[PATCH v2 2/3] bootcount: Fix potential clobbering issue

niko.mauno at vaisala.com niko.mauno at vaisala.com
Wed Feb 4 14:17:36 CET 2026


From: Niko Mauno <niko.mauno at vaisala.com>

When storing the single word bootcount value, apply the bootcount count
mask to prevent clobbering the magic half of the value.

Signed-off-by: Niko Mauno <niko.mauno at vaisala.com>
---
 drivers/bootcount/bootcount.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/bootcount/bootcount.c b/drivers/bootcount/bootcount.c
index 454e50591df..2c0114d9705 100644
--- a/drivers/bootcount/bootcount.c
+++ b/drivers/bootcount/bootcount.c
@@ -19,7 +19,8 @@ __weak void bootcount_store(ulong a)
 	uintptr_t flush_end;
 
 #if defined(CONFIG_SYS_BOOTCOUNT_SINGLEWORD)
-	raw_bootcount_store(reg, (CONFIG_SYS_BOOTCOUNT_MAGIC & BOOTCOUNT_MAGIC_MASK) | a);
+	raw_bootcount_store(reg, (CONFIG_SYS_BOOTCOUNT_MAGIC & BOOTCOUNT_MAGIC_MASK)
+		| (a & BOOTCOUNT_COUNT_MASK));
 
 	flush_end = roundup(CONFIG_SYS_BOOTCOUNT_ADDR + 4,
 			    CONFIG_SYS_CACHELINE_SIZE);
@@ -98,7 +99,8 @@ static int bootcount_mem_set(struct udevice *dev, const u32 a)
 	uintptr_t flush_end;
 
 	if (priv->singleword) {
-		raw_bootcount_store(reg, (magic & BOOTCOUNT_MAGIC_MASK) | a);
+		raw_bootcount_store(reg, (magic & BOOTCOUNT_MAGIC_MASK)
+			| (a & BOOTCOUNT_COUNT_MASK));
 		flush_end = roundup(priv->base + 4,
 				    CONFIG_SYS_CACHELINE_SIZE);
 	} else {
-- 
2.47.3



More information about the U-Boot mailing list