bhnd(4)/bwn(4): Fix a number of small issues reported by Coverity.

- Fix reference of uninitialized error value in bhndb_generic_resume() if
  the dynamic window count is 0.

- Fix incorrect bhnd_pmu(4) UPTME_MASK and PLL0_PC2_WILD_INT_MASK
  constants.

- Variable definitions referenced by our generated SPROM layouts will never
  be NULL, but add explicit asserts to make that clear.

- Add missing variable initialization in bhnd_nvram_sprom_ident().

- Fix leak of driver array in bhnd_erom_probe_driver_classes().

- Fix zero-length memset() in bhndb_pci_eio_init().

- Fix an off-by-one error and potential invalid OOBSEL bit shift operation
  in bcma_dinfo_init_intrs().

- Remove dead code in siba_suspend_hw().

- Fix duplicate call to bhnd_pmu_enable_regulator() in both the enable and
  disable code paths of bhnd_compat_cc_pmu_set_ldoparef().

Reported by:	Coverity
CIDs:		1355194, 1362020, 1362022, 1373114, 1366563, 1373115,
		1381569, 1381579, 1383555, 1383566, 1383571
Sponsored by:	The FreeBSD Foundation

8 files changed, 10 insertions, 7 deletions

diff --git a/sys/dev/bhnd/bcma/bcma_dmp.h b/sys/dev/bhnd/bcma/bcma_dmp.h
index 01bcbe68f3ba..88466969d017 100644
--- a/sys/dev/bhnd/bcma/bcma_dmp.h
+++ b/sys/dev/bhnd/bcma/bcma_dmp.h
@@ -223,7 +223,7 @@
 /* OOBSEL(IN|OUT) */
 #define	BCMA_DMP_OOBSEL_MASK		0xFF		/**< OOB selector mask */
 #define	BCMA_DMP_OOBSEL_EN		(1<<7)		/**< OOB selector enable bit */
-#define	BCMA_DMP_OOBSEL_SHIFT(_sel)	((_sel % BCMA_OOB_NUM_SEL) * 8)
+#define	BCMA_DMP_OOBSEL_SHIFT(_sel)	((_sel % 4) * 8)
 #define	BCMA_DMP_OOBSEL_BUSLINE_MASK	0x7F		/**< OOB selector bus line mask */
 #define	BCMA_DMP_OOBSEL_BUSLINE_SHIFT	0
 
diff --git a/sys/dev/bhnd/bcma/bcma_subr.c b/sys/dev/bhnd/bcma/bcma_subr.c
index 5ebceb85073e..5a4ff2c65567 100644
--- a/sys/dev/bhnd/bcma/bcma_subr.c
+++ b/sys/dev/bhnd/bcma/bcma_subr.c
@@ -282,7 +282,7 @@ bcma_dinfo_init_intrs(device_t bus, device_t child,
 	/* Fetch width of the OOB interrupt bank */
 	oobw = bhnd_bus_read_4(dinfo->res_agent,
 	     BCMA_DMP_OOB_OUTWIDTH(BCMA_OOB_BANK_INTR));
-	if (oobw > BCMA_OOB_NUM_SEL) {
+	if (oobw >= BCMA_OOB_NUM_SEL) {
 		device_printf(bus, "ignoring invalid OOBOUTWIDTH for core %u: "
 		    "%#x\n", BCMA_DINFO_COREIDX(dinfo), oobw);
 		return (0);
diff --git a/sys/dev/bhnd/bhnd_erom.c b/sys/dev/bhnd/bhnd_erom.c
index 2f55fb5554c0..9eb072cd29df 100644
--- a/sys/dev/bhnd/bhnd_erom.c
+++ b/sys/dev/bhnd/bhnd_erom.c
@@ -145,6 +145,7 @@ bhnd_erom_probe_driver_classes(devclass_t bus_devclass,
 			break;
 	}
 
+	free(drivers, M_TEMP);
 	return (erom_cls);
 }
 
diff --git a/sys/dev/bhnd/bhndb/bhndb.c b/sys/dev/bhnd/bhndb/bhndb.c
index 51849d1aa0ed..c477193a4d46 100644
--- a/sys/dev/bhnd/bhndb/bhndb.c
+++ b/sys/dev/bhnd/bhndb/bhndb.c
@@ -687,6 +687,7 @@ bhndb_generic_resume(device_t dev)
 	/* Guarantee that all in-use dynamic register windows are mapped to
 	 * their previously configured target address. */
 	BHNDB_LOCK(sc);
+	error = 0;
 	for (size_t i = 0; i < bus_res->dwa_count; i++) {
 		dwa = &bus_res->dw_alloc[i];
 	
diff --git a/sys/dev/bhnd/bhndb/bhndb_pci.c b/sys/dev/bhnd/bhndb/bhndb_pci.c
index 31f28980abad..e928d903be25 100644
--- a/sys/dev/bhnd/bhndb/bhndb_pci.c
+++ b/sys/dev/bhnd/bhndb/bhndb_pci.c
@@ -1297,7 +1297,7 @@ static int
 bhndb_pci_eio_init(struct bhndb_pci_eio *pio, device_t dev, device_t pci_dev,
     struct bhndb_host_resources *hr)
 {
-	memset(&pio->eio, sizeof(pio->eio), 0);
+	memset(&pio->eio, 0, sizeof(pio->eio));
 	pio->eio.map = bhndb_pci_eio_map;
 	pio->eio.read = bhndb_pci_eio_read;
 	pio->eio.fini = NULL;
diff --git a/sys/dev/bhnd/cores/pmu/bhnd_pmureg.h b/sys/dev/bhnd/cores/pmu/bhnd_pmureg.h
index 6b88d3000447..0146a2539789 100644
--- a/sys/dev/bhnd/cores/pmu/bhnd_pmureg.h
+++ b/sys/dev/bhnd/cores/pmu/bhnd_pmureg.h
@@ -133,7 +133,7 @@
 #define	BHND_PMU_RES_TABLE_SEL		0x620
 #define	BHND_PMU_RES_DEP_MASK		0x624
 #define	BHND_PMU_RES_UPDN_TIMER		0x628
-#define	  BHND_PMU_RES_UPDN_UPTME_MASK	0xFF
+#define	  BHND_PMU_RES_UPDN_UPTME_MASK	0xFF00
 #define	  BHND_PMU_RES_UPDN_UPTME_SHIFT	8
 #define	BHND_PMU_RES_TIMER		0x62C
 #define	BHND_PMU_CLKSTRETCH		0x630
@@ -217,7 +217,7 @@
 
 /* Wildcard base, vco_calvar, vco_swc, vco_var_selref, vso_ical & vco_sel_avdd */
 #define	BHND_PMU0_PLL0_PLLCTL2		2
-#define	BHND_PMU0_PLL0_PC2_WILD_INT_MASK	0xf
+#define	BHND_PMU0_PLL0_PC2_WILD_INT_MASK	0xf0
 #define	BHND_PMU0_PLL0_PC2_WILD_INT_SHIFT	4
 
 /* pllcontrol registers */
diff --git a/sys/dev/bhnd/nvram/bhnd_nvram_data_sprom.c b/sys/dev/bhnd/nvram/bhnd_nvram_data_sprom.c
index 480e507cbaf3..b046bb674438 100644
--- a/sys/dev/bhnd/nvram/bhnd_nvram_data_sprom.c
+++ b/sys/dev/bhnd/nvram/bhnd_nvram_data_sprom.c
@@ -190,6 +190,7 @@ bhnd_nvram_sprom_ident(struct bhnd_nvram_io *io,
 		bool			 have_magic;
 
 		layout = &bhnd_sprom_layouts[i];
+		crc_valid = true;
 
 		have_magic = true;
 		if ((layout->flags & SPROM_LAYOUT_MAGIC_NONE))
@@ -831,6 +832,7 @@ bhnd_nvram_sprom_next(struct bhnd_nvram_data *nv, void **cookiep)
 		/* Update cookiep and fetch variable definition */
 		*cookiep = entry;
 		var = SPROM_COOKIE_TO_NVRAM_VAR(*cookiep);
+		BHND_NV_ASSERT(var != NULL, ("invalid cookiep %p", cookiep));
 
 		/* We might need to parse the variable's value to determine
 		 * whether it should be treated as unset */
@@ -1439,6 +1441,7 @@ bhnd_nvram_sprom_filter_unsetvar(struct bhnd_nvram_data *nv, const char *name)
 		return (ENOENT);
 
 	var = bhnd_nvram_get_vardefn(entry->vid);
+	BHND_NV_ASSERT(var != NULL, ("missing variable definition"));
 
 	/* Variable must be capable of representing a NULL/deleted value.
 	 * 
diff --git a/sys/dev/bhnd/siba/siba.c b/sys/dev/bhnd/siba/siba.c
index a7ac85c9ce88..1f6e4cecddc1 100644
--- a/sys/dev/bhnd/siba/siba.c
+++ b/sys/dev/bhnd/siba/siba.c
@@ -865,8 +865,6 @@ siba_suspend_hw(device_t dev, device_t child, uint16_t ioctl)
 
 	siba_write_target_state(child, dinfo, SIBA_CFG0_TMSTATELOW, ts_low,
 	    ts_mask);
-	if (error)
-		return (error);
 
 	/* Give RESET ample time */
 	DELAY(10);