 map->sub_stripes = btrfs_chunk_sub_stripes(leaf, chunk); 562 >>> CID 312943: (TAINTED_SCALAR) >>> Using tainted variable "num_stripes" as a loop boundary. 563 for (i = 0; i < num_stripes; i++) { 564 map->stripes[i].physical = 565 btrfs_stripe_offset_nr(leaf, chunk, i); 566 devid = btrfs_stripe_devid_nr(leaf, chunk, i); 567 read_extent_buffer(leaf, uuid, (unsigned long) 568 btrfs_stripe_dev_uuid_nr(chunk, i), /fs/btrfs/volumes.c: 549 in read_one_chunk() 543 544 /* already mapped? */ 545 if (ce && ce->start <= logical && ce->start + ce->size > logical) { 546 return 0; 547 } 548 >>> CID 312943: (TAINTED_SCALAR) >>> Passing tainted variable "80UL + 16UL * num_stripes" to a tainted sink. [Note: The source code implementation of the function has been overridden by a builtin model.] 549 map = kmalloc(btrfs_map_lookup_size(num_stripes), GFP_NOFS); 550 if (!map) 551 return -ENOMEM; 552 553 map->ce.start = logical; 554 map->ce.size = length; ** CID 312942: Control flow issues (DEADCODE) /drivers/firmware/scmi/sandbox-scmi_devices.c: 96 in sandbox_scmi_devices_probe() ________________________________________________________________________________________________________ *** CID 312942: Control flow issues (DEADCODE) /drivers/firmware/scmi/sandbox-scmi_devices.c: 96 in sandbox_scmi_devices_probe() 90 } 91 92 return 0; 93 94 err_reset: 95 for (; n > 0; n--) >>> CID 312942: Control flow issues (DEADCODE) >>> Execution cannot reach this statement: "reset_free(priv->devices.re...". 96 reset_free(priv->devices.reset + n - 1); 97 98 return ret; 99 } 100 101 static const struct udevice_id sandbox_scmi_devices_ids[] = { ** CID 312941: Insecure data handling (TAINTED_SCALAR) /fs/btrfs/dir-item.c: 57 in btrfs_match_dir_item_name() ________________________________________________________________________________________________________ *** CID 312941: Insecure data handling (TAINTED_SCALAR) /fs/btrfs/dir-item.c: 57 in btrfs_match_dir_item_name() 51 leaf = path->nodes[0]; 52 dir_item = btrfs_item_ptr(leaf, path->slots[0], struct btrfs_dir_item); 53 total_len = btrfs_item_size_nr(leaf, path->slots[0]); 54 if (verify_dir_item(root, leaf, dir_item)) 55 return NULL; 56 >>> CID 312941: Insecure data handling (TAINTED_SCALAR) >>> Using tainted variable "total_len" as a loop boundary. 57 while(cur < total_len) { 58 this_len = sizeof(*dir_item) + 59 btrfs_dir_name_len(leaf, dir_item) + 60 btrfs_dir_data_len(leaf, dir_item); 61 if (this_len > (total_len - cur)) { 62 fprintf(stderr, "invalid dir item size\n"); ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P… To manage Coverity Scan email notifications for "tom.rini(a)gmail.com", click https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P… ----- End forwarded message ----- -- Tom

2 1

FIT required certificate check issue SOLUTION
by Muthmann, Thomas 02 Nov '20

02 Nov '20

Hi again, for reference this is my solution for the Problem below: 1. Do NOT use CONFIG_MULTI_DTB_FIT if using cipher or signature In this case all DTBs are added in FIT Image. All DTBs are added before u-boot.dtb, so you have at least two entries. U-Boot does not search this list for cipher and signature, it uses the first entry ONLY. In the U-Boot Hexdump you find the cipher and signature entries, but they are in the SECOND DTB and not found. 2. Do NOT add '-1' or '#1' in cipher or signature U-Boot only looks for 'cipher' and 'signature' I did not realize this problem, because the Host Tools fit_check_sign accepts 'cipher-1' and 'signature-1', but U-Boot NOT. If you have any of the above problems, U-Boot silently ignores the cipher and signature entries. ---------------------------------- Hi everyone, new User here. First let me explain how we are using U-Boot: NXP MX6 Hardware, load FIT Image with Kernel, DTB, RamFS as one FIT-Image from MMC, bootm To secure the FIT we are hashing all 3 Parts using sha256 und signing the Config with our Certificate. In short we are following this process: 1. Generate Cert, name it "required-company-cert" here 2. Attach this Cert to dts/dt.dtb of U-Boot using mkimage -k <dir-with-above-cert> -K dts/dt.dtb -r 3. make U-Boot to attach the Cert with it, store it at a secure place and put it on several devices In 2. you can see that I used -r to store this cert as required. Using "fdtget u-boot.dtb /signature/required-company-cert required" I get "conf". So the Cert is attached to U-Boot and is marked as required for configurations. (To be sure, I used a hex editor to find the cert and the required in the final U-Boot image) It is planned to never change U-Boot and FIT Updates are done using a dual image system (bootcount, altbootcmd) We create FIT images "test.itb" with Kernel, DTB, RamFS. 3 images using sha256, one configuration using above certificate. For the following test I used the u-boot git master from today, using "make sandbox_defconfig". The FIT Images are checked using "tools/fit_check_sign -f <itb> -k u-boot.dtb" 1. Using the correct Cert I get: Verifying Hash Integrity for node 'conf-1'... sha256,rsa4096:required-company-cert+ Verified OK, loading images Signature check OK 2. Using no Cert I get: Verifying Hash Integrity for node 'conf-1'... error! for '(null)' hash node in 'conf-1' config node Failed to verify required signature 'key-rtu-fit-sign' 3. Using the wrong Cert "tamper" I get: Verifying Hash Integrity for node 'conf-1'... sha256,rsa4096:tamper- error! Verification failed for '(null)' hash node in 'conf-1' config node Failed to verify required signature 'required-company-cert' So fit_check_sign acts correctly by finding the cert 'required-company-cert' as required in u-boot.dtb If I load any of these FIT Images in U-Boot only the sha256 hashes are checked, and nobody cares about the Certificate. (using iminfo here and bootm on our ARM Hardware) I can load any FIT Image with wrong Certs, or any Cert at all! On analyzing the Problem in the Source Code I saw that U-Boot does not check Certs if it finds no "required" entry. In common/image-fit-sig.c, method "fit_config_verify_required_sigs" the "required" node is searched. As far as I can tell any FDT operation is done on the loaded FIT, I saw no access of the u-boot.dtb included in u-boot. This makes no sense to me, as the u-boot.dtb included in u-boot must have the final word which Cert is to be used and required. Any information in the FIT must be regarded as possible tampered from a 3rd party. Regards, Thomas

1 0

[PATCH] configs: meson64: relocate config_distro_bootcmmd header
by Jaehoon Chung 02 Nov '20

02 Nov '20

Relocate a config_distro_bootcmd header before defined CONFIG_EXTRA_ENV_SETTINGS. Otherwise it can't change to specific environment. Signed-off-by: Jaehoon Chung <jh80.chung(a)samsung.com> --- include/configs/meson64.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/include/configs/meson64.h b/include/configs/meson64.h index cee690068022..52cc01f73da3 100644 --- a/include/configs/meson64.h +++ b/include/configs/meson64.h @@ -69,6 +69,8 @@ func(DHCP, dhcp, na) #endif +#include <config_distro_bootcmd.h> + #ifndef CONFIG_EXTRA_ENV_SETTINGS #define CONFIG_EXTRA_ENV_SETTINGS \ "stdin=" STDIN_CFG "\0" \ @@ -83,6 +85,5 @@ BOOTENV #endif -#include <config_distro_bootcmd.h> #endif /* __MESON64_CONFIG_H */ -- 2.29.0

2 3

[PATCHv4 0/9] Introduce B1x5v2 support
by Sebastian Reichel 02 Nov '20

02 Nov '20

This series introduces support for a new i.MX6DL based GE patient monitor series. Patch 1: Add support for storing bootcount in SPI-flash Patch 2+3: Improve M41T62 RTC driver's reset routine. PATCH 4: Support disable_ldb_di_clock_sources for i.MX6DL Patch 5: Add poweroff-gpio support Patch 6-8: restructure common GE code Patch 9: Add the actual board, using SPL and DM Changes since PATCHv3 [0]: * Dropped patch for reading DR for i.MX GPIOs and set SION pinmux bits in B1x5v2 output GPIOs instead * Rebased to v2020.10-rc3 Changes since PATCHv2: * PATCH 10: Fixed network phy mode ("rgmii" -> "rgmii-id") * PATCH 6: Fixed nits reported by Simon Glass and added is Reviewed-by Tag. Changes since PATCHv1: * Rebased to v2020.10-rc2 * Original patch 1 (support for DM_SPI_FLASH with non-DM SPL) has been dropped, since a similar patch has been merged in the meantime * poweroff-gpio support is now added using sysreset uclass instead of introducing a new poweroff uclass * B1x5v2 patch has been updated to follow recent U-Boot changes and to add USB mass storage support [0] http://patchwork.ozlabs.org/project/uboot/list/?series=196979 -- Sebastian Sebastian Reichel (9): bootcount: add a DM SPI flash backing store for bootcount rtc: m41t62: reset SQW in m41t62_rtc_reset rtc: m41t62: add oscillator fail bit reset support imx6: allow usage of disable_ldb_di_clock_sources for CONFIG_MX6QDL sysreset: Add poweroff-gpio driver board: ge: common: rename ge_common.c to ge_rtc.c board: ge: common: add config option for RTC and VPD feature board: ge: common: vpd: separate I2C specific code board: ge: b1x5v2: Add GE B1x5v2 and B1x5Pv2 arch/arm/dts/Makefile | 1 + arch/arm/dts/imx6dl-b1x5v2.dts | 654 ++++++++++++++++++++ arch/arm/mach-imx/mx6/Kconfig | 9 + arch/arm/mach-imx/mx6/clock.c | 2 +- board/ge/b1x5v2/Kconfig | 14 + board/ge/b1x5v2/Makefile | 6 + board/ge/b1x5v2/b1x5v2.c | 698 ++++++++++++++++++++++ board/ge/b1x5v2/spl.c | 587 ++++++++++++++++++ board/ge/bx50v3/Kconfig | 2 + board/ge/bx50v3/bx50v3.c | 4 +- board/ge/common/Kconfig | 7 + board/ge/common/Makefile | 3 +- board/ge/common/{ge_common.c => ge_rtc.c} | 0 board/ge/common/{ge_common.h => ge_rtc.h} | 0 board/ge/common/vpd_reader.c | 12 +- board/ge/common/vpd_reader.h | 23 +- board/ge/mx53ppd/Kconfig | 2 + board/ge/mx53ppd/mx53ppd.c | 4 +- configs/ge_b1x5v2_defconfig | 137 +++++ drivers/bootcount/Kconfig | 10 + drivers/bootcount/Makefile | 1 + drivers/bootcount/spi-flash.c | 125 ++++ drivers/rtc/m41t62.c | 139 ++++- drivers/sysreset/Kconfig | 7 + drivers/sysreset/Makefile | 1 + drivers/sysreset/poweroff_gpio.c | 92 +++ include/configs/ge_b1x5v2.h | 127 ++++ 27 files changed, 2645 insertions(+), 22 deletions(-) create mode 100644 arch/arm/dts/imx6dl-b1x5v2.dts create mode 100644 board/ge/b1x5v2/Kconfig create mode 100644 board/ge/b1x5v2/Makefile create mode 100644 board/ge/b1x5v2/b1x5v2.c create mode 100644 board/ge/b1x5v2/spl.c create mode 100644 board/ge/common/Kconfig rename board/ge/common/{ge_common.c => ge_rtc.c} (100%) rename board/ge/common/{ge_common.h => ge_rtc.h} (100%) create mode 100644 configs/ge_b1x5v2_defconfig create mode 100644 drivers/bootcount/spi-flash.c create mode 100644 drivers/sysreset/poweroff_gpio.c create mode 100644 include/configs/ge_b1x5v2.h -- 2.28.0

5 22