March 2022 - U-Boot

[PATCH 0/3] mmc: zynqmp_sdhci: Driver fixes
by Michal Simek 07 Mar '22

07 Mar '22

Hi, we found 3 issues recently with this driver which needs to be fixed. Thanks, Michal Ashok Reddy Soma (3): mmc: zynq_sdhci: Fix timeout issue mmc: zynq_sdhci: Change granularity of timeout to 1us mmc: zynq_sdhci: Enable card detect workaround for ZynqMP drivers/mmc/zynq_sdhci.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) -- 2.35.1

2 4

[PATCH 0/4] xilinx: Fru tool update
by Michal Simek 07 Mar '22

07 Mar '22

Hi, the first 3 patches are fixes in current fru implementation to make sure that code is not working with incorrect data or not waste time. The last patch adds decoder for xilinx multirecord which stores MAC addresses for DUT. Thanks, Michal Ashok Reddy Soma (4): fru: ops: Clear fru table before storing data fru: ops: Return error from checksum if data is all zero's xilinx: common: Optimise updating ethaddr from eeprom fru: ops: Add support to read mac addresses from multirecord board/xilinx/common/board.c | 11 +++++++- board/xilinx/common/fru.h | 21 +++++++++++++++ board/xilinx/common/fru_ops.c | 49 ++++++++++++++++++++++++++++++++++- 3 files changed, 79 insertions(+), 2 deletions(-) -- 2.35.1

2 5

[PATCH] Revert "board: zynqmp: Fix for wrong AMS setting by ROM"
by Michal Simek 07 Mar '22

07 Mar '22

From: T Karthik Reddy <t.karthik.reddy(a)xilinx.com> This reverts commit dfbe492edef421de09617dc26805fc428440924e. Analog bus control register should be programmed in SPL only. This commit 3414712ba8a ("arm64: zynqmp: Writing correct value to ANALOG_BUS") is programming the same. So revert this commit. Signed-off-by: T Karthik Reddy <t.karthik.reddy(a)xilinx.com> Signed-off-by: Michal Simek <michal.simek(a)xilinx.com> --- board/xilinx/zynqmp/zynqmp.c | 6 ------ 1 file changed, 6 deletions(-) diff --git a/board/xilinx/zynqmp/zynqmp.c b/board/xilinx/zynqmp/zynqmp.c index 70b3c81f1284..bc2090941d90 100644 --- a/board/xilinx/zynqmp/zynqmp.c +++ b/board/xilinx/zynqmp/zynqmp.c @@ -399,9 +399,6 @@ static void print_secure_boot(void) status & ZYNQMP_CSU_STATUS_ENCRYPTED ? "" : "not "); } -#define PS_SYSMON_ANALOG_BUS_VAL 0x3210 -#define PS_SYSMON_ANALOG_BUS_REG 0xFFA50914 - int board_init(void) { #if defined(CONFIG_ZYNQMP_FIRMWARE) @@ -429,9 +426,6 @@ int board_init(void) printf("EL Level:\tEL%d\n", current_el()); - /* Bug in ROM sets wrong value in this register */ - writel(PS_SYSMON_ANALOG_BUS_VAL, PS_SYSMON_ANALOG_BUS_REG); - #if CONFIG_IS_ENABLED(FPGA) && defined(CONFIG_FPGA_ZYNQMPPL) zynqmppl.name = zynqmp_get_silicon_idcode_name(); printf("Chip ID:\t%s\n", zynqmppl.name); -- 2.35.1

2 1

[PATCH] dm: pinctrl: Use explicit values for enums
by Michal Simek 07 Mar '22

07 Mar '22

From: Ashok Reddy Soma <ashok.reddy.soma(a)xilinx.com> Based on discussion at https://lore.kernel.org/r/20200318125003.GA2727094@kroah.com we got recommendation to use explicit values for all enums. So, add explicit values to all pinctrl related enums for readability. Signed-off-by: Ashok Reddy Soma <ashok.reddy.soma(a)xilinx.com> Signed-off-by: Michal Simek <michal.simek(a)xilinx.com> --- include/dm/pinctrl.h | 48 ++++++++++++++++++++++---------------------- 1 file changed, 24 insertions(+), 24 deletions(-) diff --git a/include/dm/pinctrl.h b/include/dm/pinctrl.h index 8b869c4fbfb7..0c461e56bb48 100644 --- a/include/dm/pinctrl.h +++ b/include/dm/pinctrl.h @@ -453,30 +453,30 @@ struct pinctrl_ops { * presented using the packed format. */ enum pin_config_param { - PIN_CONFIG_BIAS_BUS_HOLD, - PIN_CONFIG_BIAS_DISABLE, - PIN_CONFIG_BIAS_HIGH_IMPEDANCE, - PIN_CONFIG_BIAS_PULL_DOWN, - PIN_CONFIG_BIAS_PULL_PIN_DEFAULT, - PIN_CONFIG_BIAS_PULL_UP, - PIN_CONFIG_DRIVE_OPEN_DRAIN, - PIN_CONFIG_DRIVE_OPEN_SOURCE, - PIN_CONFIG_DRIVE_PUSH_PULL, - PIN_CONFIG_DRIVE_STRENGTH, - PIN_CONFIG_DRIVE_STRENGTH_UA, - PIN_CONFIG_INPUT_DEBOUNCE, - PIN_CONFIG_INPUT_ENABLE, - PIN_CONFIG_INPUT_SCHMITT, - PIN_CONFIG_INPUT_SCHMITT_ENABLE, - PIN_CONFIG_LOW_POWER_MODE, - PIN_CONFIG_OUTPUT_ENABLE, - PIN_CONFIG_OUTPUT, - PIN_CONFIG_POWER_SOURCE, - PIN_CONFIG_SLEEP_HARDWARE_STATE, - PIN_CONFIG_SLEW_RATE, - PIN_CONFIG_SKEW_DELAY, - PIN_CONFIG_END = 0x7F, - PIN_CONFIG_MAX = 0xFF, + PIN_CONFIG_BIAS_BUS_HOLD = 0, + PIN_CONFIG_BIAS_DISABLE = 1, + PIN_CONFIG_BIAS_HIGH_IMPEDANCE = 2, + PIN_CONFIG_BIAS_PULL_DOWN = 3, + PIN_CONFIG_BIAS_PULL_PIN_DEFAULT = 4, + PIN_CONFIG_BIAS_PULL_UP = 5, + PIN_CONFIG_DRIVE_OPEN_DRAIN = 6, + PIN_CONFIG_DRIVE_OPEN_SOURCE = 7, + PIN_CONFIG_DRIVE_PUSH_PULL = 8, + PIN_CONFIG_DRIVE_STRENGTH = 9, + PIN_CONFIG_DRIVE_STRENGTH_UA = 10, + PIN_CONFIG_INPUT_DEBOUNCE = 11, + PIN_CONFIG_INPUT_ENABLE = 12, + PIN_CONFIG_INPUT_SCHMITT = 13, + PIN_CONFIG_INPUT_SCHMITT_ENABLE = 14, + PIN_CONFIG_LOW_POWER_MODE = 15, + PIN_CONFIG_OUTPUT_ENABLE = 16, + PIN_CONFIG_OUTPUT = 17, + PIN_CONFIG_POWER_SOURCE = 18, + PIN_CONFIG_SLEEP_HARDWARE_STATE = 19, + PIN_CONFIG_SLEW_RATE = 20, + PIN_CONFIG_SKEW_DELAY = 21, + PIN_CONFIG_END = 127, /* 0x7F */ + PIN_CONFIG_MAX = 255, /* 0xFF */ }; #if CONFIG_IS_ENABLED(PINCTRL_GENERIC) -- 2.35.1

3 2

[PATCH] usb: gadget: ci: Make various ops const
by Adam Ford 07 Mar '22

07 Mar '22

ci_udc_ops and ci_ep_ops do not change their operations. Mark them as const. Signed-off-by: Adam Ford <aford173(a)gmail.com> diff --git a/drivers/usb/gadget/ci_udc.c b/drivers/usb/gadget/ci_udc.c index 542684c1c3..d9a89a17b2 100644 --- a/drivers/usb/gadget/ci_udc.c +++ b/drivers/usb/gadget/ci_udc.c @@ -94,11 +94,11 @@ static struct usb_request * ci_ep_alloc_request(struct usb_ep *ep, unsigned int gfp_flags); static void ci_ep_free_request(struct usb_ep *ep, struct usb_request *_req); -static struct usb_gadget_ops ci_udc_ops = { +static const struct usb_gadget_ops ci_udc_ops = { .pullup = ci_pullup, }; -static struct usb_ep_ops ci_ep_ops = { +static const struct usb_ep_ops ci_ep_ops = { .enable = ci_ep_enable, .disable = ci_ep_disable, .queue = ci_ep_queue, -- 2.34.1

2 1

Pull request: u-boot-sunxi/master for v2022.04
by Andre Przywara 06 Mar '22

06 Mar '22

Hi Tom, please pull the master branch from u-boot-sunxi, containing some fixes for 2022.04, for the newly merged F1C100 SoC: ------------------------- - Fix ARMv5/F1C100 FEL booting - Fix F1C100 reset - Introduce proper F1C100 boot method detection - Enable SPI booting for F1C100 ------------------------- Boot tested from FEL, SPI, SD card and eMMC (where applicable) on Pine64-LTS, Pine-H64, BananaPi M1, OrangePi Zero, LicheePi Nano(F1C100). Gitlab CI passed without issues. Thanks, Andre ============== The following changes since commit f64aac4a69007771963eaa52a86e733071f9fdd4: Merge https://source.denx.de/u-boot/custodians/u-boot-usb (2022-03-01 07:48:39 -0500) are available in the Git repository at: https://source.denx.de/u-boot/custodians/u-boot-sunxi.git master for you to fetch changes up to cfcf1952c11e6ffcbbf88eb63c49edca2acf1d5e: sunxi: f1c100s: Drop SYSRESET to enable reset functionality (2022-03-03 01:24:06 +0000) ---------------------------------------------------------------- Andre Przywara (2): sunxi: f1c100s: Fix FEL registers restore sunxi: f1c100s: Drop SYSRESET to enable reset functionality Jesse Taube (3): mach-sunxi: Add boot device detection for SUNIV/F1C100s mach-sunxi: Add SPL SPI boot for SUNIV mach-sunxi: Enable SPI boot for SUNIV and licheepi nano arch/arm/cpu/arm926ejs/sunxi/fel_utils.S | 4 +- arch/arm/include/asm/arch-sunxi/gpio.h | 1 + arch/arm/include/asm/arch-sunxi/spl.h | 9 +++++ arch/arm/mach-sunxi/Kconfig | 2 +- arch/arm/mach-sunxi/board.c | 64 ++++++++++++++++++-------------- arch/arm/mach-sunxi/spl_spi_sunxi.c | 24 ++++++++---- configs/licheepi_nano_defconfig | 2 + 7 files changed, 69 insertions(+), 37 deletions(-)

2 1

[PATCH] sunxi: fix build when CONFIG_UART0_PORT_F is selected
by Icenowy Zheng 06 Mar '22

06 Mar '22

Currently CONFIG_UART0_PORT_F will forbid the build of sunxi-mmc driver, which leads calls to it in board/sunxi/board.c a undefined reference. Guard that code in #ifndef to fix build. Signed-off-by: Icenowy Zheng <icenowy(a)aosc.io> --- board/sunxi/board.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/board/sunxi/board.c b/board/sunxi/board.c index 82c52b28f8..8a003d8559 100644 --- a/board/sunxi/board.c +++ b/board/sunxi/board.c @@ -539,6 +539,7 @@ int board_mmc_init(struct bd_info *bis) { __maybe_unused struct mmc *mmc0, *mmc1; +#ifndef CONFIG_UART0_PORT_F mmc_pinmux_setup(CONFIG_MMC_SUNXI_SLOT); mmc0 = sunxi_mmc_init(CONFIG_MMC_SUNXI_SLOT); if (!mmc0) @@ -549,6 +550,7 @@ int board_mmc_init(struct bd_info *bis) mmc1 = sunxi_mmc_init(CONFIG_MMC_SUNXI_SLOT_EXTRA); if (!mmc1) return -1; +#endif #endif return 0; -- 2.35.1

2 2

[PATCH 00/24] binman: rockchip: Migrate from rockchip SPL_FIT_GENERATOR script
by Simon Glass 06 Mar '22

06 Mar '22

At present rockchip 64-bit boards make use of a FIT-generator script written in Python. The script supports splitting an ELF file into several 'loadable' nodes in the FIT. Binman does not current support this feature. This series adds binman support for ELF splitting. This works by adding a new 'fit,operation' property to the FIT subnodes, allowing this new way of generating nodes. Some other fixes and improvements are needed along the way. A new, common binman description is added for 64-bit boards which includes the required u-boot.itb file. The existing script is removed, so that only a few zynq boards are now using a SPL_FIT_GENERATOR script: avnet_ultrazedev_cc_v1_0_ultrazedev_som_v1_0 xilinx_zynqmp_virt Migration of those is hopefully in progress. Note however that tools/k3_fit_atf.sh remains, used by a few boards that enable CONFIG_TI_SECURE_DEVICE so this series is copied there too: am335x_hs_evm am335x_hs_evm_uart am43xx_hs_evm am57xx_hs_evm am57xx_hs_evm_usb am65x_hs_evm_a53 am65x_hs_evm_r5 dra7xx_hs_evm dra7xx_hs_evm_usb j721e_hs_evm_a72 j721e_hs_evm_r5 k2e_hs_evm k2g_hs_evm k2hk_hs_evm k2l_hs_evm Ivan Mikhaylov has sent a patch to help with these, but I need to take a look at the testing side. In any case they should really be using binman for the image generation. This series also includes some moveconfig improvements that were used to create board lists in this cover letter. Simon Glass (24): moveconfig: Show the config name rather than the defconfig moveconfig: Allow regex matches when finding combinations spl: x86: Correct the binman symbols for SPL spl: Allow disabling binman symbols in SPL rockchip: evb-rk3288: Drop raw-image support dtoc: Support adding a string list to a device tree dtoc: Support deleting a node dtoc: Allow deleting nodes and adding them in the same sync dtoc: Support reading a list of arguments binman: Update docs to indicate mkimage is supported elf: Add a way to read segment information from an ELF file WIP: binman: Add support for OP-TEE binman: Add to the TODO binman: Support a list of strings with the mkimage etype binman: Add a ELF test file with disjoint text sections binman: Move entry-data collection into a Entry method binman: fit: Refactor to reduce function size binman: Tidy up the docs a little with fit binman: Allow different operations in FIT generator nodes binman: Support splitting an ELF file into multiple nodes rockchip: Include binman script in 64-bit boards rockchip: Support building the all output files in binman rockchip: Convert all boards to use binman rockchip: Drop the FIT generator script Makefile | 43 +- arch/arm/dts/px30-u-boot.dtsi | 2 + arch/arm/dts/rk3308-u-boot.dtsi | 2 + arch/arm/dts/rk3326-odroid-go2-u-boot.dtsi | 2 + arch/arm/dts/rk3328-u-boot.dtsi | 2 + arch/arm/dts/rk3368-u-boot.dtsi | 1 + arch/arm/dts/rk3399-u-boot.dtsi | 5 +- arch/arm/dts/rk3568-u-boot.dtsi | 2 + arch/arm/dts/rockchip-u-boot.dtsi | 84 +++- arch/arm/mach-rockchip/Kconfig | 6 + arch/arm/mach-rockchip/make_fit_atf.py | 240 --------- arch/x86/dts/u-boot.dtsi | 2 +- boot/Kconfig | 3 +- common/spl/Kconfig | 24 + common/spl/spl.c | 12 +- configs/evb-rk3288_defconfig | 1 + include/spl.h | 4 +- tools/binman/binman.rst | 98 +++- tools/binman/elf.py | 37 ++ tools/binman/elf_test.py | 31 +- tools/binman/entries.rst | 260 +++++++++- tools/binman/entry.py | 28 ++ tools/binman/etype/fit.py | 490 ++++++++++++++++--- tools/binman/etype/mkimage.py | 27 +- tools/binman/etype/op_tee.py | 23 + tools/binman/ftest.py | 123 +++++ tools/binman/missing-blob-help | 4 + tools/binman/test/220_fit_bad_oper.dts | 27 + tools/binman/test/221_fit_split_elf.dts | 67 +++ tools/binman/test/222_fit_bad_dir.dts | 9 + tools/binman/test/223_fit_bad_dir_config.dts | 9 + tools/binman/test/Makefile | 6 +- tools/binman/test/elf_sections.c | 20 + tools/binman/test/elf_sections.lds | 31 ++ tools/dtoc/fdt.py | 37 ++ tools/dtoc/fdt_util.py | 12 + tools/dtoc/test/dtoc_test_simple.dts | 1 + tools/dtoc/test_fdt.py | 43 ++ tools/moveconfig.py | 39 +- 39 files changed, 1450 insertions(+), 407 deletions(-) delete mode 100755 arch/arm/mach-rockchip/make_fit_atf.py create mode 100644 tools/binman/etype/op_tee.py create mode 100644 tools/binman/test/220_fit_bad_oper.dts create mode 100644 tools/binman/test/221_fit_split_elf.dts create mode 100644 tools/binman/test/222_fit_bad_dir.dts create mode 100644 tools/binman/test/223_fit_bad_dir_config.dts create mode 100644 tools/binman/test/elf_sections.c create mode 100644 tools/binman/test/elf_sections.lds -- 2.35.0.263.gb82422642f-goog

3 68

[scan-admin@coverity.com: New Defects reported by Coverity Scan for Das U-Boot]
by Tom Rini 05 Mar '22

05 Mar '22

So I've updated to the latest tool and that's why there's so many new defects found in old code. ----- Forwarded message from scan-admin(a)coverity.com ----- Date: Sat, 05 Mar 2022 17:28:09 +0000 (UTC) From: scan-admin(a)coverity.com To: tom.rini(a)gmail.com Subject: New Defects reported by Coverity Scan for Das U-Boot Hi, Please find the latest report on new defect(s) introduced to Das U-Boot found with Coverity Scan. 43 new defect(s) introduced to Das U-Boot found with Coverity Scan. 3 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 20 of 43 defect(s) ** CID 350448: Insecure data handling (TAINTED_SCALAR) ________________________________________________________________________________________________________ *** CID 350448: Insecure data handling (TAINTED_SCALAR) /cmd/abootimg.c: 90 in abootimg_get_dtb_load_addr() 84 goto exit; 85 } 86 87 if (argc == 0) 88 printf("%lx\n", (ulong)hdr->dtb_addr); 89 else >>> CID 350448: Insecure data handling (TAINTED_SCALAR) >>> Passing tainted expression "hdr->dtb_addr" to "env_set_hex", which uses it as an offset. 90 env_set_hex(argv[0], (ulong)hdr->dtb_addr); 91 92 exit: 93 unmap_sysmem(hdr); 94 return res; 95 } ** CID 350447: Integer handling issues (OVERFLOW_BEFORE_WIDEN) /drivers/nvme/nvme.c: 772 in nvme_blk_rw() ________________________________________________________________________________________________________ *** CID 350447: Integer handling issues (OVERFLOW_BEFORE_WIDEN) /drivers/nvme/nvme.c: 772 in nvme_blk_rw() 766 c.rw.prp1 = cpu_to_le64(temp_buffer); 767 c.rw.prp2 = cpu_to_le64(prp2); 768 status = nvme_submit_sync_cmd(dev->queues[NVME_IO_Q], 769 &c, NULL, IO_TIMEOUT); 770 if (status) 771 break; >>> CID 350447: Integer handling issues (OVERFLOW_BEFORE_WIDEN) >>> Potentially overflowing expression "(u32)lbas << ns->lba_shift" with type "u32" (32 bits, unsigned) is evaluated using 32-bit arithmetic, and then used in a context that expects an expression of type "u64" (64 bits, unsigned). 772 temp_len -= (u32)lbas << ns->lba_shift; 773 temp_buffer += lbas << ns->lba_shift; 774 } 775 776 if (read) 777 invalidate_dcache_range((unsigned long)buffer, ** CID 350446: (TAINTED_SCALAR) ________________________________________________________________________________________________________ *** CID 350446: (TAINTED_SCALAR) /fs/fat/fat.c: 1016 in fat_itr_next() 1010 } 1011 1012 /* short file name */ 1013 break; 1014 } 1015 >>> CID 350446: (TAINTED_SCALAR) >>> Passing tainted expression "dent->nameext" to "get_name", which uses it as an offset. 1016 get_name(dent, itr->s_name); 1017 if (!itr->name) 1018 itr->name = itr->s_name; 1019 1020 return 1; 1021 } /fs/fat/fat.c: 1016 in fat_itr_next() 1010 } 1011 1012 /* short file name */ 1013 break; 1014 } 1015 >>> CID 350446: (TAINTED_SCALAR) >>> Passing tainted expression "dent->nameext" to "get_name", which uses it as an offset. 1016 get_name(dent, itr->s_name); 1017 if (!itr->name) 1018 itr->name = itr->s_name; 1019 1020 return 1; 1021 } /fs/fat/fat.c: 1016 in fat_itr_next() 1010 } 1011 1012 /* short file name */ 1013 break; 1014 } 1015 >>> CID 350446: (TAINTED_SCALAR) >>> Passing tainted expression "dent->nameext" to "get_name", which uses it as an offset. 1016 get_name(dent, itr->s_name); 1017 if (!itr->name) 1018 itr->name = itr->s_name; 1019 1020 return 1; 1021 } ** CID 350445: (TAINTED_SCALAR) ________________________________________________________________________________________________________ *** CID 350445: (TAINTED_SCALAR) /tools/kwbimage.c: 2452 in kwbimage_extract_subimage() 2446 fprintf(stderr, " -p N - Nth binary header image (totally: %d)\n", 2447 cur_idx - 1); 2448 return -1; 2449 } 2450 } 2451 >>> CID 350445: (TAINTED_SCALAR) >>> Passing tainted expression "size" to "imagetool_save_subimage", which uses it as an offset. 2452 return imagetool_save_subimage(params->outfile, image, size); 2453 } 2454 2455 /* 2456 * Report Error if xflag is set in addition to default 2457 */ /tools/kwbimage.c: 2452 in kwbimage_extract_subimage() 2446 fprintf(stderr, " -p N - Nth binary header image (totally: %d)\n", 2447 cur_idx - 1); 2448 return -1; 2449 } 2450 } 2451 >>> CID 350445: (TAINTED_SCALAR) >>> Passing tainted expression "size" to "imagetool_save_subimage", which uses it as an offset. 2452 return imagetool_save_subimage(params->outfile, image, size); 2453 } 2454 2455 /* 2456 * Report Error if xflag is set in addition to default 2457 */ /tools/kwbimage.c: 2452 in kwbimage_extract_subimage() 2446 fprintf(stderr, " -p N - Nth binary header image (totally: %d)\n", 2447 cur_idx - 1); 2448 return -1; 2449 } 2450 } 2451 >>> CID 350445: (TAINTED_SCALAR) >>> Passing tainted expression "size" to "imagetool_save_subimage", which uses it as an offset. 2452 return imagetool_save_subimage(params->outfile, image, size); 2453 } 2454 2455 /* 2456 * Report Error if xflag is set in addition to default 2457 */ /tools/kwbimage.c: 2452 in kwbimage_extract_subimage() 2446 fprintf(stderr, " -p N - Nth binary header image (totally: %d)\n", 2447 cur_idx - 1); 2448 return -1; 2449 } 2450 } 2451 >>> CID 350445: (TAINTED_SCALAR) >>> Passing tainted expression "size" to "imagetool_save_subimage", which uses it as an offset. 2452 return imagetool_save_subimage(params->outfile, image, size); 2453 } 2454 2455 /* 2456 * Report Error if xflag is set in addition to default 2457 */ ** CID 350444: Insecure data handling (TAINTED_SCALAR) /boot/image-android.c: 354 in android_image_get_dtb_by_index() ________________________________________________________________________________________________________ *** CID 350444: Insecure data handling (TAINTED_SCALAR) /boot/image-android.c: 354 in android_image_get_dtb_by_index() 348 /* Find out the address of DTB with specified index in concat blobs */ 349 hdr = map_sysmem(hdr_addr, sizeof(*hdr)); 350 dtb_img_size = hdr->dtb_size; 351 unmap_sysmem(hdr); 352 i = 0; 353 dtb_addr = dtb_img_addr; >>> CID 350444: Insecure data handling (TAINTED_SCALAR) >>> Using tainted variable "dtb_img_addr + dtb_img_size" as a loop boundary. 354 while (dtb_addr < dtb_img_addr + dtb_img_size) { 355 const struct fdt_header *fdt; 356 u32 dtb_size; 357 358 fdt = map_sysmem(dtb_addr, sizeof(*fdt)); 359 if (fdt_check_header(fdt) != 0) { ** CID 350443: (TAINTED_SCALAR) /drivers/nvme/nvme.c: 862 in nvme_init() ________________________________________________________________________________________________________ *** CID 350443: (TAINTED_SCALAR) /drivers/nvme/nvme.c: 862 in nvme_init() 856 id = memalign(ndev->page_size, sizeof(struct nvme_id_ns)); 857 if (!id) { 858 ret = -ENOMEM; 859 goto free_queue; 860 } 861 >>> CID 350443: (TAINTED_SCALAR) >>> Using tainted variable "ndev->nn" as a loop boundary. 862 for (int i = 1; i <= ndev->nn; i++) { 863 struct udevice *ns_udev; 864 char name[20]; 865 866 memset(id, 0, sizeof(*id)); 867 if (nvme_identify(ndev, i, 0, (dma_addr_t)(long)id)) { /drivers/nvme/nvme.c: 889 in nvme_init() 883 ret = blk_create_devicef(udev, "nvme-blk", name, IF_TYPE_NVME, 884 -1, 512, 0, &ns_udev); 885 if (ret) 886 goto free_id; 887 } 888 >>> CID 350443: (TAINTED_SCALAR) >>> Passing tainted expression "*id" to "dlfree", which uses it as an offset. 889 free(id); 890 return 0; 891 892 free_id: 893 free(id); 894 free_queue: /drivers/nvme/nvme.c: 893 in nvme_init() 887 } 888 889 free(id); 890 return 0; 891 892 free_id: >>> CID 350443: (TAINTED_SCALAR) >>> Passing tainted expression "*id" to "dlfree", which uses it as an offset. 893 free(id); 894 free_queue: 895 free((void *)ndev->queues); 896 free_nvme: 897 return ret; 898 } ** CID 350442: Memory - corruptions (OVERRUN) /env/common.c: 103 in eth_env_set_enetaddr() ________________________________________________________________________________________________________ *** CID 350442: Memory - corruptions (OVERRUN) /env/common.c: 103 in eth_env_set_enetaddr() 97 { 98 char buf[ARP_HLEN_ASCII + 1]; 99 100 if (eth_env_get_enetaddr(name, (uint8_t *)buf)) 101 return -EEXIST; 102 >>> CID 350442: Memory - corruptions (OVERRUN) >>> "sprintf" will overrun its first argument "buf" which can accommodate 18 bytes. The number of bytes written may be 20 bytes, including the terminating null. 103 sprintf(buf, "%pM", enetaddr); 104 105 return env_set(name, buf); 106 } 107 108 /* ** CID 350441: (TAINTED_SCALAR) /tools/ifwitool.c: 1888 in ifwi_dir_extract() ________________________________________________________________________________________________________ *** CID 350441: (TAINTED_SCALAR) /tools/ifwitool.c: 1907 in ifwi_dir_extract() 1901 1902 DEBUG("Splicing buffer at 0x%x size 0x%x\n", s->e[i].offset, 1903 s->e[i].length); 1904 buffer_splice(&dst, &ifwi_image.subpart_buf[type], s->e[i].offset, 1905 s->e[i].length); 1906 >>> CID 350441: (TAINTED_SCALAR) >>> Passing tainted expression "dst.size" to "buffer_write_file", which uses it as an offset. 1907 if (buffer_write_file(&dst, param.file_name)) 1908 return COMMAND_ERR; 1909 1910 printf("Sub-Partition %s(%d), entry(%s) stored in %s.\n", 1911 param.subpart_name, type, param.dentry_name, param.file_name); 1912 /tools/ifwitool.c: 1888 in ifwi_dir_extract() 1882 parse_subpart_dir(&subpart_dir_buff, &ifwi_image.subpart_buf[type], 1883 subparts[type].name); 1884 1885 uint32_t i; 1886 struct subpart_dir *s = buffer_get(&subpart_dir_buff); 1887 >>> CID 350441: (TAINTED_SCALAR) >>> Using tainted variable "s->h.num_entries" as a loop boundary. 1888 for (i = 0; i < s->h.num_entries; i++) { 1889 if (!strncmp((char *)s->e[i].name, param.dentry_name, 1890 sizeof(s->e[i].name))) 1891 break; 1892 } 1893 ** CID 350440: Memory - corruptions (OVERRUN) ________________________________________________________________________________________________________ *** CID 350440: Memory - corruptions (OVERRUN) /drivers/block/ide.c: 615 in ide_ident() 609 #endif 610 611 ide_input_swap_data(device, (ulong *)&iop, ATA_SECTORWORDS); 612 613 ident_cpy((unsigned char *)dev_desc->revision, iop.fw_rev, 614 sizeof(dev_desc->revision)); >>> CID 350440: Memory - corruptions (OVERRUN) >>> Overrunning array "iop.model" of 40 bytes by passing it to a function which accesses it at byte offset 40 using argument "41U". 615 ident_cpy((unsigned char *)dev_desc->vendor, iop.model, 616 sizeof(dev_desc->vendor)); 617 ident_cpy((unsigned char *)dev_desc->product, iop.serial_no, 618 sizeof(dev_desc->product)); 619 620 if ((iop.config & 0x0080) == 0x0080) ** CID 350439: Insecure data handling (TAINTED_SCALAR) ________________________________________________________________________________________________________ *** CID 350439: Insecure data handling (TAINTED_SCALAR) /disk/part_efi.c: 257 in part_print_efi() 251 printf("\ttype:\t%pUl\n", uuid); 252 uuid = (unsigned char *)gpt_pte[i].unique_partition_guid.b; 253 printf("\tguid:\t%pUl\n", uuid); 254 } 255 256 /* Remember to free pte */ >>> CID 350439: Insecure data handling (TAINTED_SCALAR) >>> Passing tainted expression "*gpt_pte" to "dlfree", which uses it as an offset. 257 free(gpt_pte); 258 return; 259 } 260 261 int part_get_info_efi(struct blk_desc *dev_desc, int part, 262 struct disk_partition *info) ** CID 350438: (TAINTED_SCALAR) ________________________________________________________________________________________________________ *** CID 350438: (TAINTED_SCALAR) /disk/part_efi.c: 281 in part_get_info_efi() 275 return -1; 276 277 if (part > le32_to_cpu(gpt_head->num_partition_entries) || 278 !is_pte_valid(&gpt_pte[part - 1])) { 279 debug("%s: *** ERROR: Invalid partition number %d ***\n", 280 __func__, part); >>> CID 350438: (TAINTED_SCALAR) >>> Passing tainted expression "*gpt_pte" to "dlfree", which uses it as an offset. 281 free(gpt_pte); 282 return -1; 283 } 284 285 /* The 'lbaint_t' casting may limit the maximum disk size to 2 TB */ 286 info->start = (lbaint_t)le64_to_cpu(gpt_pte[part - 1].starting_lba); /disk/part_efi.c: 309 in part_get_info_efi() 303 #endif 304 305 debug("%s: start 0x" LBAF ", size 0x" LBAF ", name %s\n", __func__, 306 info->start, info->size, info->name); 307 308 /* Remember to free pte */ >>> CID 350438: (TAINTED_SCALAR) >>> Passing tainted expression "*gpt_pte" to "dlfree", which uses it as an offset. 309 free(gpt_pte); 310 return 0; 311 } 312 313 static int part_test_efi(struct blk_desc *dev_desc) 314 { ** CID 350437: Insecure data handling (TAINTED_SCALAR) ________________________________________________________________________________________________________ *** CID 350437: Insecure data handling (TAINTED_SCALAR) /disk/part_efi.c: 687 in gpt_verify_headers() 681 printf("%s: *** ERROR: Invalid GPT ***\n", 682 __func__); 683 return -1; 684 } 685 686 /* Free pte before allocating again */ >>> CID 350437: Insecure data handling (TAINTED_SCALAR) >>> Passing tainted expression "**gpt_pte" to "dlfree", which uses it as an offset. 687 free(*gpt_pte); 688 689 /* 690 * Check that the alternate_lba entry points to the last LBA 691 */ 692 if (le64_to_cpu(gpt_head->alternate_lba) != (dev_desc->lba - 1)) { ** CID 350436: Insecure data handling (TAINTED_SCALAR) /tools/ifwitool.c: 1456 in bpdt_fixup_write_buffer() ________________________________________________________________________________________________________ *** CID 350436: Insecure data handling (TAINTED_SCALAR) /tools/ifwitool.c: 1456 in bpdt_fixup_write_buffer() 1450 offset = fix_member(&h->ifwi_version, offset, sizeof(h->ifwi_version)); 1451 offset = fix_member(&h->fit_tool_version, offset, 1452 sizeof(h->fit_tool_version)); 1453 1454 uint32_t i; 1455 >>> CID 350436: Insecure data handling (TAINTED_SCALAR) >>> Using tainted variable "count" as a loop boundary. 1456 for (i = 0; i < count; i++) { 1457 offset = fix_member(&e[i].type, offset, sizeof(e[i].type)); 1458 offset = fix_member(&e[i].flags, offset, sizeof(e[i].flags)); 1459 offset = fix_member(&e[i].offset, offset, sizeof(e[i].offset)); 1460 offset = fix_member(&e[i].size, offset, sizeof(e[i].size)); 1461 } ** CID 350435: Insecure data handling (TAINTED_SCALAR) ________________________________________________________________________________________________________ *** CID 350435: Insecure data handling (TAINTED_SCALAR) /cmd/extension_board.c: 56 in extension_apply() 50 51 blob = map_sysmem(overlay_addr, 0); 52 if (!fdt_valid(&blob)) 53 return CMD_RET_FAILURE; 54 55 /* apply method prints messages on error */ >>> CID 350435: Insecure data handling (TAINTED_SCALAR) >>> Passing tainted expression "*blob" to "fdt_overlay_apply_verbose", which uses it as an offset. 56 if (fdt_overlay_apply_verbose(working_fdt, blob)) 57 return CMD_RET_FAILURE; 58 59 return CMD_RET_SUCCESS; 60 } 61 ** CID 350434: Uninitialized variables (UNINIT) ________________________________________________________________________________________________________ *** CID 350434: Uninitialized variables (UNINIT) /lib/efi_loader/efi_device_path_to_text.c: 435 in efi_convert_device_path_to_text() 429 str = efi_convert_single_device_node_to_text( 430 str, device_path); 431 } 432 *(u8 **)&device_path += device_path->length; 433 } 434 >>> CID 350434: Uninitialized variables (UNINIT) >>> Using uninitialized value "*buffer" when calling "efi_str_to_u16". 435 text = efi_str_to_u16(buffer); 436 437 out: 438 EFI_EXIT(EFI_SUCCESS); 439 return text; 440 } ** CID 350433: Memory - corruptions (OVERRUN) ________________________________________________________________________________________________________ *** CID 350433: Memory - corruptions (OVERRUN) /drivers/block/ide.c: 613 in ide_ident() 607 if (retries == 2) /* Not found */ 608 return; 609 #endif 610 611 ide_input_swap_data(device, (ulong *)&iop, ATA_SECTORWORDS); 612 >>> CID 350433: Memory - corruptions (OVERRUN) >>> Overrunning array "iop.fw_rev" of 8 bytes by passing it to a function which accesses it at byte offset 8 using argument "9U". 613 ident_cpy((unsigned char *)dev_desc->revision, iop.fw_rev, 614 sizeof(dev_desc->revision)); 615 ident_cpy((unsigned char *)dev_desc->vendor, iop.model, 616 sizeof(dev_desc->vendor)); 617 ident_cpy((unsigned char *)dev_desc->product, iop.serial_no, 618 sizeof(dev_desc->product)); ** CID 350432: (TAINTED_SCALAR) ________________________________________________________________________________________________________ *** CID 350432: (TAINTED_SCALAR) /cmd/gpt.c: 650 in gpt_verify() 644 /* Check partition layout with provided pattern */ 645 ret = gpt_verify_partitions(blk_dev_desc, partitions, part_count, 646 gpt_head, &gpt_pte); 647 free(str_disk_guid); 648 free(partitions); 649 out: >>> CID 350432: (TAINTED_SCALAR) >>> Passing tainted expression "*gpt_pte" to "dlfree", which uses it as an offset. 650 free(gpt_pte); 651 return ret; 652 } 653 654 /** 655 * gpt_enumerate() - Enumerate partition names into environment variable. /cmd/gpt.c: 650 in gpt_verify() 644 /* Check partition layout with provided pattern */ 645 ret = gpt_verify_partitions(blk_dev_desc, partitions, part_count, 646 gpt_head, &gpt_pte); 647 free(str_disk_guid); 648 free(partitions); 649 out: >>> CID 350432: (TAINTED_SCALAR) >>> Passing tainted expression "*gpt_pte" to "dlfree", which uses it as an offset. 650 free(gpt_pte); 651 return ret; 652 } 653 654 /** 655 * gpt_enumerate() - Enumerate partition names into environment variable. /cmd/gpt.c: 650 in gpt_verify() 644 /* Check partition layout with provided pattern */ 645 ret = gpt_verify_partitions(blk_dev_desc, partitions, part_count, 646 gpt_head, &gpt_pte); 647 free(str_disk_guid); 648 free(partitions); 649 out: >>> CID 350432: (TAINTED_SCALAR) >>> Passing tainted expression "*gpt_pte" to "dlfree", which uses it as an offset. 650 free(gpt_pte); 651 return ret; 652 } 653 654 /** 655 * gpt_enumerate() - Enumerate partition names into environment variable. /cmd/gpt.c: 650 in gpt_verify() 644 /* Check partition layout with provided pattern */ 645 ret = gpt_verify_partitions(blk_dev_desc, partitions, part_count, 646 gpt_head, &gpt_pte); 647 free(str_disk_guid); 648 free(partitions); 649 out: >>> CID 350432: (TAINTED_SCALAR) >>> Passing tainted expression "*gpt_pte" to "dlfree", which uses it as an offset. 650 free(gpt_pte); 651 return ret; 652 } 653 654 /** 655 * gpt_enumerate() - Enumerate partition names into environment variable. ** CID 350431: (TAINTED_SCALAR) ________________________________________________________________________________________________________ *** CID 350431: (TAINTED_SCALAR) /tools/ifwitool.c: 1974 in ifwi_print() 1968 1969 bpdt_print_header(&b->h, "BPDT"); 1970 bpdt_print_entries(&b->e[0], b->h.descriptor_count, "BPDT"); 1971 1972 b = buffer_get(&ifwi_image.subpart_buf[S_BPDT_TYPE]); 1973 bpdt_print_header(&b->h, "S-BPDT"); >>> CID 350431: (TAINTED_SCALAR) >>> Passing tainted expression "b->h.descriptor_count" to "bpdt_print_entries", which uses it as a loop boundary. 1974 bpdt_print_entries(&b->e[0], b->h.descriptor_count, "S-BPDT"); 1975 1976 if (param.dir_ops == 0) { 1977 verbose -= 2; 1978 return NO_ACTION_REQUIRED; 1979 } /tools/ifwitool.c: 1970 in ifwi_print() 1964 { 1965 verbose += 2; 1966 1967 struct bpdt *b = buffer_get(&ifwi_image.bpdt); 1968 1969 bpdt_print_header(&b->h, "BPDT"); >>> CID 350431: (TAINTED_SCALAR) >>> Passing tainted expression "b->h.descriptor_count" to "bpdt_print_entries", which uses it as a loop boundary. 1970 bpdt_print_entries(&b->e[0], b->h.descriptor_count, "BPDT"); 1971 1972 b = buffer_get(&ifwi_image.subpart_buf[S_BPDT_TYPE]); 1973 bpdt_print_header(&b->h, "S-BPDT"); 1974 bpdt_print_entries(&b->e[0], b->h.descriptor_count, "S-BPDT"); 1975 /tools/ifwitool.c: 1989 in ifwi_print() 1983 1984 for (i = 0; i < MAX_SUBPARTS ; i++) { 1985 if (!(subparts[i].attr & CONTAINS_DIR) || 1986 (buffer_size(&ifwi_image.subpart_buf[i]) == 0)) 1987 continue; 1988 >>> CID 350431: (TAINTED_SCALAR) >>> Passing tainted expression "*subpart_dir_buf.data" to "parse_subpart_dir", which uses it as a loop boundary. 1989 parse_subpart_dir(&subpart_dir_buf, &ifwi_image.subpart_buf[i], 1990 subparts[i].name); 1991 buffer_delete(&subpart_dir_buf); 1992 } 1993 1994 verbose -= 2; /tools/ifwitool.c: 1970 in ifwi_print() 1964 { 1965 verbose += 2; 1966 1967 struct bpdt *b = buffer_get(&ifwi_image.bpdt); 1968 1969 bpdt_print_header(&b->h, "BPDT"); >>> CID 350431: (TAINTED_SCALAR) >>> Passing tainted expression "b->e[0].type" to "bpdt_print_entries", which uses it as an offset. 1970 bpdt_print_entries(&b->e[0], b->h.descriptor_count, "BPDT"); 1971 1972 b = buffer_get(&ifwi_image.subpart_buf[S_BPDT_TYPE]); 1973 bpdt_print_header(&b->h, "S-BPDT"); 1974 bpdt_print_entries(&b->e[0], b->h.descriptor_count, "S-BPDT"); 1975 /tools/ifwitool.c: 1974 in ifwi_print() 1968 1969 bpdt_print_header(&b->h, "BPDT"); 1970 bpdt_print_entries(&b->e[0], b->h.descriptor_count, "BPDT"); 1971 1972 b = buffer_get(&ifwi_image.subpart_buf[S_BPDT_TYPE]); 1973 bpdt_print_header(&b->h, "S-BPDT"); >>> CID 350431: (TAINTED_SCALAR) >>> Passing tainted expression "b->e[0].type" to "bpdt_print_entries", which uses it as an offset. 1974 bpdt_print_entries(&b->e[0], b->h.descriptor_count, "S-BPDT"); 1975 1976 if (param.dir_ops == 0) { 1977 verbose -= 2; 1978 return NO_ACTION_REQUIRED; 1979 } ** CID 350430: Insecure data handling (TAINTED_SCALAR) ________________________________________________________________________________________________________ *** CID 350430: Insecure data handling (TAINTED_SCALAR) /disk/part_efi.c: 1072 in alloc_read_gpt_entries() 1066 1067 /* Read GPT Entries from device */ 1068 blk = le64_to_cpu(pgpt_head->partition_entry_lba); 1069 blk_cnt = BLOCK_CNT(count, dev_desc); 1070 if (blk_dread(dev_desc, blk, (lbaint_t)blk_cnt, pte) != blk_cnt) { 1071 printf("*** ERROR: Can't read GPT Entries ***\n"); >>> CID 350430: Insecure data handling (TAINTED_SCALAR) >>> Passing tainted expression "*pte" to "dlfree", which uses it as an offset. 1072 free(pte); 1073 return NULL; 1074 } 1075 return pte; 1076 } 1077 ** CID 350429: Insecure data handling (TAINTED_SCALAR) /tools/ifwitool.c: 1671 in subpart_dir_fixup_write_buffer() ________________________________________________________________________________________________________ *** CID 350429: Insecure data handling (TAINTED_SCALAR) /tools/ifwitool.c: 1671 in subpart_dir_fixup_write_buffer() 1665 sizeof(h->header_length)); 1666 offset = fix_member(&h->checksum, offset, sizeof(h->checksum)); 1667 offset += sizeof(h->name); 1668 1669 uint32_t i; 1670 >>> CID 350429: Insecure data handling (TAINTED_SCALAR) >>> Using tainted variable "count" as a loop boundary. 1671 for (i = 0; i < count; i++) { 1672 offset += sizeof(e[i].name); 1673 offset = fix_member(&e[i].offset, offset, sizeof(e[i].offset)); 1674 offset = fix_member(&e[i].length, offset, sizeof(e[i].length)); 1675 offset = fix_member(&e[i].rsvd, offset, sizeof(e[i].rsvd)); 1676 } ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P… To manage Coverity Scan email notifications for "tom.rini(a)gmail.com", click https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P… ----- End forwarded message ----- -- Tom

1 0

[PATCH] lib: rsa: use actual OpenSSL 1.1.0 EVP MD API
by Yann Droneaud 05 Mar '22

05 Mar '22

Since OpenSSL 1.1.0, EVP_MD_CTX_create() is EVP_MD_CTX_new() EVP_MD_CTX_destroy() is EVP_MD_CTX_free() EVP_MD_CTX_init() is EVP_MD_CTX_reset() As there's no need to reset a newly created EVP_MD_CTX, moreover EVP_DigestSignInit() does the reset, thus call to EVP_MD_CTX_init() can be dropped. As there's no need to reset an EVP_MD_CTX before it's destroyed, as it will be reset by EVP_MD_CTX_free(), call to EVP_MD_CTX_reset() is not needed and can be dropped. Signed-off-by: Yann Droneaud <ydroneaud(a)opteya.com> --- lib/rsa/rsa-sign.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/lib/rsa/rsa-sign.c b/lib/rsa/rsa-sign.c index 3e7b7982890b..b2a21199e485 100644 --- a/lib/rsa/rsa-sign.c +++ b/lib/rsa/rsa-sign.c @@ -383,12 +383,11 @@ static int rsa_sign_with_key(EVP_PKEY *pkey, struct padding_algo *padding_algo, goto err_alloc; } - context = EVP_MD_CTX_create(); + context = EVP_MD_CTX_new(); if (!context) { ret = rsa_err("EVP context creation failed"); goto err_create; } - EVP_MD_CTX_init(context); ckey = EVP_PKEY_CTX_new(pkey, NULL); if (!ckey) { @@ -425,8 +424,7 @@ static int rsa_sign_with_key(EVP_PKEY *pkey, struct padding_algo *padding_algo, goto err_sign; } - EVP_MD_CTX_reset(context); - EVP_MD_CTX_destroy(context); + EVP_MD_CTX_free(context); debug("Got signature: %zu bytes, expected %d\n", size, EVP_PKEY_size(pkey)); *sigp = sig; @@ -435,7 +433,7 @@ static int rsa_sign_with_key(EVP_PKEY *pkey, struct padding_algo *padding_algo, return 0; err_sign: - EVP_MD_CTX_destroy(context); + EVP_MD_CTX_free(context); err_create: free(sig); err_alloc: -- 2.32.0

4 4