Hi,
Please find the latest report on new defect(s) introduced to ARM-software/arm-trusted-firmware found with Coverity Scan.
3 new defect(s) introduced to ARM-software/arm-trusted-firmware found with Coverity Scan.
New defect(s) Reported-by: Coverity Scan
Showing 3 of 3 defect(s)
** CID 378361: Null pointer dereferences (NULL_RETURNS)
/plat/arm/board/fvp/fvp_bl2_setup.c: 84 in plat_get_next_bl_params()
________________________________________________________________________________________________________
*** CID 378361: Null pointer dereferences (NULL_RETURNS)
/plat/arm/board/fvp/fvp_bl2_setup.c: 84 in plat_get_next_bl_params()
78
79 /* To retrieve actual size of the HW_CONFIG */
80 param_node = get_bl_mem_params_node(HW_CONFIG_ID);
81 assert(param_node != NULL);
82
83 /* Copy HW config from Secure address to NS address */
>>> CID 378361: Null pointer dereferences (NULL_RETURNS)
>>> Dereferencing "hw_config_info", which is known to be "NULL".
84 memcpy((void *)hw_config_info->ns_config_addr,
85 (void *)hw_config_info->config_addr,
86 (size_t)param_node->image_info.image_size);
87
88 /*
89 * Ensure HW-config device tree committed to memory, as there is
** CID 378360: (NULL_RETURNS)
/plat/renesas/rzg/bl2_plat_setup.c: 411 in bl2_plat_handle_post_image_load()
/plat/renesas/rcar/bl2_plat_setup.c: 446 in bl2_plat_handle_post_image_load()
/plat/st/stm32mp1/bl2_plat_setup.c: 466 in bl2_plat_handle_post_image_load()
/plat/renesas/rcar/bl2_plat_setup.c: 465 in bl2_plat_handle_post_image_load()
/plat/renesas/rzg/bl2_plat_setup.c: 407 in bl2_plat_handle_post_image_load()
/plat/st/stm32mp1/bl2_plat_setup.c: 472 in bl2_plat_handle_post_image_load()
/plat/renesas/rcar/bl2_plat_setup.c: 448 in bl2_plat_handle_post_image_load()
/plat/renesas/rcar/bl2_plat_setup.c: 440 in bl2_plat_handle_post_image_load()
/plat/renesas/rzg/bl2_plat_setup.c: 397 in bl2_plat_handle_post_image_load()
/plat/renesas/rzg/bl2_plat_setup.c: 404 in bl2_plat_handle_post_image_load()
/plat/st/stm32mp1/bl2_plat_setup.c: 529 in bl2_plat_handle_post_image_load()
________________________________________________________________________________________________________
*** CID 378360: (NULL_RETURNS)
/plat/renesas/rzg/bl2_plat_setup.c: 411 in bl2_plat_handle_post_image_load()
405 }
406
407 memcpy(¶ms->bl32_ep_info, &bl_mem_params->ep_info,
408 sizeof(entry_point_info_t));
409 break;
410 case BL33_IMAGE_ID:
>>> CID 378360: (NULL_RETURNS)
>>> Dereferencing a pointer that might be "NULL" "&bl_mem_params->ep_info" when calling "memcpy". [Note: The source code implementation of the function has been overridden by a builtin model.]
411 memcpy(¶ms->bl33_ep_info, &bl_mem_params->ep_info,
412 sizeof(entry_point_info_t));
413 break;
414 default:
415 break;
416 }
/plat/renesas/rcar/bl2_plat_setup.c: 446 in bl2_plat_handle_post_image_load()
440 bl_mem_params->image_info.image_base = dest;
441 break;
442 case BL32_IMAGE_ID:
443 ret = rcar_get_dest_addr_from_cert(TRUSTED_OS_FW_CONTENT_CERT_ID,
444 &dest);
445 if (!ret)
>>> CID 378360: (NULL_RETURNS)
>>> Dereferencing "bl_mem_params", which is known to be "NULL".
446 bl_mem_params->image_info.image_base = dest;
447
448 memcpy(¶ms->bl32_ep_info, &bl_mem_params->ep_info,
449 sizeof(entry_point_info_t));
450 break;
451 case BL33_IMAGE_ID:
/plat/st/stm32mp1/bl2_plat_setup.c: 466 in bl2_plat_handle_post_image_load()
460 switch (image_ids[i]) {
461 case BL32_IMAGE_ID:
462 bl_mem_params->ep_info.pc = config_info->config_addr;
463
464 /* In case of OPTEE, initialize address space with tos_fw addr */
465 pager_mem_params = get_bl_mem_params_node(BL32_EXTRA1_IMAGE_ID);
>>> CID 378360: (NULL_RETURNS)
>>> Dereferencing "pager_mem_params", which is known to be "NULL".
466 pager_mem_params->image_info.image_base = config_info->config_addr;
467 pager_mem_params->image_info.image_max_size =
468 config_info->config_max_size;
469
470 /* Init base and size for pager if exist */
471 paged_mem_params = get_bl_mem_params_node(BL32_EXTRA2_IMAGE_ID);
/plat/renesas/rcar/bl2_plat_setup.c: 465 in bl2_plat_handle_post_image_load()
459 } else {
460 /* plain image, copy it in place */
461 memcpy((void *)BL33_BASE, (void *)BL33_COMP_BASE,
462 bl_mem_params->image_info.image_size);
463 }
464 #endif
>>> CID 378360: (NULL_RETURNS)
>>> Dereferencing a pointer that might be "NULL" "&bl_mem_params->ep_info" when calling "memcpy". [Note: The source code implementation of the function has been overridden by a builtin model.]
465 memcpy(¶ms->bl33_ep_info, &bl_mem_params->ep_info,
466 sizeof(entry_point_info_t));
467 break;
468 }
469
470 return 0;
/plat/renesas/rzg/bl2_plat_setup.c: 407 in bl2_plat_handle_post_image_load()
401 ret = rzg_get_dest_addr_from_cert(TRUSTED_OS_FW_CONTENT_CERT_ID,
402 &dest);
403 if (ret == 0U) {
404 bl_mem_params->image_info.image_base = dest;
405 }
406
>>> CID 378360: (NULL_RETURNS)
>>> Dereferencing a pointer that might be "NULL" "&bl_mem_params->ep_info" when calling "memcpy". [Note: The source code implementation of the function has been overridden by a builtin model.]
407 memcpy(¶ms->bl32_ep_info, &bl_mem_params->ep_info,
408 sizeof(entry_point_info_t));
409 break;
410 case BL33_IMAGE_ID:
411 memcpy(¶ms->bl33_ep_info, &bl_mem_params->ep_info,
412 sizeof(entry_point_info_t));
/plat/st/stm32mp1/bl2_plat_setup.c: 472 in bl2_plat_handle_post_image_load()
466 pager_mem_params->image_info.image_base = config_info->config_addr;
467 pager_mem_params->image_info.image_max_size =
468 config_info->config_max_size;
469
470 /* Init base and size for pager if exist */
471 paged_mem_params = get_bl_mem_params_node(BL32_EXTRA2_IMAGE_ID);
>>> CID 378360: (NULL_RETURNS)
>>> Dereferencing "paged_mem_params", which is known to be "NULL".
472 paged_mem_params->image_info.image_base = STM32MP_DDR_BASE +
473 (dt_get_ddr_size() - STM32MP_DDR_S_SIZE -
474 STM32MP_DDR_SHMEM_SIZE);
475 paged_mem_params->image_info.image_max_size = STM32MP_DDR_S_SIZE;
476 break;
477
/plat/renesas/rcar/bl2_plat_setup.c: 448 in bl2_plat_handle_post_image_load()
442 case BL32_IMAGE_ID:
443 ret = rcar_get_dest_addr_from_cert(TRUSTED_OS_FW_CONTENT_CERT_ID,
444 &dest);
445 if (!ret)
446 bl_mem_params->image_info.image_base = dest;
447
>>> CID 378360: (NULL_RETURNS)
>>> Dereferencing a pointer that might be "NULL" "&bl_mem_params->ep_info" when calling "memcpy". [Note: The source code implementation of the function has been overridden by a builtin model.]
448 memcpy(¶ms->bl32_ep_info, &bl_mem_params->ep_info,
449 sizeof(entry_point_info_t));
450 break;
451 case BL33_IMAGE_ID:
452 #if RCAR_GEN3_BL33_GZIP == 1
453 if ((mmio_read_32(BL33_COMP_BASE) & 0xffff) == 0x8b1f) {
/plat/renesas/rcar/bl2_plat_setup.c: 440 in bl2_plat_handle_post_image_load()
434
435 switch (image_id) {
436 case BL31_IMAGE_ID:
437 ret = rcar_get_dest_addr_from_cert(SOC_FW_CONTENT_CERT_ID,
438 &dest);
439 if (!ret)
>>> CID 378360: (NULL_RETURNS)
>>> Dereferencing "bl_mem_params", which is known to be "NULL".
440 bl_mem_params->image_info.image_base = dest;
441 break;
442 case BL32_IMAGE_ID:
443 ret = rcar_get_dest_addr_from_cert(TRUSTED_OS_FW_CONTENT_CERT_ID,
444 &dest);
445 if (!ret)
/plat/renesas/rzg/bl2_plat_setup.c: 397 in bl2_plat_handle_post_image_load()
391
392 switch (image_id) {
393 case BL31_IMAGE_ID:
394 ret = rzg_get_dest_addr_from_cert(SOC_FW_CONTENT_CERT_ID,
395 &dest);
396 if (ret == 0U) {
>>> CID 378360: (NULL_RETURNS)
>>> Dereferencing "bl_mem_params", which is known to be "NULL".
397 bl_mem_params->image_info.image_base = dest;
398 }
399 break;
400 case BL32_IMAGE_ID:
401 ret = rzg_get_dest_addr_from_cert(TRUSTED_OS_FW_CONTENT_CERT_ID,
402 &dest);
/plat/renesas/rzg/bl2_plat_setup.c: 404 in bl2_plat_handle_post_image_load()
398 }
399 break;
400 case BL32_IMAGE_ID:
401 ret = rzg_get_dest_addr_from_cert(TRUSTED_OS_FW_CONTENT_CERT_ID,
402 &dest);
403 if (ret == 0U) {
>>> CID 378360: (NULL_RETURNS)
>>> Dereferencing "bl_mem_params", which is known to be "NULL".
404 bl_mem_params->image_info.image_base = dest;
405 }
406
407 memcpy(¶ms->bl32_ep_info, &bl_mem_params->ep_info,
408 sizeof(entry_point_info_t));
409 break;
/plat/st/stm32mp1/bl2_plat_setup.c: 529 in bl2_plat_handle_post_image_load()
523 bl_mem_params->ep_info.args.arg1 = 0; /* Unused */
524 bl_mem_params->ep_info.args.arg2 = 0; /* No DT supported */
525 } else {
526 #if !STM32MP_USE_STM32IMAGE
527 bl_mem_params->ep_info.pc = bl_mem_params->image_info.image_base;
528 tos_fw_mem_params = get_bl_mem_params_node(TOS_FW_CONFIG_ID);
>>> CID 378360: (NULL_RETURNS)
>>> Dereferencing "tos_fw_mem_params", which is known to be "NULL".
529 bl_mem_params->image_info.image_max_size +=
530 tos_fw_mem_params->image_info.image_max_size;
531 #endif /* !STM32MP_USE_STM32IMAGE */
532 bl_mem_params->ep_info.args.arg0 = 0;
533 }
534 break;
** CID 378359: Null pointer dereferences (NULL_RETURNS)
/plat/st/common/bl2_io_storage.c: 413 in bl2_plat_handle_pre_image_load()
________________________________________________________________________________________________________
*** CID 378359: Null pointer dereferences (NULL_RETURNS)
/plat/st/common/bl2_io_storage.c: 413 in bl2_plat_handle_pre_image_load()
407 image_block_spec.length = entry->length;
408 #endif
409 gpt_init_done = true;
410 } else {
411 bl_mem_params_node_t *bl_mem_params = get_bl_mem_params_node(image_id);
412
>>> CID 378359: Null pointer dereferences (NULL_RETURNS)
>>> Dereferencing "bl_mem_params", which is known to be "NULL".
413 mmc_block_dev_spec.buffer.offset = bl_mem_params->image_info.image_base;
414 mmc_block_dev_spec.buffer.length = bl_mem_params->image_info.image_max_size;
415 }
416
417 break;
418 #endif
________________________________________________________________________________________________________
To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…
TF-A Community,
This is to notify that we are planning to target the Trusted Firmware-A 2.7 release during the fourth week of May 2021 as part of the regular 6 month cadence. This is a little later than originally targeted due to the number of patches still under review from contributors.
The aim is to consolidate all TF-A work since the 2.6 release. As part of this, a release candidate tag will be created and release activities will commence some time during the week ending 20th May 2022 across all TF-A repositories.
Any major enhancement patches still open after that date will not be merged until after the release.
This release will involve the various repositories making up the broader TF-A project including the TF-A mainline, TF-A Tests, Hafnium, TF-A CI Scripts and TF-A CI Jobs.
We will endeavour minimise the disruption on patch merging and complete release activities ASAP after we start.
Thanks
Joanna
This event has been changed.
Title: TF-A Tech Forum
Topic: Feature Detection MechanismPresented by : Jayanth
ChidanandAgenda:Feature detection mechanism is a diagnostic tool to quickly
check and get assured of whether the architectural features enabled by
software match with the given hardware implementation at an early stage of
booting. It aims at mitigating the runtime-exceptions.I will be covering
the implementation work completed so far and the impact ofReferences:TF-A
Mailing List
PostPatchesDocumentation=================================================We
run an open technical forum call for anyone to participate and it is not
restricted to Trusted Firmware project members. It will operate under the
guidance of the TF TSC. Feel free to forward this invite to
colleagues. Invites are via the TF-A mailing list and also published on the
Trusted Firmware website. Details are
here: https://www.trustedfirmware.org/meetings/tf-a-technical-forum/Tr…
Firmware is inviting you to a scheduled Zoom meeting.Join Zoom
Meetinghttps://zoom.us/j/9159704974Meeting ID: 915 970 4974One tap
mobile+16465588656,,9159704974# US (New York)+16699009128,,9159704974# US
(San Jose)Dial by your location +1 646 558
8656 US (New York) +1 669 900
9128 US (San Jose) 877 853 5247 US
Toll-free 888 788 0099 US Toll-freeMeeting ID:
915 970 4974Find your local
number: https://zoom.us/u/ad27hc6t7h (changed)
When: Thu Apr 21, 2022 4pm – 5pm United Kingdom Time
Calendar: tf-a(a)lists.trustedfirmware.org
Who:
(Guest list has been hidden at organizer's request)
Event details:
https://calendar.google.com/calendar/event?action=VIEW&eid=NWlub3Ewdm1tMmk1…
Invitation from Google Calendar: https://calendar.google.com/calendar/
You are receiving this courtesy email at the account
tf-a(a)lists.trustedfirmware.org because you are an attendee of this event.
To stop receiving future updates for this event, decline this event.
Alternatively you can sign up for a Google account at
https://calendar.google.com/calendar/ and control your notification
settings for your entire calendar.
Forwarding this invitation could allow any recipient to send a response to
the organizer and be added to the guest list, or invite others regardless
of their own invitation status, or to modify your RSVP. Learn more at
https://support.google.com/calendar/answer/37135#forwarding
This event has been changed.
Title: TF-A Tech Forum
Topic: Feature Detection MechanismPresented by : Jayanth
ChidanandAgenda:Feature detection mechanism is a diagnostic tool to quickly
check and get assured of whether the architectural features enabled by
software match with the given hardware implementation at an early stage of
booting. It aims at mitigating the runtime-exceptions.I will be covering
the implementation work completed so far and the impact ofReferences:TF-A
Mailing List
PostPatchesDocumentation=================================================We
run an open technical forum call for anyone to participate and it is not
restricted to Trusted Firmware project members. It will operate under the
guidance of the TF TSC. Feel free to forward this invite to
colleagues. Invites are via the TF-A mailing list and also published on the
Trusted Firmware website. Details are
here: https://www.trustedfirmware.org/meetings/tf-a-technical-forum/Tr…
Firmware is inviting you to a scheduled Zoom meeting.Join Zoom
Meetinghttps://zoom.us/j/9159704974Meeting ID: 915 970 4974One tap
mobile+16465588656,,9159704974# US (New York)+16699009128,,9159704974# US
(San Jose)Dial by your location +1 646 558
8656 US (New York) +1 669 900
9128 US (San Jose) 877 853 5247 US
Toll-free 888 788 0099 US Toll-freeMeeting ID:
915 970 4974Find your local
number: https://zoom.us/u/ad27hc6t7h (changed)
When: Thu Apr 21, 2022 4pm – 5pm United Kingdom Time
Calendar: tf-a(a)lists.trustedfirmware.org
Who:
* Bill Fletcher - creator
* marek.bykowski(a)gmail.com
* okash.khawaja(a)gmail.com
* tf-a(a)lists.trustedfirmware.org
Event details:
https://calendar.google.com/calendar/event?action=VIEW&eid=NWlub3Ewdm1tMmk1…
Invitation from Google Calendar: https://calendar.google.com/calendar/
You are receiving this courtesy email at the account
tf-a(a)lists.trustedfirmware.org because you are an attendee of this event.
To stop receiving future updates for this event, decline this event.
Alternatively you can sign up for a Google account at
https://calendar.google.com/calendar/ and control your notification
settings for your entire calendar.
Forwarding this invitation could allow any recipient to send a response to
the organizer and be added to the guest list, or invite others regardless
of their own invitation status, or to modify your RSVP. Learn more at
https://support.google.com/calendar/answer/37135#forwarding
Hi,
I've started to experiment with MTE in OP-TEE at S-EL1. I've compiled
TF-A with CTX_INCLUDE_MTE_REGS and I'm testing this on QEMU. Before
trying to use MTE in OP-TEE I check id_aa64pfr1_el1 and skip MTE
initializations if unavailable.
This works as long as TF-A always is compiled with
CTX_INCLUDE_MTE_REGS if MTE is available. If TF-A is compiled without
CTX_INCLUDE_MTE_REGS OP-TEE will be trapped into EL3 when trying to
access one of the MTE registers. I suppose this is because SCR_EL3.ATA
is 0. Is there a way for OP-TEE to tell if the MTE registers are safe
to access?
Thanks,
Jens
Hi,
I'm working on a hobby project: AARCH64 Hypervisor on Raspberry Pi 4b. I
have a problem with trapping a psci smc. I'll explain everything and what
steps I have followed.
Right now, I'm implementing SMC trapping. I can successfully forward almost
all SMCs except for PSCI_CPU_ON_AARCH64. Linux makes these SMCs to bring
up secondary CPUs during booting. Here's what I'm trying to do:
- trap the PSCI_CPU_ON_AARCH64 SMC,
- preserve the entry_point address in global variable
- replace the entrypoint with my entrypoint and make the smc to tf-a(or
simply forward it.)
- when secondary cpus come online at the given address, where I set
their stack point and then eret the original address.
Secondary cpus won't come online at the given address. Even if I don't
change any arguments of CPU_ON smc and forward it as it is, the secondary
cpus still won't come online. However, without trapping
enabled(HCR_EL2.TSC=0), everything works fine.
I tried to debug inside Trusted Firmware. I know that overall path for
secondary CPU hotplug in is:
CPU released from reset -> (ROM and possibly some other bootloader) ->
bl31/aarch64/bl31_entrypoint.S:bl31_warm_entrypoint() ->
lib/psci/psci_common.c:psci_warmboot_entrypoint() ->
lib/psci/psci_on.c:psci_cpu_on_finish() -> rpi3_pwr_domain_on_finish()
I printed at all these points in Trusted Firmware with and without trapping
enabled. Here's what I found: Nothing gets printed anywhere in that path if
trapping is enabled. However, without trapping enabled, I can print
anywhere even in bl31_entrypoint.S:bl31_warm_entrypoint(). What could be
the problem?
Here's my code:
https://github.com/SikkiLadho/Leo/blob/4f272eff39934058a7f989c91aad82eab810…
--
Mushahid Hussain
Hello,
Are there any immediate plans to add support for Cortex-X1 in TF-A? If
not then I'll be happy to submit CL for it. For start, it will cover a
subset of errata workarounds. Then people can add more as needed. Let
me know what you think.
Thanks,
Okash