April 2015 - coreboot - mail.coreboot.org

Lenovo T410 Coreboot
by A. Veek Dec. 14, 2018

Dec. 14, 2018

2 1

Re: [coreboot] No VGA output on e350m1 after flashing. what to do?
by Reiner Luett Sept. 12, 2017

Sept. 12, 2017

Hi! On 30.06.2013 19:28, Christian Weinz wrote: > Maybe I didn't include the VGA option in the make menuconfig process. > How can I solve this problem? You need to add the VGA Option ROM (VGA BIOS -> Add VGA BIOS image). I've extracted it from the UEFI, but you also could use these: http://www.coreboot.org/index.php?title=ASRock_E350M1&oldid=11114 at the end of the page or you also may be able to use the default AMD fam14 (Persimmon) vbios. You will need to agree to the click through: http://wwwd.amd.com/support/vbioslic.nsf/userverify?openform http://www.coreboot.org/AMD_DB-FT1_PERSIMMON It's a pity, that bios_extract didn't work for now. You could use the AMI Aptio EFI MMTool with wine: http://win-lite.de/benutzer/fernando/BIOS-Tools/AMI_Aptio_EFI_MMTool_v4.50.… You need to extract OntarioEFIVbios with PCI ID 1002,9802 as Option ROM. Regards, Reiner --

5 6

Re: [coreboot] On Intel Boot Guard
by Alexander Couzens April 15, 2016

April 15, 2016

Hi Iru, we aren't still sure which boards use Intel Boot Guard and which doesn't use it. But we expect most board use it, because it's "recommended" by intel - as we dont recommend it. Also there isn't yet a test script for Intel Boot Guard. Can you post a link to that forum post? I would like to look into a x240 flash image. If you have such board it would be nice if you can send me a copy of the flash image via private mail. Cheers, lynxis -- Alexander Couzens mail: lynxis(a)fe80.eu jabber: lynxis(a)jabber.ccc.de mobile: +4915123277221

2 2

coreboot ported to the ASUS KGPE-D16 (Libreboot: blobless, fully functional!)
by Timothy Pearson Oct. 17, 2015

Oct. 17, 2015

All, I have successfully ported coreboot to the relatively modern ASUS KGPE-D16 server board (dual AMD socket G34, 16 DDR3 DIMMs, https://www.asus.com/us/Commercial_Servers_Workstations/KGPED16/) This port uses native Family 10h initialization (_not_ AGESA or CIMX). The Libreboot folks will be interested to know that this board can run blob-free and still retain full functionality! Port specifications: CPU: Dual AMD G34 Magny-Cours (Family 10h) RAM: 16 DDR3 DIMM slots with ECC support (tested with x4 4G DDR3-1333 unbuffered DIMMs) Peripherals: PCIe slots: all functional PCI slot: functional RS-232: functional PS/2: expected to function, not tested (on SuperIO) ASpeed VGA device: functional (text mode, see below) IEEE1394: functional On-board USB: functional On-board NICs: functional ASUS PIKE SAS controller: functional PCIe ROMs: functional Power management: DDR3 voltage set: functional ACPI/APIC: functional Suspend/resume: broken Other: cbmem console: partial support (log truncated) cbmem timestamps: functional nvram: functional BIOS recovery jumper: functional ASpeed VGA: The ASpeed VGA device initialises in text mode via its (new) coreboot driver, however this initialisation is incomplete, leading to distorted but quite usable VGA output. When Linux boots and engages the graphical framebuffer all distortion disappears. This port was not trivial. Almost every device used was broken and required debugging/repair, with the notable exception of the SuperIO chip. The AMD DDR3 controller was severely broken to the point where large rewrites were needed in order to bring it in line with the BKDG. Even after the various component drivers were repaired Due to the labor-intensive nature of the port and the extensive changes throughout the entire source tree, it is not economically feasible to merge this port upstream at this time (I estimate upward of 30 independent patches would be required just to get the board booting!). Raptor Engineering will, however, be continuing to maintain this port internally, and I am currently looking into adding native Family 15h support on top of this internal tree. Additionally, while it was not a priority for the initial port, I will be attempting to enable suspend/resume functionality as I have time. If there is sufficient interest from the community in adding this board to coreboot I would consider merging the changes in exchange for a one-time contract payment in the vicinity of $35,000 USD. When considering this offer please bear in mind that this is a fully functional blobless board with a wide range of peripherals and expansion options available, and that once these large changes are merged I will continue to enhance coreboot functionality as before (e.g. with the KFSN4-DRE and the T400). I would also be willing to add this board to the test stand as the only fully supported 4-way Opteron board (socket G34 Magny-Cours CPUs contain two separate CPUs in one package, making this 2-socket board a 4-way system from a HyperTransport perspective). Please let me know if you have any questions! -- Timothy Pearson Raptor Engineering +1 (415) 727-8645 http://www.raptorengineeringinc.com

6 10

[Mohon Peak] Memtest86+
by Patrick Agrain Aug. 18, 2015

Aug. 18, 2015

Hello, I try to perform some memory test on the Mohon Peak CRB with memtest86+. I downloaded memtest86+ v5.01 and compile it. So far, so good. Following the thread: http://www.coreboot.org/pipermail/coreboot/2015-January/079143.html concerning this topic, I modified the given values, so that now: [root@localhost memtest86+-5.01]# readelf -e memtest1modified ELF Header: Magic: 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00 Class: ELF32 Data: 2's complement, little endian Version: 1 (current) OS/ABI: UNIX - System V ABI Version: 0 Type: EXEC (Executable file) Machine: Intel 80386 Version: 0x1 Entry point address: 0x10000 Start of program headers: 52 (bytes into file) Start of section headers: 151580 (bytes into file) Flags: 0x0 Size of this header: 52 (bytes) Size of program headers: 32 (bytes) Number of program headers: 1 Size of section headers: 40 (bytes) Number of section headers: 3 Section header string table index: 2 Section Headers: [Nr] Name Type Addr Off Size ES Flg Lk Inf Al [ 0] NULL 00000000 000000 000000 00 0 0 0 [ 1] .data PROGBITS 00010000 001000 024008 00 WA 0 0 1 [ 2] .shstrtab STRTAB 00000000 025008 000011 00 0 0 1 Key to Flags: W (write), A (alloc), X (execute), M (merge), S (strings) I (info), L (link order), G (group), x (unknown) O (extra OS processing required) o (OS specific), p (processor specific) Program Headers: Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align LOAD 0x010000 0x00010000 0x00010000 0x24008 0x24008 RW 0x200000 Section to Segment mapping: Segment Sections... 00 .shstrtab [root@localhost memtest86+-5.01]# What gives the same scheme as in the previously mentionned thread. Now the logs of the booting Mohon Peak (from begin of Seabios): SeaBIOS (version rel-1.8.0-12-ga1ac886-dirty-20150402_003540-localhost.localdomain) init usb EHCI init on dev 00:16.0 (regs=0xdfe89420) set_address 0x7fd41b80 config_usb: 0x7fd41a50 device rev=0200 cls=09 sub=00 proto=01 size=64 init serial Found 2 legacy serial ports init hard drives init ahci AHCI controller at 17.0, iobase dfe88000, irq 15 AHCI: cap 0xc720ff03, ports_impl 0x0 AHCI controller at 18.0, iobase dfe88800, irq 0 AHCI: cap 0xc3309f01, ports_impl 0x1 AHCI/0: probing AHCI/0: link up AHCI/0: ... finished, status 0x51, ERROR 0x4 Searching bootorder for: /pci@i0cf8/*@18/drive@0/disk@0 AHCI/0: registering: "AHCI/0: ST500DM002-1BD142 ATA-8 Hard-Disk (465 GiBytes)" Registering bootable: AHCI/0: ST500DM002-1BD142 ATA-8 Hard-Disk (465 GiBytes) (type:2 prio:103 data:f3ef0) Searching bootorder for: /rom@img/Memtest86+ Registering bootable: Payload [Memtest86+] (type:32 prio:9999 data:ffe23240) Scan for option roms Attempting to init PCI bdf 00:00.0 (vd 8086:1f08) Attempting to init PCI bdf 00:01.0 (vd 8086:1f10) Attempting to init PCI bdf 00:03.0 (vd 8086:1f12) Attempting to init PCI bdf 00:0e.0 (vd 8086:1f14) Attempting to init PCI bdf 00:0f.0 (vd 8086:1f16) Attempting to init PCI bdf 00:13.0 (vd 8086:1f15) Attempting to init PCI bdf 00:14.0 (vd 8086:1f41) Attempting to init PCI bdf 00:14.1 (vd 8086:1f41) Attempting to init PCI bdf 00:16.0 (vd 8086:1f2c) Attempting to init PCI bdf 00:17.0 (vd 8086:1f22) Attempting to init PCI bdf 00:18.0 (vd 8086:1f32) Attempting to init PCI bdf 00:1f.0 (vd 8086:1f38) Attempting to init PCI bdf 00:1f.3 (vd 8086:1f3c) Attempting to init PCI bdf 01:00.0 (vd 1415:c158) Attempting to init PCI bdf 02:00.0 (vd 10b5:8624) Attempting to init PCI bdf 03:04.0 (vd 10b5:8624) Attempting to init PCI bdf 03:05.0 (vd 10b5:8624) Attempting to init PCI bdf 03:08.0 (vd 10b5:8624) Attempting to init PCI bdf 05:00.0 (vd 8086:1528) Attempting to init PCI bdf 05:00.1 (vd 8086:1528) Press ESC for boot menu. Select boot device: 1. AHCI/0: ST500DM002-1BD142 ATA-8 Hard-Disk (465 GiBytes) 2. Payload [Memtest86+] Searching bootorder for: HALT Mapping hd drive 0x000f3ef0 to 0 drive 0x000f3ef0: PCHS=16383/16/63 translation=lba LCHS=1024/255/63 s=976773168 finalize PMM malloc finalize Space available for UMB: c1000-ee800, f0000-f3ef0 Returned 258048 bytes of ZoneHigh e820 map has 8 items: 0: 0000000000000000 - 000000000009f800 = 1 RAM 1: 000000000009f800 - 00000000000a0000 = 2 RESERVED 2: 00000000000f0000 - 0000000000100000 = 2 RESERVED 3: 0000000000100000 - 000000007fd89000 = 1 RAM 4: 000000007fd89000 - 000000007fe00000 = 2 RESERVED 5: 00000000e0000000 - 00000000f0000000 = 2 RESERVED 6: 00000000fee00000 - 00000000fee01000 = 2 RESERVED 7: 0000000100000000 - 0000000180000000 = 1 RAM Jump to int19 enter handle_19: NULL Booting from CBFS... Run img/Memtest86+ Segment 464c457f 16777216@0xffe23268 -> 256@0x02000300 No support for compression type 10101 enter handle_18: NULL Booting from 0000:7c00 GRUB Loading stage2. Output on the SERIAL line.. enter handle_12: a=00000000 b=00000000 c=00000000 d=00000080 ds=0000 es=0000 ss=0000 si=0000811e di=00028da8 bp=00001ff0 sp=00001ff4 cs=0000 ip=8a82 f=0297 no switch back. GRUB version 0.5.96 (638K lower / 2093604K upper memory) +-------------------------------------------------------------------------+ | Boot GNU/Linux [ll-ttyS1-115K2] | | Boot GNU/Linux [xx-ttyS1-115K2] | | Boot GNU/Linux [xx-ttyS1-115K2] | | Boot GNU/Linux [default] | | Install GRUB into the hard disk | | | | | | | | | | | | | | | +-------------------------------------------------------------------------+ Use the ^ and v keys to select which entry is highlighted. Press enter to boot the selected OS, 'e' to edit the commands before booting, or 'c' for a command-line. After pressing 'ESC' and select '2', I'm not able to boot memtest86+, and fall back to the hard drive. Has anyone already faced this behavior. Thanks in advance. Best regards, Patrick Agrain

1 1

build failure on amd64 host:- help
by sibu May 1, 2015

May 1, 2015

Greetings, I am new to this list. I am trying to learn how to compile coreboot. My host has these: ---cpu: AMD64 3 cores ---OS: linux (BLFS) linux-3.10.32, ( pure 64-bit ), gcc-4.8.1. IASL ( downloaded as tbb41_201305160ss ) A ) I fetched coreboot fron the git repository B ) I unpacked the downloaded in /usr/src C ) I ran 'make menuconfig' and selected 'build with any toolchain' D ) I then ran 'make' which ended as follows:- ###################### mv build/coreboot.pre1.tmp build/coreboot.pre1 LINK cbfs/fallback/romstage_null.debug ld.bfd -b elf32-i386 -melf_i386 --gc-sections -nostdlib -nostartfiles -static -o build/cbfs/fallback/romstage_null.debug -Lbuild --wrap __divdi3 --wrap __udivdi3 --wrap __moddi3 --wrap __umoddi3 --start-group build/generated/crt0.romstage.o build/mainboard/emulation/qemu- i440fx/static.romstage.o build/arch/x86/boot/boot.romstage.o build/arch/x86/boot/cbmem.romstage.o build/arch/x86/lib/cbfs_and_run.romstage.o build/arch/x86/lib/memcpy.romstage.o build/arch/x86/lib/memmove.romstage.o build/arch/x86/lib/memset.romstage.o build/arch/x86/lib/rom_media.romstage.o build/console/console.romstage.o build/console/die.romstage.o build/console/init.romstage.o build/console/post.romstage.o build/console/printk.romstage.o build/console/vtxprintf.romstage.o build/cpu/x86/car.romstage.o build/cpu/x86/lapic/boot_cpu.romstage.o build/device/device_romstage.romstage.o build/device/pci_early.romstage.o build/drivers/emulation/qemu/qemu_debugcon.romstage.o build/drivers/pc80/mc146818rtc.romstage.o build/drivers/pc80/mc146818rtc_early.romstage.o build/drivers/uart/uart8250io.romstage.o build/drivers/uart/util.romstage.o build/lib/bootmode.romstage.o build/lib/cbfs.romstage.o build/lib/cbfs_core.romstage.o build/lib/cbmem_common.romstage.o build/lib/cbmem_console.romstage.o build/lib/clog2.romstage.o build/lib/compute_ip_checksum.romstage.o build/lib/dynamic_cbmem.romstage.o build/lib/gcc.romstage.o build/lib/halt.romstage.o build/lib/hexdump.romstage.o build/lib/loaders/cbfs_ramstage_loader.romstage.o build/lib/loaders/load_and_run_ramstage.romstage.o build/lib/lzma.romstage.o build/lib/lzmadecode.romstage.o build/lib/memchr.romstage.o build/lib/memcmp.romstage.o build/lib/prog_ops.romstage.o build/lib/ramtest.romstage.o build/lib/version.romstage.o build/southbridge/intel/i82371eb/early_pm.romstage.o build/southbridge/intel/i82371eb/early_smbus.romstage.o /usr/lib/gcc/x86_64- unknown-linux-gnu/4.8.1/libgcc.a --end-group -T build/generated/romstage_null.ld build/lib/gcc.romstage.o: In function `__wrap___udivdi3': /usr/src/coreboot_GIT170415/src/lib/gcc.c:37: undefined reference to `__udivdi3' build/lib/gcc.romstage.o: In function `__wrap___umoddi3': /usr/src/coreboot_GIT170415/src/lib/gcc.c:39: undefined reference to `__umoddi3' make: *** [build/cbfs/fallback/romstage_null.debug] Error 1 rm build/cbfs/fallback/bootblock.elf ######### I am running on a pure 64-bit host but it seems coreboot is attempting to link 32-bit binaries. Help to successfuly build coreboot will be appreciated. Yours sincerely Sibu

3 2

ASUS KFSN4-DRE Automated Test Failure
by Raptor Engineering Automated Test Stand April 28, 2015

April 28, 2015

The ASUS KFSN4-DRE fails verification as of commit 595e7777e7282249b13c3d7f8a45178e76798690 The following tests failed: BOOT_FAILURE Commits since last successful test: 595e777 Kconfig whitespace fixes See attached boot log for details This message was automatically generated from Raptor Engineering's ASUS KFSN4-DRE test stand Raptor Engineering offers coreboot consulting services! Please visit https://www.raptorengineeringinc.com for more information Please contact Timothy Pearson at Raptor Engineering <tpearson(a)raptorengineeringinc.com> regarding any issues stemming from this notification

2 1

error building coreboot
by chp＠posteo.de April 28, 2015

April 28, 2015

hi, i am trying to build coreboot according to https://github.com/bibanon/Coreboot-ThinkPads/wiki/T60p-Build-Coreboot#buil… make crossgcc worked fine. after running "make" im getting the following error and the building process is stopped: --------- /coreboot/util/cbfstool/cbfs_image.c:451:59: error: comparison between signed and unsigned integer expressions [-Werror=sign-compare] assert((char*)CBFS_SUBHEADER(entry) - image->buffer.data == ^ cc1: all warnings being treated as errors make: *** [build/util/cbfstool/cbfs_image.o] Fehler 1 --------- any ideas what is causing this error and how to fix it? thanks in advance chp

2 1

Re: [coreboot] Google Panther: coreboot has to wait for Intel’s ME (Management Engine)
by Berth-Olof Bergman April 28, 2015

April 28, 2015

That’s truly amazing! So the FSP + coreboot part only takes a quarter of a second? Intel FSP must be on steroids!! The total boot time is the sum of components time, so if you fix that problem you will have close to a quarter of second boot time!! Can we see a video clip of that boot? > 27 apr 2015 kl. 22:42 skrev Duncan Laurie <dlaurie(a)chromium.org>: > > On Mon, Apr 27, 2015 at 12:29 PM, Matt DeVillier <matt.devillier(a)gmail.com <mailto:matt.devillier@gmail.com>> wrote: > On 4/26/2015 3:03 AM, Paul Menzel wrote: >> Dear coreboot folks, >> >> >> looking at the time stamps of the Intel Haswell device Google Panther, >> which Matt DeVillier thankfully uploaded to the board status repository >> [1], it looks odd that it took around a quarter of a second, from after >> the SeaBIOS payload was decompressed to starting the payload. This is >> almost half of the whole boot time. >> >> […] >> 90:load payload 233,302 (216) >> 15:starting LZMA decompress (ignore for x86) 233,415 (113) >> 16:finished LZMA decompress (ignore for x86) 250,327 (16,912) >> 99:selfboot jump 493,712 (243,384) >> >> Thanks to Aaron Durbin’s analysis of the code path, the finalize in line >> 138 of `src/southbridge/intel/lynxpoint/smi.c` calls >> `intel_me_mbp_clear()` in line 589 of >> `src/southbridge/intel/lynxpoint/me_9.x.c`. >> >> $ more src/southbridge/intel/lynxpoint/me_9.x.c # line 589 >> […] >> #if CONFIG_ME_MBP_CLEAR_LATE >> /* Wait for ME MBP Cleared indicator */ >> intel_me_mbp_clear(PCH_ME_DEV); >> #endif >> […] >> >> The issue is even described in the Kconfig option description of >> `ME_MBP_CLEAR_LATE` and the commit message of commit 3d299c4b (lynxpoint >> me: add support for mbp clear wait in finalize step) [2] adding this >> option. >> >> $ more src/southbridge/intel/lynxpoint/Kconfig >> […] >> config ME_MBP_CLEAR_LATE >> bool "Defer wait for ME MBP Cleared" >> default y >> help >> If you set this option to y, the Management Engine driver >> will defer waiting for the MBP Cleared indicator until the >> finalize step. This can speed up boot time if the ME takes >> a long time to indicate this status. >> […] >> >> I guess there is no way to get fixed ME BLOBs from Intel. I heard the ME >> BLOB has been fixed for newer Intel devices. > > The ME firmware that ships with Panther is 9.5.13.1706. I've also tested 9.5.41.1904 (what I'm using in the firmware referenced above) and 9.5.45.1922 (which I just came across today) - all display the same behavior in terms of time needed to report MBP cleared. The 9.6 series ME firmware is also for Haswell/Lynxpoint, but I'm unsure if it's compatible with systems shipped with ME 9.5. Since I have an external programmer, I suppose I could always give it a try :) The 10.0 series ME firmware is for Broadwell and is more likely to contain the fix, but less likely to be compatible with Haswell/LP. > > -Matt > > > > > Unfortunately the wait for ME MBP to clear is even worse on Broadwell, but with ME10 there is a (gross) boot flow to avoid it thanks to some new commands that do not need acknowledgement: > > http://review.coreboot.org/gitweb?p=coreboot.git;a=commit;h=c99681f4f23ddac… <http://review.coreboot.org/gitweb?p=coreboot.git;a=commit;h=c99681f4f23ddac…> > > -duncan > >> Thanks, >> >> Paul >> >> >> [1] http://review.coreboot.org/gitweb?p=board-status.git;a=commitdiff;h=3926f95… <http://review.coreboot.org/gitweb?p=board-status.git;a=commitdiff;h=3926f95…> >> [2] http://review.coreboot.org/4375 <http://review.coreboot.org/4375> >> >> > > > -- > coreboot mailing list: coreboot(a)coreboot.org <mailto:coreboot@coreboot.org> > http://www.coreboot.org/mailman/listinfo/coreboot <http://www.coreboot.org/mailman/listinfo/coreboot> > > -- > coreboot mailing list: coreboot(a)coreboot.org > http://www.coreboot.org/mailman/listinfo/coreboot

2 2

New Defects reported by Coverity Scan for coreboot
by scan-admin＠coverity.com April 28, 2015

April 28, 2015

Hi, Please find the latest report on new defect(s) introduced to coreboot found with Coverity Scan. 17 new defect(s) introduced to coreboot found with Coverity Scan. 6 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 17 of 17 defect(s) ** CID 1295501: Null pointer dereferences (FORWARD_NULL) /src/soc/broadcom/cygnus/gpio.c: 464 in gpio_get() ________________________________________________________________________________________________________ *** CID 1295501: Null pointer dereferences (FORWARD_NULL) /src/soc/broadcom/cygnus/gpio.c: 464 in gpio_get() 458 { 459 struct cygnus_gpio *chip; 460 unsigned gpio_num; 461 462 chip = cygnus_get_gpio_core(gpio, &gpio_num); 463 if (chip == NULL) { >>> CID 1295501: Null pointer dereferences (FORWARD_NULL) >>> Dereferencing null pointer "chip". 464 dev_dbg(chip, "unable to find chip for gpio %d", gpio); 465 return -1; 466 } 467 468 return cygnus_gpio_get(chip, gpio_num); 469 } ** CID 1295500: Control flow issues (DEADCODE) /src/soc/broadcom/cygnus/shmoo_and28.c: 4278 in soc_and28_shmoo_ctl() ________________________________________________________________________________________________________ *** CID 1295500: Control flow issues (DEADCODE) /src/soc/broadcom/cygnus/shmoo_and28.c: 4278 in soc_and28_shmoo_ctl() 4272 4273 if(!stat) 4274 { 4275 scPtr = &shmoo_container; 4276 if(scPtr == NULL) 4277 { >>> CID 1295500: Control flow issues (DEADCODE) >>> Execution cannot reach this statement: "return 4;". 4278 return SOC_E_MEMORY; 4279 } 4280 sal_memset(scPtr, 0, sizeof(and28_shmoo_container_t)); 4281 4282 if(phy_ndx != SHMOO_AND28_INTERFACE_RSVP) 4283 { ** CID 1295499: Control flow issues (DEADCODE) /src/soc/intel/common/nvm.c: 113 in nvm_is_write_protected() ________________________________________________________________________________________________________ *** CID 1295499: Control flow issues (DEADCODE) /src/soc/intel/common/nvm.c: 113 in nvm_is_write_protected() 107 } 108 wp_spi = !!(sr1 & 0x80); 109 110 printk(BIOS_DEBUG, "SPI flash protection: WPSW=%d SRP0=%d\n", 111 wp_gpio, wp_spi); 112 >>> CID 1295499: Control flow issues (DEADCODE) >>> Execution cannot reach the expression "wp_spi" inside this statement: "return wp_gpio && wp_spi;". 113 return wp_gpio && wp_spi; 114 } 115 116 /* Apply protection to a range of flash */ 117 int nvm_protect(void *start, size_t size) 118 { ** CID 1295498: Null pointer dereferences (FORWARD_NULL) /src/soc/broadcom/cygnus/gpio.c: 404 in gpio_free() ________________________________________________________________________________________________________ *** CID 1295498: Null pointer dereferences (FORWARD_NULL) /src/soc/broadcom/cygnus/gpio.c: 404 in gpio_free() 398 { 399 struct cygnus_gpio *chip; 400 unsigned gpio_num; 401 402 chip = cygnus_get_gpio_core(gpio, &gpio_num); 403 if (chip == NULL) { >>> CID 1295498: Null pointer dereferences (FORWARD_NULL) >>> Dereferencing null pointer "chip". 404 dev_dbg(chip, "unable to find chip for gpio %d", gpio); 405 return; 406 } 407 408 cygnus_gpio_free(chip, gpio_num); 409 } ** CID 1295497: Integer handling issues (NO_EFFECT) /src/soc/broadcom/cygnus/i2c.c: 240 in i2c_init() ________________________________________________________________________________________________________ *** CID 1295497: Integer handling issues (NO_EFFECT) /src/soc/broadcom/cygnus/i2c.c: 240 in i2c_init() 234 } 235 236 void i2c_init(unsigned int bus, unsigned int hz) 237 { 238 struct cygnus_i2c_regs *regs = i2c_bus[bus]; 239 >>> CID 1295497: Integer handling issues (NO_EFFECT) >>> This greater-than-or-equal-to-zero comparison of an unsigned value is always true. "bus >= 0U". 240 assert(bus >= 0 && bus <= 1); 241 242 setbits_le32(&regs->i2c_con, I2C_SMB_RESET); 243 udelay(100); /* wait 100 usec per spec */ 244 clrbits_le32(&regs->i2c_con, I2C_SMB_RESET); 245 ** CID 1295496: Null pointer dereferences (FORWARD_NULL) /src/soc/broadcom/cygnus/gpio.c: 436 in gpio_input_pulldown() ________________________________________________________________________________________________________ *** CID 1295496: Null pointer dereferences (FORWARD_NULL) /src/soc/broadcom/cygnus/gpio.c: 436 in gpio_input_pulldown() 430 { 431 struct cygnus_gpio *chip; 432 unsigned gpio_num; 433 434 chip = cygnus_get_gpio_core(gpio, &gpio_num); 435 if (chip == NULL) { >>> CID 1295496: Null pointer dereferences (FORWARD_NULL) >>> Dereferencing null pointer "chip". 436 dev_dbg(chip, "unable to find chip for gpio %d", gpio); 437 return; 438 } 439 440 cygnus_gpio_set_pull(chip, gpio_num, 0, 0); 441 } ** CID 1295495: Null pointer dereferences (FORWARD_NULL) /src/soc/broadcom/cygnus/gpio.c: 478 in gpio_set() ________________________________________________________________________________________________________ *** CID 1295495: Null pointer dereferences (FORWARD_NULL) /src/soc/broadcom/cygnus/gpio.c: 478 in gpio_set() 472 { 473 struct cygnus_gpio *chip; 474 unsigned gpio_num; 475 476 chip = cygnus_get_gpio_core(gpio, &gpio_num); 477 if (chip == NULL) { >>> CID 1295495: Null pointer dereferences (FORWARD_NULL) >>> Dereferencing null pointer "chip". 478 dev_dbg(chip, "unable to find chip for gpio %d", gpio); 479 return; 480 } 481 482 cygnus_gpio_set(chip, gpio_num, value); 483 } ** CID 1295494: Error handling issues (NEGATIVE_RETURNS) /util/cbfstool/common.c: 83 in buffer_from_file() ________________________________________________________________________________________________________ *** CID 1295494: Error handling issues (NEGATIVE_RETURNS) /util/cbfstool/common.c: 83 in buffer_from_file() 77 if (buffer->size == -1u) { 78 fprintf(stderr, "could not determine size of %s\n", filename); 79 fclose(fp); 80 return -1; 81 } 82 buffer->name = strdup(filename); >>> CID 1295494: Error handling issues (NEGATIVE_RETURNS) >>> "buffer->size" is passed to a parameter that cannot be negative. [Note: The source code implementation of the function has been overridden by a builtin model.] 83 buffer->data = (char *)malloc(buffer->size); 84 assert(buffer->data); 85 if (fread(buffer->data, 1, buffer->size, fp) != buffer->size) { 86 fprintf(stderr, "incomplete read: %s\n", filename); 87 fclose(fp); 88 return -1; ** CID 1295493: Control flow issues (UNREACHABLE) /src/soc/broadcom/cygnus/ddr_init.c: 1194 in simple_ddr_crc32_check() ________________________________________________________________________________________________________ *** CID 1295493: Control flow issues (UNREACHABLE) /src/soc/broadcom/cygnus/ddr_init.c: 1194 in simple_ddr_crc32_check() 1188 #endif 1189 1190 #if defined(CONFIG_SOC_BROADCOM_CYGNUS) 1191 static int simple_ddr_crc32_check(void) 1192 { 1193 return 0; >>> CID 1295493: Control flow issues (UNREACHABLE) >>> This code cannot be reached: "register uint32_t crc_mcu =...". 1194 register uint32_t crc_mcu = 0; 1195 register uint32_t crc = 0, offset = 0; 1196 register volatile uint32_t *buf = (uint32_t *)0x60000000; 1197 register uint32_t len = 0x00100000;//in word 1198 1199 printk(BIOS_INFO, "Checking simple DDR CRC, word start 0x%p, len 0x%08x...\n", buf, len); ** CID 1295492: Control flow issues (STRAY_SEMICOLON) /src/soc/broadcom/cygnus/ddr_init.c: 431 in ddr_phy_ctl_regs_ovrd() ________________________________________________________________________________________________________ *** CID 1295492: Control flow issues (STRAY_SEMICOLON) /src/soc/broadcom/cygnus/ddr_init.c: 431 in ddr_phy_ctl_regs_ovrd() 425 #if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__ 426 addr[offset/4] = *tblptr; 427 #else 428 addr[offset/4] = swap_u32(*tblptr); 429 #endif 430 val = reg32_read((volatile uint32_t *)DDR_PHY_CONTROL_REGS_REVISION); >>> CID 1295492: Control flow issues (STRAY_SEMICOLON) >>> An "if" statement with no "then" or "else" is suspicious. 431 if (val) ; 432 ++tblptr; 433 offset = *tblptr; 434 } 435 } 436 ** CID 1295491: Parse warnings (PARSE_ERROR) /util/broadcom/secimage/crypto.c: 19 in () ________________________________________________________________________________________________________ *** CID 1295491: Parse warnings (PARSE_ERROR) /util/broadcom/secimage/crypto.c: 19 in () 13 14 15 #include <stdio.h> 16 #include <string.h> 17 #include <stdint.h> 18 #include "secimage.h" >>> CID 1295491: Parse warnings (PARSE_ERROR) >>> cannot open source file "openssl/hmac.h" 19 #include <openssl/hmac.h> 20 21 22 /*---------------------------------------------------------------------- 23 * Name : HmacSha256Hash 24 * Purpose : ** CID 1295490: Null pointer dereferences (FORWARD_NULL) /src/soc/broadcom/cygnus/gpio.c: 450 in gpio_input_pullup() ________________________________________________________________________________________________________ *** CID 1295490: Null pointer dereferences (FORWARD_NULL) /src/soc/broadcom/cygnus/gpio.c: 450 in gpio_input_pullup() 444 { 445 struct cygnus_gpio *chip; 446 unsigned gpio_num; 447 448 chip = cygnus_get_gpio_core(gpio, &gpio_num); 449 if (chip == NULL) { >>> CID 1295490: Null pointer dereferences (FORWARD_NULL) >>> Dereferencing null pointer "chip". 450 dev_dbg(chip, "unable to find chip for gpio %d", gpio); 451 return; 452 } 453 454 cygnus_gpio_set_pull(chip, gpio_num, 0, 1); 455 } ** CID 1295489: (OVERRUN) ________________________________________________________________________________________________________ *** CID 1295489: (OVERRUN) /src/mainboard/google/veyron_jerry/mainboard.c: 77 in configure_codec() 71 gpio_output(GPIO(2, B, 1), 1); /* EMMC_RST_L */ 72 } 73 74 static void configure_codec(void) 75 { 76 write32(&rk3288_grf->iomux_i2c2, IOMUX_I2C2); /* CODEC I2C */ >>> CID 1295489: (OVERRUN) >>> Overrunning callee's array of size 2 by passing argument "2U" in call to "i2c_init". 77 i2c_init(2, 400*KHz); /* CODEC I2C */ 78 79 write32(&rk3288_grf->iomux_i2s, IOMUX_I2S); 80 write32(&rk3288_grf->iomux_i2sclk, IOMUX_I2SCLK); 81 82 rk808_configure_ldo(6, 1800); /* VCC18_CODEC */ /src/mainboard/google/veyron_danger/mainboard.c: 77 in configure_codec() 71 gpio_output(GPIO(2, B, 1), 1); /* EMMC_RST_L */ 72 } 73 74 static void configure_codec(void) 75 { 76 write32(&rk3288_grf->iomux_i2c2, IOMUX_I2C2); /* CODEC I2C */ >>> CID 1295489: (OVERRUN) >>> Overrunning callee's array of size 2 by passing argument "2U" in call to "i2c_init". 77 i2c_init(2, 400*KHz); /* CODEC I2C */ 78 79 write32(&rk3288_grf->iomux_i2s, IOMUX_I2S); 80 write32(&rk3288_grf->iomux_i2sclk, IOMUX_I2SCLK); 81 82 rk808_configure_ldo(6, 1800); /* VCC18_CODEC */ /src/mainboard/google/veyron_pinky/mainboard.c: 108 in configure_codec() 102 } 103 } 104 105 static void configure_codec(void) 106 { 107 write32(&rk3288_grf->iomux_i2c2, IOMUX_I2C2); /* CODEC I2C */ >>> CID 1295489: (OVERRUN) >>> Overrunning callee's array of size 2 by passing argument "2U" in call to "i2c_init". 108 i2c_init(2, 400*KHz); /* CODEC I2C */ 109 110 write32(&rk3288_grf->iomux_i2s, IOMUX_I2S); 111 write32(&rk3288_grf->iomux_i2sclk, IOMUX_I2SCLK); 112 113 switch (board_id()) { /src/mainboard/google/veyron_speedy/mainboard.c: 77 in configure_codec() 71 gpio_output(GPIO(2, B, 1), 1); /* EMMC_RST_L */ 72 } 73 74 static void configure_codec(void) 75 { 76 write32(&rk3288_grf->iomux_i2c2, IOMUX_I2C2); /* CODEC I2C */ >>> CID 1295489: (OVERRUN) >>> Overrunning callee's array of size 2 by passing argument "2U" in call to "i2c_init". 77 i2c_init(2, 400*KHz); /* CODEC I2C */ 78 79 write32(&rk3288_grf->iomux_i2s, IOMUX_I2S); 80 write32(&rk3288_grf->iomux_i2sclk, IOMUX_I2SCLK); 81 82 rk808_configure_ldo(6, 1800); /* VCC18_CODEC */ /src/mainboard/google/veyron_mighty/mainboard.c: 77 in configure_codec() 71 gpio_output(GPIO(2, B, 1), 1); /* EMMC_RST_L */ 72 } 73 74 static void configure_codec(void) 75 { 76 write32(&rk3288_grf->iomux_i2c2, IOMUX_I2C2); /* CODEC I2C */ >>> CID 1295489: (OVERRUN) >>> Overrunning callee's array of size 2 by passing argument "2U" in call to "i2c_init". 77 i2c_init(2, 400*KHz); /* CODEC I2C */ 78 79 write32(&rk3288_grf->iomux_i2s, IOMUX_I2S); 80 write32(&rk3288_grf->iomux_i2sclk, IOMUX_I2SCLK); 81 82 rk808_configure_ldo(6, 1800); /* VCC18_CODEC */ /src/mainboard/google/veyron_brain/mainboard.c: 63 in configure_codec() 57 gpio_output(GPIO(2, B, 1), 1); /* EMMC_RST_L */ 58 } 59 60 static void configure_codec(void) 61 { 62 write32(&rk3288_grf->iomux_i2c2, IOMUX_I2C2); /* CODEC I2C */ >>> CID 1295489: (OVERRUN) >>> Overrunning callee's array of size 2 by passing argument "2U" in call to "i2c_init". 63 i2c_init(2, 400*KHz); /* CODEC I2C */ 64 65 write32(&rk3288_grf->iomux_i2s, IOMUX_I2S); 66 write32(&rk3288_grf->iomux_i2sclk, IOMUX_I2SCLK); 67 68 rk808_configure_ldo(6, 1800); /* VCC18_CODEC */ /src/mainboard/google/veyron_rialto/mainboard.c: 63 in configure_codec() 57 gpio_output(GPIO(2, B, 1), 1); /* EMMC_RST_L */ 58 } 59 60 static void configure_codec(void) 61 { 62 write32(&rk3288_grf->iomux_i2c2, IOMUX_I2C2); /* CODEC I2C */ >>> CID 1295489: (OVERRUN) >>> Overrunning callee's array of size 2 by passing argument "2U" in call to "i2c_init". 63 i2c_init(2, 400*KHz); /* CODEC I2C */ 64 65 write32(&rk3288_grf->iomux_i2s, IOMUX_I2S); 66 write32(&rk3288_grf->iomux_i2sclk, IOMUX_I2SCLK); 67 68 rk808_configure_ldo(6, 1800); /* VCC18_CODEC */ ** CID 1295488: Null pointer dereferences (FORWARD_NULL) /src/soc/broadcom/cygnus/gpio.c: 492 in gpio_output() ________________________________________________________________________________________________________ *** CID 1295488: Null pointer dereferences (FORWARD_NULL) /src/soc/broadcom/cygnus/gpio.c: 492 in gpio_output() 486 { 487 struct cygnus_gpio *chip; 488 unsigned gpio_num; 489 490 chip = cygnus_get_gpio_core(gpio, &gpio_num); 491 if (chip == NULL) { >>> CID 1295488: Null pointer dereferences (FORWARD_NULL) >>> Dereferencing null pointer "chip". 492 dev_dbg(chip, "unable to find chip for gpio %d", gpio); 493 return; 494 } 495 496 if (cygnus_gpio_request(chip, gpio_num) != 0) { 497 printk(BIOS_ERR, "Cannot mux GPIO %d\n", gpio); 498 return; 499 } 500 cygnus_gpio_direction_output(chip, gpio_num, value); ** CID 1295487: Memory - illegal accesses (OVERRUN) /coreboot-builds/amd_lamar/agesa/amdlib.c: 1411 in IdsErrorStop() ________________________________________________________________________________________________________ *** CID 1295487: Memory - illegal accesses (OVERRUN) /coreboot-builds/amd_lamar/agesa/amdlib.c: 1411 in IdsErrorStop() 1405 } post = {0xDEAD, FileCode, 0xDEAD, FileCode}; 1406 UINT16 offset = 0; 1407 UINT16 j; 1408 1409 while(1) { 1410 offset %= sizeof(struct POST) / 2; >>> CID 1295487: Memory - illegal accesses (OVERRUN) >>> Overrunning array of 3 4-byte elements at element index 15 (byte offset 60) by dereferencing pointer "(UINT32 *)(&post + offset)". 1411 WriteIo32(80, *((UINT32*)(&post+offset))); 1412 ++offset; 1413 for (j=0; j<250; ++j) { 1414 ReadIo8(80); 1415 } 1416 } ** CID 1295486: Null pointer dereferences (FORWARD_NULL) /src/soc/broadcom/cygnus/gpio.c: 418 in gpio_input() ________________________________________________________________________________________________________ *** CID 1295486: Null pointer dereferences (FORWARD_NULL) /src/soc/broadcom/cygnus/gpio.c: 418 in gpio_input() 412 { 413 struct cygnus_gpio *chip; 414 unsigned gpio_num; 415 416 chip = cygnus_get_gpio_core(gpio, &gpio_num); 417 if (chip == NULL) { >>> CID 1295486: Null pointer dereferences (FORWARD_NULL) >>> Dereferencing null pointer "chip". 418 dev_dbg(chip, "unable to find chip for gpio %d", gpio); 419 return; 420 } 421 422 if (cygnus_gpio_request(chip, gpio_num) != 0) { 423 printk(BIOS_ERR, "Cannot mux GPIO %d\n", gpio); ** CID 1295485: Null pointer dereferences (NULL_RETURNS) /src/vendorcode/amd/agesa/f16kb/Proc/GNB/Modules/GnbCommonLib/GnbTimerLib.c: 147 in GnbFmTimeStamp() ________________________________________________________________________________________________________ *** CID 1295485: Null pointer dereferences (NULL_RETURNS) /src/vendorcode/amd/agesa/f16kb/Proc/GNB/Modules/GnbCommonLib/GnbTimerLib.c: 147 in GnbFmTimeStamp() 141 ) 142 { 143 AGESA_STATUS Status; 144 GNB_FAM_TS_SERVICES *GnbFamTsFunc; 145 GNB_HANDLE *GnbHandle; 146 >>> CID 1295485: Null pointer dereferences (NULL_RETURNS) >>> Assigning: "GnbHandle" = null return value from "GnbGetHandle". 147 GnbHandle = GnbGetHandle (StdHeader); 148 149 Status = GnbLibLocateService (GnbFamTsService, GnbGetSocketId (GnbHandle), (VOID **)&GnbFamTsFunc, StdHeader); 150 ASSERT (Status == AGESA_SUCCESS); 151 if (Status == AGESA_SUCCESS) { 152 return GnbFamTsFunc->GnbFmTimeStamp (StdHeader); 153 } 154 return 0; ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://scan.coverity.com/projects/1016?tab=overview To manage Coverity Scan email notifications for "coreboot(a)coreboot.org", click https://scan.coverity.com/subscriptions/edit?email=coreboot%40coreboot.org&… .

2 1