Update CI + fix new findings with cppcheck 2.20

.github/workflows/test-configs.yml

@@ -194,19 +194,19 @@ jobs:
       config-file: ./config/examples/nrf54l15-wolfcrypt-tz.config
 
   nxp_p1021_test:
-    uses: ./.github/workflows/test-build.yml
+    uses: ./.github/workflows/test-build-powerpc.yml
     with:
       arch: ppc
       config-file: ./config/examples/nxp-p1021.config
 
   nxp_t1024_test:
-    uses: ./.github/workflows/test-build.yml
+    uses: ./.github/workflows/test-build-powerpc.yml
     with:
       arch: ppc
       config-file: ./config/examples/nxp-t1024.config
 
   nxp_t2080_test:
-    uses: ./.github/workflows/test-build.yml
+    uses: ./.github/workflows/test-build-powerpc.yml
     with:
       arch: ppc
       config-file: ./config/examples/nxp-t2080.config

.github/workflows/test-parse-tools.yml

@@ -11,7 +11,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     container:
-      image: ghcr.io/wolfssl/wolfboot-ci-arm:v0.9.1
+      image: ghcr.io/wolfssl/wolfboot-ci-powerpc:v0.9.2
     timeout-minutes: 15
 
     steps:

Makefile

@@ -661,8 +661,21 @@ image-header-size: wolfboot.bin
 
 cppcheck:
 	cppcheck -f --enable=warning --enable=portability \
+		-Iinclude -I. \
+		-D'XALIGNED(x)=' -D'TZ_SECURE()=0' -D'__has_attribute(x)=0' \
 		--suppress="ctunullpointer" --suppress="nullPointer" \
 		--suppress="objectIndex" --suppress="comparePointers" \
+		--suppress="bufferAccessOutOfBounds" \
+		--suppress="internalAstError" \
+		--suppress="invalidPrintfArgType_s" \
+		--suppress="invalidPrintfArgType_sint" \
+		--suppress="invalidPrintfArgType_uint" \
+		--suppress="invalidTestForOverflow" \
+		--suppress="preprocessorErrorDirective" \
+		--suppress="shiftTooManyBitsSigned" \
+		--suppress="syntaxError" \
+		--suppress="uninitvar" \
+		--suppress="zerodiv" \
 		--check-level=exhaustive \
 		--error-exitcode=89 --std=c89 src/*.c hal/*.c hal/spi/*.c hal/uart/*.c
 

hal/stm32h5.c

@@ -129,14 +129,14 @@ int RAMFUNCTION hal_flash_write(uint32_t address, const uint8_t *data, int len)
 #endif
     while (i < len) {
         uint32_t cur_addr = (uint32_t)dst + i;
-        uint32_t *dst_aligned = (uint32_t *)(cur_addr & ~0xf);
+        uint32_t *dst_aligned = (uint32_t *)(cur_addr & 0xFFFFFFF0U);
         int byte_offset = cur_addr - (uint32_t)dst_aligned;
         int i_aligned = i - byte_offset;
         int j;
         if (byte_offset == 0 && i + 16 <= len) {
             /* Full aligned 128 bits */
             for (j = 0; j < 4; j++) {
-                qword[j] = src[(i >> 2) + j];
+                qword[j] = src[((unsigned int)i >> 2) + j];
             }
         } else {
             /* Non-aligned / non-full 128 bits */

hal/va416x0.c

@@ -425,7 +425,7 @@ static int test_ext_flash(void)
 {
     int ret;
     uint32_t i;
-    uint8_t pageData[WOLFBOOT_SECTOR_SIZE];
+    uint8_t pageData[WOLFBOOT_SECTOR_SIZE] = { 0 };
 
 #ifndef READONLY
     /* Erase sector */

src/boot_x86_fsp.c

@@ -169,12 +169,18 @@ static int range_overlaps(uint32_t start1, uint32_t end1, uint32_t start2,
     return !(end1 <= start2 || end2 <= start1);
 }
 
+static size_t linker_range_size(const void *start, const void *end)
+{
+    return (size_t)((uintptr_t)end - (uintptr_t)start);
+}
+
 static int check_memory_ranges()
 {
     uint32_t wb_start, wb_end;
 
     wb_start = (uint32_t)WOLFBOOT_LOAD_BASE - IMAGE_HEADER_SIZE;
-    wb_end = wb_start + (_wolfboot_flash_end - _wolfboot_flash_start);
+    wb_end = wb_start + (uint32_t)linker_range_size(_wolfboot_flash_start,
+        _wolfboot_flash_end);
     if (range_overlaps(wb_start, wb_end, (uint32_t)_start_data,
                        (uint32_t)_end_data))
         return -1;
@@ -210,11 +216,12 @@ static void load_wolfboot(void)
     }
 
     wolfboot_start = (uint32_t)WOLFBOOT_LOAD_BASE - IMAGE_HEADER_SIZE;
-    wolfboot_size = _wolfboot_flash_end - _wolfboot_flash_start;
+    wolfboot_size = linker_range_size(_wolfboot_flash_start,
+        _wolfboot_flash_end);
     x86_log_memory_load(wolfboot_start, wolfboot_start + wolfboot_size,
                         "wolfboot");
     memcpy((uint8_t*)wolfboot_start,_wolfboot_flash_start, wolfboot_size);
-    bss_size = wb_end_bss - wb_start_bss;
+    bss_size = linker_range_size(wb_start_bss, wb_end_bss);
     x86_log_memory_load((uint32_t)(uintptr_t)wb_start_bss,
                         (uint32_t)(uintptr_t)(wb_start_bss + bss_size),
                         "wolfboot .bss");
@@ -338,7 +345,7 @@ static inline void memory_init_data_bss(void)
     }
     x86_log_memory_load((uint32_t)(uintptr_t)_start_bss,
                           (uint32_t)(uintptr_t)_end_bss, "stage1 .bss");
-    memset(_start_bss, 0, (_end_bss - _start_bss));
+    memset(_start_bss, 0, linker_range_size(_start_bss, _end_bss));
 }
 
 static int pci_get_capability(uint8_t bus, uint8_t dev, uint8_t fun,
@@ -656,7 +663,8 @@ void start(uint32_t stack_base, uint32_t stack_top, uint64_t timestamp,
     stage2_params->tpm_policy = (uint32_t)_start_policy;
 
     stage2_params->tpm_policy_size = *_policy_size_u32;
-    if (stage2_params->tpm_policy_size > _end_policy - _start_policy)
+    if (stage2_params->tpm_policy_size >
+            linker_range_size(_start_policy, _end_policy))
         stage2_params->tpm_policy_size = 0;
     wolfBoot_printf("setting policy @%x (%d bytes)\r\n",
                     (uint32_t)(uintptr_t)stage2_params->tpm_policy,

src/update_ram.c

@@ -167,7 +167,7 @@ void RAMFUNCTION wolfBoot_start(void)
     #endif
 
     #ifdef WOLFBOOT_USE_RAMBOOT
-        load_address = (uint32_t*)(WOLFBOOT_LOAD_ADDRESS -
+        load_address = (uint32_t *)(uintptr_t)(WOLFBOOT_LOAD_ADDRESS -
             IMAGE_HEADER_SIZE);
       #if defined(EXT_ENCRYPTED) && defined(MMU)
         ret = wolfBoot_ram_decrypt((uint8_t*)source_address,