coreboot-gerrit November 2013

coreboot-gerrit@coreboot.org

1 participants
856 discussions

Patch set updated for coreboot: 363805a console/vsprintf: Implement snprintf
by Vladimir Serbinenko 26 Nov '13

26 Nov '13

Vladimir Serbinenko (phcoder(a)gmail.com) just uploaded a new patch set to gerrit, which you can find at http://review.coreboot.org/4278 -gerrit commit 363805a35ab05127c765f95b4b486b6dfa087892 Author: Vladimir Serbinenko <phcoder(a)gmail.com> Date: Tue Nov 26 22:07:47 2013 +0100 console/vsprintf: Implement snprintf snprintf is a safe variant of sprintf. To avoid buffer overflows we shouldn't use sprintf at all. But for now let's start by implementing snprintf in first place. Change-Id: Ic17d94b8cd91b72f66b84b0589a06b8abef5e5c9 Signed-off-by: Vladimir Serbinenko <phcoder(a)gmail.com> --- src/console/vsprintf.c | 36 ++++++++++++++++++++++++++++-------- src/include/string.h | 1 + 2 files changed, 29 insertions(+), 8 deletions(-) diff --git a/src/console/vsprintf.c b/src/console/vsprintf.c index 321ce81..b1b6d47 100644 --- a/src/console/vsprintf.c +++ b/src/console/vsprintf.c @@ -23,28 +23,34 @@ #include <console/vtxprintf.h> #include <trace.h> -struct vsprintf_context +struct vsnprintf_context { char *str_buf; + size_t buf_limit; }; static void str_tx_byte(unsigned char byte, void *data) { - struct vsprintf_context *ctx = data; - *ctx->str_buf = byte; - ctx->str_buf++; + struct vsnprintf_context *ctx = data; + if (ctx->buf_limit) { + *ctx->str_buf = byte; + ctx->str_buf++; + ctx->buf_limit--; + } } -static int vsprintf(char *buf, const char *fmt, va_list args) +static int vsnprintf(char *buf, size_t size, const char *fmt, va_list args) { int i; - struct vsprintf_context ctx; + struct vsnprintf_context ctx; DISABLE_TRACE; ctx.str_buf = buf; + ctx.buf_limit = size ? size - 1 : 0; i = vtxdprintf(str_tx_byte, fmt, args, &ctx); - *ctx.str_buf = '\0'; + if (size) + *ctx.str_buf = '\0'; ENABLE_TRACE; @@ -57,7 +63,21 @@ int sprintf(char *buf, const char *fmt, ...) int i; va_start(args, fmt); - i = vsprintf(buf, fmt, args); + /* A trick: we have at most (size_t)-1 adressable space anyway, so + if we output so much we'll crash anyway. */ + i = vsnprintf(buf, -1, fmt, args); + va_end(args); + + return i; +} + +int snprintf(char *buf, size_t size, const char *fmt, ...) +{ + va_list args; + int i; + + va_start(args, fmt); + i = vsnprintf(buf, size, fmt, args); va_end(args); return i; diff --git a/src/include/string.h b/src/include/string.h index 77985e1..dc125e1 100644 --- a/src/include/string.h +++ b/src/include/string.h @@ -17,6 +17,7 @@ int memcmp(const void *s1, const void *s2, size_t n); void *memchr(const void *s, int c, size_t n); #if !defined(__PRE_RAM__) int sprintf(char * buf, const char *fmt, ...); +int snprintf(char * buf, size_t size, const char *fmt, ...); #endif // simple string functions

1 0

Patch set updated for coreboot: 622d99b snprintf: lockless operation
by Vladimir Serbinenko 26 Nov '13

26 Nov '13

Vladimir Serbinenko (phcoder(a)gmail.com) just uploaded a new patch set to gerrit, which you can find at http://review.coreboot.org/4288 -gerrit commit 622d99ba115125493948a6cc0f9ed7d46c1b9de0 Author: Vladimir Serbinenko <phcoder(a)gmail.com> Date: Tue Nov 26 21:48:57 2013 +0100 snprintf: lockless operation Instead of having global variables put them on the stack. Change-Id: I462e3b245612ff2dfb077da1cbcc5ac88f8b8e48 Signed-off-by: Vladimir Serbinenko <phcoder(a)gmail.com> --- src/console/vsprintf.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/src/console/vsprintf.c b/src/console/vsprintf.c index 435401b..321ce81 100644 --- a/src/console/vsprintf.c +++ b/src/console/vsprintf.c @@ -20,32 +20,32 @@ */ #include <string.h> -#include <smp/spinlock.h> #include <console/vtxprintf.h> #include <trace.h> -DECLARE_SPIN_LOCK(vsprintf_lock) - -static char *str_buf; +struct vsprintf_context +{ + char *str_buf; +}; -static void str_tx_byte(unsigned char byte) +static void str_tx_byte(unsigned char byte, void *data) { - *str_buf = byte; - str_buf++; + struct vsprintf_context *ctx = data; + *ctx->str_buf = byte; + ctx->str_buf++; } static int vsprintf(char *buf, const char *fmt, va_list args) { int i; + struct vsprintf_context ctx; DISABLE_TRACE; - spin_lock(&vsprintf_lock); - str_buf = buf; - i = vtxprintf(str_tx_byte, fmt, args); - *str_buf = '\0'; + ctx.str_buf = buf; + i = vtxdprintf(str_tx_byte, fmt, args, &ctx); + *ctx.str_buf = '\0'; - spin_unlock(&vsprintf_lock); ENABLE_TRACE; return i;

1 0

Patch set updated for coreboot: 959255a Replace all occurences of sprintf with snprintf
by Vladimir Serbinenko 26 Nov '13

26 Nov '13

Vladimir Serbinenko (phcoder(a)gmail.com) just uploaded a new patch set to gerrit, which you can find at http://review.coreboot.org/4279 -gerrit commit 959255a3077ee90fcdecdb31dca7181875e47bf5 Author: Vladimir Serbinenko <phcoder(a)gmail.com> Date: Tue Nov 26 02:41:26 2013 +0100 Replace all occurences of sprintf with snprintf THis reduces risks of bufer overflows. Change-Id: I77f80e76efec16ac0a0af83d76430a8126a7602d Signed-off-by: Vladimir Serbinenko <phcoder(a)gmail.com> --- src/arch/x86/boot/acpigen.c | 3 +- src/device/device_util.c | 83 ++++++++++++---------- src/device/oprom/x86emu/debug.c | 8 +-- src/mainboard/google/link/i915.c | 2 +- src/mainboard/google/stout/i915.c | 2 +- src/mainboard/intel/wtm2/i915.c | 2 +- src/mainboard/lenovo/x60/i915.c | 2 +- src/northbridge/amd/agesa/family10/northbridge.c | 2 +- src/northbridge/amd/agesa/family12/northbridge.c | 2 +- src/northbridge/amd/agesa/family14/northbridge.c | 2 +- src/northbridge/amd/agesa/family15/northbridge.c | 2 +- src/northbridge/amd/agesa/family15tn/northbridge.c | 2 +- src/northbridge/amd/agesa/family16kb/northbridge.c | 2 +- src/northbridge/amd/amdfam10/acpi.c | 2 +- src/northbridge/amd/amdfam10/northbridge.c | 4 +- src/northbridge/amd/amdk8/northbridge.c | 4 +- 16 files changed, 67 insertions(+), 57 deletions(-) diff --git a/src/arch/x86/boot/acpigen.c b/src/arch/x86/boot/acpigen.c index 121cb22..6496d75 100644 --- a/src/arch/x86/boot/acpigen.c +++ b/src/arch/x86/boot/acpigen.c @@ -274,7 +274,8 @@ int acpigen_write_processor(u8 cpuindex, u32 pblock_addr, u8 pblock_len) acpigen_emit_byte(0x83); len = acpigen_write_len_f(); - sprintf(pscope, "\\_PR.CPU%x", (unsigned int) cpuindex); + snprintf(pscope, sizeof (pscope), + "\\_PR.CPU%x", (unsigned int) cpuindex); len += acpigen_emit_namestring(pscope); acpigen_emit_byte(cpuindex); acpigen_emit_byte(pblock_addr & 0xff); diff --git a/src/device/device_util.c b/src/device/device_util.c index d2c99e1..b35911b 100644 --- a/src/device/device_util.c +++ b/src/device/device_util.c @@ -176,48 +176,52 @@ const char *dev_path(device_t dev) break; case DEVICE_PATH_PCI: #if CONFIG_PCI_BUS_SEGN_BITS - sprintf(buffer, "PCI: %04x:%02x:%02x.%01x", - dev->bus->secondary >> 8, - dev->bus->secondary & 0xff, - PCI_SLOT(dev->path.pci.devfn), - PCI_FUNC(dev->path.pci.devfn)); + snprintf(buffer, sizeof (buffer), + "PCI: %04x:%02x:%02x.%01x", + dev->bus->secondary >> 8, + dev->bus->secondary & 0xff, + PCI_SLOT(dev->path.pci.devfn), + PCI_FUNC(dev->path.pci.devfn)); #else - sprintf(buffer, "PCI: %02x:%02x.%01x", - dev->bus->secondary, - PCI_SLOT(dev->path.pci.devfn), - PCI_FUNC(dev->path.pci.devfn)); + snprintf(buffer, sizeof (buffer), + "PCI: %02x:%02x.%01x", + dev->bus->secondary, + PCI_SLOT(dev->path.pci.devfn), + PCI_FUNC(dev->path.pci.devfn)); #endif break; case DEVICE_PATH_PNP: - sprintf(buffer, "PNP: %04x.%01x", - dev->path.pnp.port, dev->path.pnp.device); + snprintf(buffer, sizeof (buffer), "PNP: %04x.%01x", + dev->path.pnp.port, dev->path.pnp.device); break; case DEVICE_PATH_I2C: - sprintf(buffer, "I2C: %02x:%02x", - dev->bus->secondary, - dev->path.i2c.device); + snprintf(buffer, sizeof (buffer), "I2C: %02x:%02x", + dev->bus->secondary, + dev->path.i2c.device); break; case DEVICE_PATH_APIC: - sprintf(buffer, "APIC: %02x", - dev->path.apic.apic_id); + snprintf(buffer, sizeof (buffer), "APIC: %02x", + dev->path.apic.apic_id); break; case DEVICE_PATH_IOAPIC: - sprintf(buffer, "IOAPIC: %02x", - dev->path.ioapic.ioapic_id); + snprintf(buffer, sizeof (buffer), "IOAPIC: %02x", + dev->path.ioapic.ioapic_id); break; case DEVICE_PATH_DOMAIN: - sprintf(buffer, "DOMAIN: %04x", + snprintf(buffer, sizeof (buffer), "DOMAIN: %04x", dev->path.domain.domain); break; case DEVICE_PATH_CPU_CLUSTER: - sprintf(buffer, "CPU_CLUSTER: %01x", + snprintf(buffer, sizeof (buffer), "CPU_CLUSTER: %01x", dev->path.cpu_cluster.cluster); break; case DEVICE_PATH_CPU: - sprintf(buffer, "CPU: %02x", dev->path.cpu.id); + snprintf(buffer, sizeof (buffer), + "CPU: %02x", dev->path.cpu.id); break; case DEVICE_PATH_CPU_BUS: - sprintf(buffer, "CPU_BUS: %02x", dev->path.cpu_bus.id); + snprintf(buffer, sizeof (buffer), + "CPU_BUS: %02x", dev->path.cpu_bus.id); break; default: printk(BIOS_ERR, "Unknown device path type: %d\n", @@ -241,7 +245,8 @@ const char *dev_name(device_t dev) const char *bus_path(struct bus *bus) { static char buffer[BUS_PATH_MAX]; - sprintf(buffer, "%s,%d", dev_path(bus->dev), bus->link_num); + snprintf(buffer, sizeof (buffer), + "%s,%d", dev_path(bus->dev), bus->link_num); return buffer; } @@ -529,15 +534,15 @@ resource_t resource_max(struct resource *resource) const char *resource_type(struct resource *resource) { static char buffer[RESOURCE_TYPE_MAX]; - sprintf(buffer, "%s%s%s%s", - ((resource->flags & IORESOURCE_READONLY) ? "ro" : ""), - ((resource->flags & IORESOURCE_PREFETCH) ? "pref" : ""), - ((resource->flags == 0) ? "unused" : - (resource->flags & IORESOURCE_IO) ? "io" : - (resource->flags & IORESOURCE_DRQ) ? "drq" : - (resource->flags & IORESOURCE_IRQ) ? "irq" : - (resource->flags & IORESOURCE_MEM) ? "mem" : "??????"), - ((resource->flags & IORESOURCE_PCI64) ? "64" : "")); + snprintf(buffer, sizeof (buffer), "%s%s%s%s", + ((resource->flags & IORESOURCE_READONLY) ? "ro" : ""), + ((resource->flags & IORESOURCE_PREFETCH) ? "pref" : ""), + ((resource->flags == 0) ? "unused" : + (resource->flags & IORESOURCE_IO) ? "io" : + (resource->flags & IORESOURCE_DRQ) ? "drq" : + (resource->flags & IORESOURCE_IRQ) ? "irq" : + (resource->flags & IORESOURCE_MEM) ? "mem" : "??????"), + ((resource->flags & IORESOURCE_PCI64) ? "64" : "")); return buffer; } @@ -563,10 +568,12 @@ void report_resource_stored(device_t dev, struct resource *resource, if (resource->flags & IORESOURCE_PCI_BRIDGE) { #if CONFIG_PCI_BUS_SEGN_BITS - sprintf(buf, "bus %04x:%02x ", dev->bus->secondary >> 8, + snprintf(buf, sizeof (buf), + "bus %04x:%02x ", dev->bus->secondary >> 8, dev->link_list->secondary & 0xff); #else - sprintf(buf, "bus %02x ", dev->link_list->secondary); + snprintf(buf, sizeof (buf), + "bus %02x ", dev->link_list->secondary); #endif } printk(BIOS_DEBUG, "%s %02lx <- [0x%010llx - 0x%010llx] size 0x%08llx " @@ -775,10 +782,12 @@ void show_one_resource(int debug_level, struct device *dev, /* if (resource->flags & IORESOURCE_BRIDGE) { #if CONFIG_PCI_BUS_SEGN_BITS - sprintf(buf, "bus %04x:%02x ", dev->bus->secondary >> 8, - dev->link[0].secondary & 0xff); + snprintf(buf, sizeof (buf), "bus %04x:%02x ", + dev->bus->secondary >> 8, + dev->link[0].secondary & 0xff); #else - sprintf(buf, "bus %02x ", dev->link[0].secondary); + snprintf(buf, sizeof (buf), + "bus %02x ", dev->link[0].secondary); #endif } */ diff --git a/src/device/oprom/x86emu/debug.c b/src/device/oprom/x86emu/debug.c index b3f4b6e..e7a111b 100644 --- a/src/device/oprom/x86emu/debug.c +++ b/src/device/oprom/x86emu/debug.c @@ -163,15 +163,15 @@ void x86emu_inc_decoded_inst_len (int x) void x86emu_decode_printf (const char *x) { - sprintf(M.x86.decoded_buf+M.x86.enc_str_pos,"%s",x); + strcpy(M.x86.decoded_buf+M.x86.enc_str_pos,x); M.x86.enc_str_pos += strlen(x); } void x86emu_decode_printf2 (const char *x, int y) { char temp[100]; - sprintf(temp,x,y); - sprintf(M.x86.decoded_buf+M.x86.enc_str_pos,"%s",temp); + snprintf(temp, sizeof (temp), x,y); + strcpy(M.x86.decoded_buf+M.x86.enc_str_pos,temp); M.x86.enc_str_pos += strlen(temp); } @@ -186,7 +186,7 @@ static void print_encoded_bytes (u16 s, u16 o) int i; char buf1[64]; for (i=0; i< M.x86.enc_pos; i++) { - sprintf(buf1+2*i,"%02x", fetch_data_byte_abs(s,o+i)); + snprintf(buf1+2*i, 64 - 2 * i, "%02x", fetch_data_byte_abs(s,o+i)); } printf("%-20s ",buf1); } diff --git a/src/mainboard/google/link/i915.c b/src/mainboard/google/link/i915.c index 42b9c0f..079ae02 100644 --- a/src/mainboard/google/link/i915.c +++ b/src/mainboard/google/link/i915.c @@ -78,7 +78,7 @@ const u32 link_edid_data[] = { static char *regname(unsigned long addr) { static char name[16]; - sprintf(name, "0x%lx", addr); + snprintf(name, sizeof (name), "0x%lx", addr); return name; } diff --git a/src/mainboard/google/stout/i915.c b/src/mainboard/google/stout/i915.c index 89a8594..8085de6 100644 --- a/src/mainboard/google/stout/i915.c +++ b/src/mainboard/google/stout/i915.c @@ -88,7 +88,7 @@ setgtt(int start, int end, unsigned long base, int inc) static char *regname(unsigned long addr) { static char name[16]; - sprintf(name, "0x%lx", addr); + snprintf(name, sizeof (name), "0x%lx", addr); return name; } diff --git a/src/mainboard/intel/wtm2/i915.c b/src/mainboard/intel/wtm2/i915.c index df88138..b664c35 100644 --- a/src/mainboard/intel/wtm2/i915.c +++ b/src/mainboard/intel/wtm2/i915.c @@ -88,7 +88,7 @@ static int ioread = 0, iowrite = 0; static char *regname(unsigned long addr) { static char name[16]; - sprintf(name, "0x%lx", addr); + snprintf(name, sizeof (name), "0x%lx", addr); return name; } diff --git a/src/mainboard/lenovo/x60/i915.c b/src/mainboard/lenovo/x60/i915.c index f130c5c..93f60a8 100644 --- a/src/mainboard/lenovo/x60/i915.c +++ b/src/mainboard/lenovo/x60/i915.c @@ -81,7 +81,7 @@ const u32 x60_edid_data[] = { static char *regname(unsigned long addr) { static char name[16]; - sprintf(name, "0x%lx", addr); + snprintf(name, sizeof (name), "0x%lx", addr); return name; } diff --git a/src/northbridge/amd/agesa/family10/northbridge.c b/src/northbridge/amd/agesa/family10/northbridge.c index 1c7e547..60f3951 100644 --- a/src/northbridge/amd/agesa/family10/northbridge.c +++ b/src/northbridge/amd/agesa/family10/northbridge.c @@ -657,7 +657,7 @@ static void amdfam10_set_resource(device_t dev, struct resource *resource, store_conf_mmio_addr(nodeid, link_num, reg, (resource->index >>24), rbase>>8, rend>>8); } resource->flags |= IORESOURCE_STORED; - sprintf(buf, " <node %x link %x>", + snprintf(buf, sizeof (buf), " <node %x link %x>", nodeid, link_num); report_resource_stored(dev, resource, buf); } diff --git a/src/northbridge/amd/agesa/family12/northbridge.c b/src/northbridge/amd/agesa/family12/northbridge.c index e6be598..9757d96 100644 --- a/src/northbridge/amd/agesa/family12/northbridge.c +++ b/src/northbridge/amd/agesa/family12/northbridge.c @@ -402,7 +402,7 @@ static void set_resource(device_t dev, struct resource *resource, set_mmio_addr_reg(nodeid, link_num, reg, (resource->index >>24), rbase>>8, rend>>8, 1) ;// [39:8] } resource->flags |= IORESOURCE_STORED; - sprintf(buf, " <node %x link %x>", + snprintf(buf, sizeof (buf), " <node %x link %x>", nodeid, link_num); report_resource_stored(dev, resource, buf); printk(BIOS_DEBUG, "Fam12h - northbridge.c - %s - End.\n",__func__); diff --git a/src/northbridge/amd/agesa/family14/northbridge.c b/src/northbridge/amd/agesa/family14/northbridge.c index 7cc812b..847e6dd 100644 --- a/src/northbridge/amd/agesa/family14/northbridge.c +++ b/src/northbridge/amd/agesa/family14/northbridge.c @@ -402,7 +402,7 @@ static void set_resource(device_t dev, struct resource *resource, u32 nodeid) rbase >> 8, rend >> 8, 1); // [39:8] } resource->flags |= IORESOURCE_STORED; - sprintf(buf, " <node %x link %x>", nodeid, link_num); + snprintf(buf, sizeof (buf), " <node %x link %x>", nodeid, link_num); report_resource_stored(dev, resource, buf); } diff --git a/src/northbridge/amd/agesa/family15/northbridge.c b/src/northbridge/amd/agesa/family15/northbridge.c index a8cc1cc..aa9ec56 100644 --- a/src/northbridge/amd/agesa/family15/northbridge.c +++ b/src/northbridge/amd/agesa/family15/northbridge.c @@ -400,7 +400,7 @@ static void set_resource(device_t dev, struct resource *resource, u32 nodeid) set_mmio_addr_reg(nodeid, link_num, reg, (resource->index >>24), rbase>>8, rend>>8, node_nums) ;// [39:8] } resource->flags |= IORESOURCE_STORED; - sprintf(buf, " <node %x link %x>", + snprintf(buf, sizeof (buf), " <node %x link %x>", nodeid, link_num); report_resource_stored(dev, resource, buf); } diff --git a/src/northbridge/amd/agesa/family15tn/northbridge.c b/src/northbridge/amd/agesa/family15tn/northbridge.c index b55d52b..2b5549d 100644 --- a/src/northbridge/amd/agesa/family15tn/northbridge.c +++ b/src/northbridge/amd/agesa/family15tn/northbridge.c @@ -393,7 +393,7 @@ static void set_resource(device_t dev, struct resource *resource, u32 nodeid) set_mmio_addr_reg(nodeid, link_num, reg, (resource->index >>24), rbase>>8, rend>>8, node_nums) ;// [39:8] } resource->flags |= IORESOURCE_STORED; - sprintf(buf, " <node %x link %x>", + snprintf(buf, sizeof (buf), " <node %x link %x>", nodeid, link_num); report_resource_stored(dev, resource, buf); } diff --git a/src/northbridge/amd/agesa/family16kb/northbridge.c b/src/northbridge/amd/agesa/family16kb/northbridge.c index b8bba50..6feabf4 100644 --- a/src/northbridge/amd/agesa/family16kb/northbridge.c +++ b/src/northbridge/amd/agesa/family16kb/northbridge.c @@ -380,7 +380,7 @@ static void set_resource(device_t dev, struct resource *resource, u32 nodeid) set_mmio_addr_reg(nodeid, link_num, reg, (resource->index >>24), rbase>>8, rend>>8, node_nums) ;// [39:8] } resource->flags |= IORESOURCE_STORED; - sprintf(buf, " <node %x link %x>", + snprintf(buf, sizeof (buf), " <node %x link %x>", nodeid, link_num); report_resource_stored(dev, resource, buf); } diff --git a/src/northbridge/amd/amdfam10/acpi.c b/src/northbridge/amd/amdfam10/acpi.c index ee842d5..abba0ce 100644 --- a/src/northbridge/amd/amdfam10/acpi.c +++ b/src/northbridge/amd/amdfam10/acpi.c @@ -313,7 +313,7 @@ static void update_sspr(void *sspr, u32 nodeid, u32 cpuindex) CONTROL = sspr + 0x8d; STATUS = sspr + 0x8f; - sprintf((char*)CPU, "%02x", (char)cpuindex); + snprintf((char*)CPU, 3, "%02x", (char)cpuindex); *CPUIN = (u8) cpuindex; for(i=0;i<sysconf.p_state_num;i++) { diff --git a/src/northbridge/amd/amdfam10/northbridge.c b/src/northbridge/amd/amdfam10/northbridge.c index 6bcab41..26e040f 100644 --- a/src/northbridge/amd/amdfam10/northbridge.c +++ b/src/northbridge/amd/amdfam10/northbridge.c @@ -541,8 +541,8 @@ static void amdfam10_set_resource(device_t dev, struct resource *resource, store_conf_mmio_addr(nodeid, link_num, reg, (resource->index >>24), rbase>>8, rend>>8); } resource->flags |= IORESOURCE_STORED; - sprintf(buf, " <node %x link %x>", - nodeid, link_num); + snprintf(buf, sizeof (buf), " <node %x link %x>", + nodeid, link_num); report_resource_stored(dev, resource, buf); } diff --git a/src/northbridge/amd/amdk8/northbridge.c b/src/northbridge/amd/amdk8/northbridge.c index 8f0a11b..b0acdf7 100644 --- a/src/northbridge/amd/amdk8/northbridge.c +++ b/src/northbridge/amd/amdk8/northbridge.c @@ -479,8 +479,8 @@ static void amdk8_set_resource(device_t dev, struct resource *resource, unsigned f1_write_config32(reg, base); } resource->flags |= IORESOURCE_STORED; - sprintf(buf, " <node %x link %x>", - nodeid, link_num); + snprintf(buf, sizeof (buf), " <node %x link %x>", + nodeid, link_num); report_resource_stored(dev, resource, buf); }

1 0

Patch set updated for coreboot: df5a17e Remove sprintf
by Vladimir Serbinenko 26 Nov '13

26 Nov '13

Vladimir Serbinenko (phcoder(a)gmail.com) just uploaded a new patch set to gerrit, which you can find at http://review.coreboot.org/4280 -gerrit commit df5a17e1e11bcbe3d8c6a52ffd6fb57800794bdf Author: Vladimir Serbinenko <phcoder(a)gmail.com> Date: Tue Nov 26 02:42:52 2013 +0100 Remove sprintf Remove sprintf as if you can't easily use snprintf then you probably have buffer overflow. Change-Id: Ic4570e099a52d743aca938a2bfadb95981adc503 Signed-off-by: Vladimir Serbinenko <phcoder(a)gmail.com> --- src/console/vsprintf.c | 14 -------------- src/include/string.h | 1 - 2 files changed, 15 deletions(-) diff --git a/src/console/vsprintf.c b/src/console/vsprintf.c index b1b6d47..1fb834f 100644 --- a/src/console/vsprintf.c +++ b/src/console/vsprintf.c @@ -57,20 +57,6 @@ static int vsnprintf(char *buf, size_t size, const char *fmt, va_list args) return i; } -int sprintf(char *buf, const char *fmt, ...) -{ - va_list args; - int i; - - va_start(args, fmt); - /* A trick: we have at most (size_t)-1 adressable space anyway, so - if we output so much we'll crash anyway. */ - i = vsnprintf(buf, -1, fmt, args); - va_end(args); - - return i; -} - int snprintf(char *buf, size_t size, const char *fmt, ...) { va_list args; diff --git a/src/include/string.h b/src/include/string.h index dc125e1..b4d0268 100644 --- a/src/include/string.h +++ b/src/include/string.h @@ -16,7 +16,6 @@ void *memset(void *s, int c, size_t n); int memcmp(const void *s1, const void *s2, size_t n); void *memchr(const void *s, int c, size_t n); #if !defined(__PRE_RAM__) -int sprintf(char * buf, const char *fmt, ...); int snprintf(char * buf, size_t size, const char *fmt, ...); #endif

1 0

New patch to review for coreboot: 27f2049 snprintf: lockless operation
by Vladimir Serbinenko 26 Nov '13

26 Nov '13

Vladimir Serbinenko (phcoder(a)gmail.com) just uploaded a new patch set to gerrit, which you can find at http://review.coreboot.org/4288 -gerrit commit 27f204932f36cdecf54b5b8ddad48c88e6c91bd1 Author: Vladimir Serbinenko <phcoder(a)gmail.com> Date: Tue Nov 26 21:48:57 2013 +0100 snprintf: lockless operation Instead of having global variables put them on the stack. Change-Id: I462e3b245612ff2dfb077da1cbcc5ac88f8b8e48 Signed-off-by: Vladimir Serbinenko <phcoder(a)gmail.com> --- src/console/vsprintf.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/src/console/vsprintf.c b/src/console/vsprintf.c index 435401b..6210d01 100644 --- a/src/console/vsprintf.c +++ b/src/console/vsprintf.c @@ -20,32 +20,32 @@ */ #include <string.h> -#include <smp/spinlock.h> #include <console/vtxprintf.h> #include <trace.h> -DECLARE_SPIN_LOCK(vsprintf_lock) - -static char *str_buf; +struct context +{ + char *str_buf; +}; -static void str_tx_byte(unsigned char byte) +static void str_tx_byte(unsigned char byte, void *data) { - *str_buf = byte; - str_buf++; + struct context *ctx = data; + *ctx->str_buf = byte; + ctx->str_buf++; } static int vsprintf(char *buf, const char *fmt, va_list args) { int i; + struct context ctx; DISABLE_TRACE; - spin_lock(&vsprintf_lock); - str_buf = buf; - i = vtxprintf(str_tx_byte, fmt, args); - *str_buf = '\0'; + ctx.str_buf = buf; + i = vtxdprintf(str_tx_byte, fmt, args, &ctx); + *ctx.str_buf = '\0'; - spin_unlock(&vsprintf_lock); ENABLE_TRACE; return i;

1 0

New patch to review for coreboot: c752639 vtxprintf: Introduce vtxdprintf for the ease of closures
by Vladimir Serbinenko 26 Nov '13

26 Nov '13

Vladimir Serbinenko (phcoder(a)gmail.com) just uploaded a new patch set to gerrit, which you can find at http://review.coreboot.org/4287 -gerrit commit c752639c3c556791cf56171bf335678b537bc8bb Author: Vladimir Serbinenko <phcoder(a)gmail.com> Date: Tue Nov 26 21:43:05 2013 +0100 vtxprintf: Introduce vtxdprintf for the ease of closures It was suggested to eliminate the lock for sprintf. One way to do it is to make the fake tx_byte into a closure. This patch allows it. It's a bit tricky since we need to preserve compatibility with romcc. Change-Id: I877ef0cef54dcbb0589fe858c485f76f3dd27ece Signed-off-by: Vladimir Serbinenko <phcoder(a)gmail.com> --- src/console/vtxprintf.c | 77 ++++++++++++++++++++++++++++------------- src/include/console/vtxprintf.h | 4 +++ 2 files changed, 57 insertions(+), 24 deletions(-) diff --git a/src/console/vtxprintf.c b/src/console/vtxprintf.c index 4fc6f35..df62897 100644 --- a/src/console/vtxprintf.c +++ b/src/console/vtxprintf.c @@ -8,6 +8,16 @@ #include <console/console.h> #include <console/vtxprintf.h> +#ifndef __ROMCC__ +#define DATA_ARG , data +#define DATA_ARG_DECL , void *data +#else +#define DATA_ARG +#define DATA_ARG_DECL +#endif + +#define call_tx(x) tx_byte(x DATA_ARG) + /* haha, don't need ctype.c */ #define isdigit(c) ((c) >= '0' && (c) <= '9') #define is_digit isdigit @@ -30,8 +40,9 @@ static int skip_atoi(const char **s) #define SPECIAL 32 /* 0x */ #define LARGE 64 /* use 'ABCDEF' instead of 'abcdef' */ -static int number(void (*tx_byte)(unsigned char byte), - unsigned long long num, int base, int size, int precision, int type) +static int number(void (*tx_byte)(unsigned char byte DATA_ARG_DECL), + unsigned long long num, int base, int size, int precision, int type + DATA_ARG_DECL) { char c,sign,tmp[66]; const char *digits="0123456789abcdefghijklmnopqrstuvwxyz"; @@ -77,31 +88,36 @@ static int number(void (*tx_byte)(unsigned char byte), size -= precision; if (!(type&(ZEROPAD+LEFT))) while(size-->0) - tx_byte(' '), count++; + call_tx(' '), count++; if (sign) - tx_byte(sign), count++; + call_tx(sign), count++; if (type & SPECIAL) { if (base==8) - tx_byte('0'), count++; + call_tx('0'), count++; else if (base==16) { - tx_byte('0'), count++; - tx_byte(digits[33]), count++; + call_tx('0'), count++; + call_tx(digits[33]), count++; } } if (!(type & LEFT)) while (size-- > 0) - tx_byte(c), count++; + call_tx(c), count++; while (i < precision--) - tx_byte('0'), count++; + call_tx('0'), count++; while (i-- > 0) - tx_byte(tmp[i]), count++; + call_tx(tmp[i]), count++; while (size-- > 0) - tx_byte(' '), count++; + call_tx(' '), count++; return count; } -int vtxprintf(void (*tx_byte)(unsigned char byte), const char *fmt, va_list args) +#ifndef __ROMCC__ +int vtxdprintf(void (*tx_byte)(unsigned char byte, void *data), + const char *fmt, va_list args, void *data) +#else +int vtxprintf(void (*tx_byte)(unsigned char byte), const char *fmt, va_list args); +#endif { int len; unsigned long long num; @@ -124,7 +140,7 @@ int vtxprintf(void (*tx_byte)(unsigned char byte), const char *fmt, va_list args for (count=0; *fmt ; ++fmt) { if (*fmt != '%') { - tx_byte(*fmt), count++; + call_tx(*fmt), count++; continue; } @@ -187,10 +203,10 @@ repeat: case 'c': if (!(flags & LEFT)) while (--field_width > 0) - tx_byte(' '), count++; - tx_byte((unsigned char) va_arg(args, int)), count++; + call_tx(' '), count++; + call_tx((unsigned char) va_arg(args, int)), count++; while (--field_width > 0) - tx_byte(' '), count++; + call_tx(' '), count++; continue; case 's': @@ -202,11 +218,11 @@ repeat: if (!(flags & LEFT)) while (len < field_width--) - tx_byte(' '), count++; + call_tx(' '), count++; for (i = 0; i < len; ++i) - tx_byte(*s++), count++; + call_tx(*s++), count++; while (len < field_width--) - tx_byte(' '), count++; + call_tx(' '), count++; continue; case 'p': @@ -216,7 +232,7 @@ repeat: } count += number(tx_byte, (unsigned long) va_arg(args, void *), 16, - field_width, precision, flags); + field_width, precision, flags DATA_ARG); continue; case 'n': @@ -233,7 +249,7 @@ repeat: continue; case '%': - tx_byte('%'), count++; + call_tx('%'), count++; continue; /* integer number formats - set up the flags and "break" */ @@ -254,9 +270,9 @@ repeat: break; default: - tx_byte('%'), count++; + call_tx('%'), count++; if (*fmt) - tx_byte(*fmt), count++; + call_tx(*fmt), count++; else --fmt; continue; @@ -276,8 +292,21 @@ repeat: } else { num = va_arg(args, unsigned int); } - count += number(tx_byte, num, base, field_width, precision, flags); + count += number(tx_byte, num, base, field_width, precision, flags DATA_ARG); } return count; } + +#ifndef __ROMCC__ +static void wrap_tx_byte (unsigned char byte, void *data) +{ + void (*tx_byte)(unsigned char byte) = data; + tx_byte (byte); +} + +int vtxprintf(void (*tx_byte)(unsigned char byte), const char *fmt, va_list args) +{ + return vtxdprintf(wrap_tx_byte, fmt, args, tx_byte); +} +#endif diff --git a/src/include/console/vtxprintf.h b/src/include/console/vtxprintf.h index 2cf44de..4e56827 100644 --- a/src/include/console/vtxprintf.h +++ b/src/include/console/vtxprintf.h @@ -36,4 +36,8 @@ typedef __builtin_va_list va_list; int vtxprintf(void (*tx_byte)(unsigned char byte), const char *fmt, va_list args); +#ifndef __ROMCC__ +int vtxdprintf(void (*tx_byte)(unsigned char byte, void *data), const char *fmt, va_list args, void *data); +#endif + #endif

1 0

Patch set updated for coreboot: 00dba6d console/vsprintf: Implement snprintf
by Vladimir Serbinenko 26 Nov '13

26 Nov '13

Vladimir Serbinenko (phcoder(a)gmail.com) just uploaded a new patch set to gerrit, which you can find at http://review.coreboot.org/4278 -gerrit commit 00dba6da719d2804572a25ba6643eb2179d66fba Author: Vladimir Serbinenko <phcoder(a)gmail.com> Date: Tue Nov 26 02:20:32 2013 +0100 console/vsprintf: Implement snprintf snprintf is a safe variant of sprintf. To avoid buffer overflows we shouldn't use sprintf at all. But for now let's start by implementing snprintf in first place. Change-Id: Ic17d94b8cd91b72f66b84b0589a06b8abef5e5c9 Signed-off-by: Vladimir Serbinenko <phcoder(a)gmail.com> --- src/console/vsprintf.c | 30 +++++++++++++++++++++++++----- src/include/string.h | 1 + 2 files changed, 26 insertions(+), 5 deletions(-) diff --git a/src/console/vsprintf.c b/src/console/vsprintf.c index 6210d01..f055d61 100644 --- a/src/console/vsprintf.c +++ b/src/console/vsprintf.c @@ -26,16 +26,20 @@ struct context { char *str_buf; + size_t buf_limit; }; static void str_tx_byte(unsigned char byte, void *data) { struct context *ctx = data; - *ctx->str_buf = byte; - ctx->str_buf++; + if (ctx->buf_limit) { + *ctx->str_buf = byte; + ctx->str_buf++; + ctx->buf_limit--; + } } -static int vsprintf(char *buf, const char *fmt, va_list args) +static int vsnprintf(char *buf, size_t size, const char *fmt, va_list args) { int i; struct context ctx; @@ -43,8 +47,10 @@ static int vsprintf(char *buf, const char *fmt, va_list args) DISABLE_TRACE; ctx.str_buf = buf; + ctx.buf_limit = size ? size - 1 : 0; i = vtxdprintf(str_tx_byte, fmt, args, &ctx); - *ctx.str_buf = '\0'; + if (size) + *ctx.str_buf = '\0'; ENABLE_TRACE; @@ -57,7 +63,21 @@ int sprintf(char *buf, const char *fmt, ...) int i; va_start(args, fmt); - i = vsprintf(buf, fmt, args); + /* A trick: we have at most (size_t)-1 adressable space anyway, so + if we output so much we'll crash anyway. */ + i = vsnprintf(buf, -1, fmt, args); + va_end(args); + + return i; +} + +int snprintf(char *buf, size_t size, const char *fmt, ...) +{ + va_list args; + int i; + + va_start(args, fmt); + i = vsnprintf(buf, size, fmt, args); va_end(args); return i; diff --git a/src/include/string.h b/src/include/string.h index 77985e1..dc125e1 100644 --- a/src/include/string.h +++ b/src/include/string.h @@ -17,6 +17,7 @@ int memcmp(const void *s1, const void *s2, size_t n); void *memchr(const void *s, int c, size_t n); #if !defined(__PRE_RAM__) int sprintf(char * buf, const char *fmt, ...); +int snprintf(char * buf, size_t size, const char *fmt, ...); #endif // simple string functions

1 0

Patch set updated for coreboot: 9567bf3 Replace all occurences of sprintf with snprintf
by Vladimir Serbinenko 26 Nov '13

26 Nov '13

Vladimir Serbinenko (phcoder(a)gmail.com) just uploaded a new patch set to gerrit, which you can find at http://review.coreboot.org/4279 -gerrit commit 9567bf35926e6e9c2caef2f2f16d2a40a452ed4f Author: Vladimir Serbinenko <phcoder(a)gmail.com> Date: Tue Nov 26 02:41:26 2013 +0100 Replace all occurences of sprintf with snprintf THis reduces risks of bufer overflows. Change-Id: I77f80e76efec16ac0a0af83d76430a8126a7602d Signed-off-by: Vladimir Serbinenko <phcoder(a)gmail.com> --- src/arch/x86/boot/acpigen.c | 3 +- src/device/device_util.c | 83 ++++++++++++---------- src/device/oprom/x86emu/debug.c | 8 +-- src/mainboard/google/link/i915.c | 2 +- src/mainboard/google/stout/i915.c | 2 +- src/mainboard/intel/wtm2/i915.c | 2 +- src/mainboard/lenovo/x60/i915.c | 2 +- src/northbridge/amd/agesa/family10/northbridge.c | 2 +- src/northbridge/amd/agesa/family12/northbridge.c | 2 +- src/northbridge/amd/agesa/family14/northbridge.c | 2 +- src/northbridge/amd/agesa/family15/northbridge.c | 2 +- src/northbridge/amd/agesa/family15tn/northbridge.c | 2 +- src/northbridge/amd/agesa/family16kb/northbridge.c | 2 +- src/northbridge/amd/amdfam10/acpi.c | 2 +- src/northbridge/amd/amdfam10/northbridge.c | 4 +- src/northbridge/amd/amdk8/northbridge.c | 4 +- 16 files changed, 67 insertions(+), 57 deletions(-) diff --git a/src/arch/x86/boot/acpigen.c b/src/arch/x86/boot/acpigen.c index 121cb22..6496d75 100644 --- a/src/arch/x86/boot/acpigen.c +++ b/src/arch/x86/boot/acpigen.c @@ -274,7 +274,8 @@ int acpigen_write_processor(u8 cpuindex, u32 pblock_addr, u8 pblock_len) acpigen_emit_byte(0x83); len = acpigen_write_len_f(); - sprintf(pscope, "\\_PR.CPU%x", (unsigned int) cpuindex); + snprintf(pscope, sizeof (pscope), + "\\_PR.CPU%x", (unsigned int) cpuindex); len += acpigen_emit_namestring(pscope); acpigen_emit_byte(cpuindex); acpigen_emit_byte(pblock_addr & 0xff); diff --git a/src/device/device_util.c b/src/device/device_util.c index d2c99e1..b35911b 100644 --- a/src/device/device_util.c +++ b/src/device/device_util.c @@ -176,48 +176,52 @@ const char *dev_path(device_t dev) break; case DEVICE_PATH_PCI: #if CONFIG_PCI_BUS_SEGN_BITS - sprintf(buffer, "PCI: %04x:%02x:%02x.%01x", - dev->bus->secondary >> 8, - dev->bus->secondary & 0xff, - PCI_SLOT(dev->path.pci.devfn), - PCI_FUNC(dev->path.pci.devfn)); + snprintf(buffer, sizeof (buffer), + "PCI: %04x:%02x:%02x.%01x", + dev->bus->secondary >> 8, + dev->bus->secondary & 0xff, + PCI_SLOT(dev->path.pci.devfn), + PCI_FUNC(dev->path.pci.devfn)); #else - sprintf(buffer, "PCI: %02x:%02x.%01x", - dev->bus->secondary, - PCI_SLOT(dev->path.pci.devfn), - PCI_FUNC(dev->path.pci.devfn)); + snprintf(buffer, sizeof (buffer), + "PCI: %02x:%02x.%01x", + dev->bus->secondary, + PCI_SLOT(dev->path.pci.devfn), + PCI_FUNC(dev->path.pci.devfn)); #endif break; case DEVICE_PATH_PNP: - sprintf(buffer, "PNP: %04x.%01x", - dev->path.pnp.port, dev->path.pnp.device); + snprintf(buffer, sizeof (buffer), "PNP: %04x.%01x", + dev->path.pnp.port, dev->path.pnp.device); break; case DEVICE_PATH_I2C: - sprintf(buffer, "I2C: %02x:%02x", - dev->bus->secondary, - dev->path.i2c.device); + snprintf(buffer, sizeof (buffer), "I2C: %02x:%02x", + dev->bus->secondary, + dev->path.i2c.device); break; case DEVICE_PATH_APIC: - sprintf(buffer, "APIC: %02x", - dev->path.apic.apic_id); + snprintf(buffer, sizeof (buffer), "APIC: %02x", + dev->path.apic.apic_id); break; case DEVICE_PATH_IOAPIC: - sprintf(buffer, "IOAPIC: %02x", - dev->path.ioapic.ioapic_id); + snprintf(buffer, sizeof (buffer), "IOAPIC: %02x", + dev->path.ioapic.ioapic_id); break; case DEVICE_PATH_DOMAIN: - sprintf(buffer, "DOMAIN: %04x", + snprintf(buffer, sizeof (buffer), "DOMAIN: %04x", dev->path.domain.domain); break; case DEVICE_PATH_CPU_CLUSTER: - sprintf(buffer, "CPU_CLUSTER: %01x", + snprintf(buffer, sizeof (buffer), "CPU_CLUSTER: %01x", dev->path.cpu_cluster.cluster); break; case DEVICE_PATH_CPU: - sprintf(buffer, "CPU: %02x", dev->path.cpu.id); + snprintf(buffer, sizeof (buffer), + "CPU: %02x", dev->path.cpu.id); break; case DEVICE_PATH_CPU_BUS: - sprintf(buffer, "CPU_BUS: %02x", dev->path.cpu_bus.id); + snprintf(buffer, sizeof (buffer), + "CPU_BUS: %02x", dev->path.cpu_bus.id); break; default: printk(BIOS_ERR, "Unknown device path type: %d\n", @@ -241,7 +245,8 @@ const char *dev_name(device_t dev) const char *bus_path(struct bus *bus) { static char buffer[BUS_PATH_MAX]; - sprintf(buffer, "%s,%d", dev_path(bus->dev), bus->link_num); + snprintf(buffer, sizeof (buffer), + "%s,%d", dev_path(bus->dev), bus->link_num); return buffer; } @@ -529,15 +534,15 @@ resource_t resource_max(struct resource *resource) const char *resource_type(struct resource *resource) { static char buffer[RESOURCE_TYPE_MAX]; - sprintf(buffer, "%s%s%s%s", - ((resource->flags & IORESOURCE_READONLY) ? "ro" : ""), - ((resource->flags & IORESOURCE_PREFETCH) ? "pref" : ""), - ((resource->flags == 0) ? "unused" : - (resource->flags & IORESOURCE_IO) ? "io" : - (resource->flags & IORESOURCE_DRQ) ? "drq" : - (resource->flags & IORESOURCE_IRQ) ? "irq" : - (resource->flags & IORESOURCE_MEM) ? "mem" : "??????"), - ((resource->flags & IORESOURCE_PCI64) ? "64" : "")); + snprintf(buffer, sizeof (buffer), "%s%s%s%s", + ((resource->flags & IORESOURCE_READONLY) ? "ro" : ""), + ((resource->flags & IORESOURCE_PREFETCH) ? "pref" : ""), + ((resource->flags == 0) ? "unused" : + (resource->flags & IORESOURCE_IO) ? "io" : + (resource->flags & IORESOURCE_DRQ) ? "drq" : + (resource->flags & IORESOURCE_IRQ) ? "irq" : + (resource->flags & IORESOURCE_MEM) ? "mem" : "??????"), + ((resource->flags & IORESOURCE_PCI64) ? "64" : "")); return buffer; } @@ -563,10 +568,12 @@ void report_resource_stored(device_t dev, struct resource *resource, if (resource->flags & IORESOURCE_PCI_BRIDGE) { #if CONFIG_PCI_BUS_SEGN_BITS - sprintf(buf, "bus %04x:%02x ", dev->bus->secondary >> 8, + snprintf(buf, sizeof (buf), + "bus %04x:%02x ", dev->bus->secondary >> 8, dev->link_list->secondary & 0xff); #else - sprintf(buf, "bus %02x ", dev->link_list->secondary); + snprintf(buf, sizeof (buf), + "bus %02x ", dev->link_list->secondary); #endif } printk(BIOS_DEBUG, "%s %02lx <- [0x%010llx - 0x%010llx] size 0x%08llx " @@ -775,10 +782,12 @@ void show_one_resource(int debug_level, struct device *dev, /* if (resource->flags & IORESOURCE_BRIDGE) { #if CONFIG_PCI_BUS_SEGN_BITS - sprintf(buf, "bus %04x:%02x ", dev->bus->secondary >> 8, - dev->link[0].secondary & 0xff); + snprintf(buf, sizeof (buf), "bus %04x:%02x ", + dev->bus->secondary >> 8, + dev->link[0].secondary & 0xff); #else - sprintf(buf, "bus %02x ", dev->link[0].secondary); + snprintf(buf, sizeof (buf), + "bus %02x ", dev->link[0].secondary); #endif } */ diff --git a/src/device/oprom/x86emu/debug.c b/src/device/oprom/x86emu/debug.c index b3f4b6e..e7a111b 100644 --- a/src/device/oprom/x86emu/debug.c +++ b/src/device/oprom/x86emu/debug.c @@ -163,15 +163,15 @@ void x86emu_inc_decoded_inst_len (int x) void x86emu_decode_printf (const char *x) { - sprintf(M.x86.decoded_buf+M.x86.enc_str_pos,"%s",x); + strcpy(M.x86.decoded_buf+M.x86.enc_str_pos,x); M.x86.enc_str_pos += strlen(x); } void x86emu_decode_printf2 (const char *x, int y) { char temp[100]; - sprintf(temp,x,y); - sprintf(M.x86.decoded_buf+M.x86.enc_str_pos,"%s",temp); + snprintf(temp, sizeof (temp), x,y); + strcpy(M.x86.decoded_buf+M.x86.enc_str_pos,temp); M.x86.enc_str_pos += strlen(temp); } @@ -186,7 +186,7 @@ static void print_encoded_bytes (u16 s, u16 o) int i; char buf1[64]; for (i=0; i< M.x86.enc_pos; i++) { - sprintf(buf1+2*i,"%02x", fetch_data_byte_abs(s,o+i)); + snprintf(buf1+2*i, 64 - 2 * i, "%02x", fetch_data_byte_abs(s,o+i)); } printf("%-20s ",buf1); } diff --git a/src/mainboard/google/link/i915.c b/src/mainboard/google/link/i915.c index 42b9c0f..079ae02 100644 --- a/src/mainboard/google/link/i915.c +++ b/src/mainboard/google/link/i915.c @@ -78,7 +78,7 @@ const u32 link_edid_data[] = { static char *regname(unsigned long addr) { static char name[16]; - sprintf(name, "0x%lx", addr); + snprintf(name, sizeof (name), "0x%lx", addr); return name; } diff --git a/src/mainboard/google/stout/i915.c b/src/mainboard/google/stout/i915.c index 89a8594..8085de6 100644 --- a/src/mainboard/google/stout/i915.c +++ b/src/mainboard/google/stout/i915.c @@ -88,7 +88,7 @@ setgtt(int start, int end, unsigned long base, int inc) static char *regname(unsigned long addr) { static char name[16]; - sprintf(name, "0x%lx", addr); + snprintf(name, sizeof (name), "0x%lx", addr); return name; } diff --git a/src/mainboard/intel/wtm2/i915.c b/src/mainboard/intel/wtm2/i915.c index df88138..b664c35 100644 --- a/src/mainboard/intel/wtm2/i915.c +++ b/src/mainboard/intel/wtm2/i915.c @@ -88,7 +88,7 @@ static int ioread = 0, iowrite = 0; static char *regname(unsigned long addr) { static char name[16]; - sprintf(name, "0x%lx", addr); + snprintf(name, sizeof (name), "0x%lx", addr); return name; } diff --git a/src/mainboard/lenovo/x60/i915.c b/src/mainboard/lenovo/x60/i915.c index f130c5c..93f60a8 100644 --- a/src/mainboard/lenovo/x60/i915.c +++ b/src/mainboard/lenovo/x60/i915.c @@ -81,7 +81,7 @@ const u32 x60_edid_data[] = { static char *regname(unsigned long addr) { static char name[16]; - sprintf(name, "0x%lx", addr); + snprintf(name, sizeof (name), "0x%lx", addr); return name; } diff --git a/src/northbridge/amd/agesa/family10/northbridge.c b/src/northbridge/amd/agesa/family10/northbridge.c index 1c7e547..60f3951 100644 --- a/src/northbridge/amd/agesa/family10/northbridge.c +++ b/src/northbridge/amd/agesa/family10/northbridge.c @@ -657,7 +657,7 @@ static void amdfam10_set_resource(device_t dev, struct resource *resource, store_conf_mmio_addr(nodeid, link_num, reg, (resource->index >>24), rbase>>8, rend>>8); } resource->flags |= IORESOURCE_STORED; - sprintf(buf, " <node %x link %x>", + snprintf(buf, sizeof (buf), " <node %x link %x>", nodeid, link_num); report_resource_stored(dev, resource, buf); } diff --git a/src/northbridge/amd/agesa/family12/northbridge.c b/src/northbridge/amd/agesa/family12/northbridge.c index e6be598..9757d96 100644 --- a/src/northbridge/amd/agesa/family12/northbridge.c +++ b/src/northbridge/amd/agesa/family12/northbridge.c @@ -402,7 +402,7 @@ static void set_resource(device_t dev, struct resource *resource, set_mmio_addr_reg(nodeid, link_num, reg, (resource->index >>24), rbase>>8, rend>>8, 1) ;// [39:8] } resource->flags |= IORESOURCE_STORED; - sprintf(buf, " <node %x link %x>", + snprintf(buf, sizeof (buf), " <node %x link %x>", nodeid, link_num); report_resource_stored(dev, resource, buf); printk(BIOS_DEBUG, "Fam12h - northbridge.c - %s - End.\n",__func__); diff --git a/src/northbridge/amd/agesa/family14/northbridge.c b/src/northbridge/amd/agesa/family14/northbridge.c index 7cc812b..847e6dd 100644 --- a/src/northbridge/amd/agesa/family14/northbridge.c +++ b/src/northbridge/amd/agesa/family14/northbridge.c @@ -402,7 +402,7 @@ static void set_resource(device_t dev, struct resource *resource, u32 nodeid) rbase >> 8, rend >> 8, 1); // [39:8] } resource->flags |= IORESOURCE_STORED; - sprintf(buf, " <node %x link %x>", nodeid, link_num); + snprintf(buf, sizeof (buf), " <node %x link %x>", nodeid, link_num); report_resource_stored(dev, resource, buf); } diff --git a/src/northbridge/amd/agesa/family15/northbridge.c b/src/northbridge/amd/agesa/family15/northbridge.c index a8cc1cc..aa9ec56 100644 --- a/src/northbridge/amd/agesa/family15/northbridge.c +++ b/src/northbridge/amd/agesa/family15/northbridge.c @@ -400,7 +400,7 @@ static void set_resource(device_t dev, struct resource *resource, u32 nodeid) set_mmio_addr_reg(nodeid, link_num, reg, (resource->index >>24), rbase>>8, rend>>8, node_nums) ;// [39:8] } resource->flags |= IORESOURCE_STORED; - sprintf(buf, " <node %x link %x>", + snprintf(buf, sizeof (buf), " <node %x link %x>", nodeid, link_num); report_resource_stored(dev, resource, buf); } diff --git a/src/northbridge/amd/agesa/family15tn/northbridge.c b/src/northbridge/amd/agesa/family15tn/northbridge.c index b55d52b..2b5549d 100644 --- a/src/northbridge/amd/agesa/family15tn/northbridge.c +++ b/src/northbridge/amd/agesa/family15tn/northbridge.c @@ -393,7 +393,7 @@ static void set_resource(device_t dev, struct resource *resource, u32 nodeid) set_mmio_addr_reg(nodeid, link_num, reg, (resource->index >>24), rbase>>8, rend>>8, node_nums) ;// [39:8] } resource->flags |= IORESOURCE_STORED; - sprintf(buf, " <node %x link %x>", + snprintf(buf, sizeof (buf), " <node %x link %x>", nodeid, link_num); report_resource_stored(dev, resource, buf); } diff --git a/src/northbridge/amd/agesa/family16kb/northbridge.c b/src/northbridge/amd/agesa/family16kb/northbridge.c index b8bba50..6feabf4 100644 --- a/src/northbridge/amd/agesa/family16kb/northbridge.c +++ b/src/northbridge/amd/agesa/family16kb/northbridge.c @@ -380,7 +380,7 @@ static void set_resource(device_t dev, struct resource *resource, u32 nodeid) set_mmio_addr_reg(nodeid, link_num, reg, (resource->index >>24), rbase>>8, rend>>8, node_nums) ;// [39:8] } resource->flags |= IORESOURCE_STORED; - sprintf(buf, " <node %x link %x>", + snprintf(buf, sizeof (buf), " <node %x link %x>", nodeid, link_num); report_resource_stored(dev, resource, buf); } diff --git a/src/northbridge/amd/amdfam10/acpi.c b/src/northbridge/amd/amdfam10/acpi.c index ee842d5..abba0ce 100644 --- a/src/northbridge/amd/amdfam10/acpi.c +++ b/src/northbridge/amd/amdfam10/acpi.c @@ -313,7 +313,7 @@ static void update_sspr(void *sspr, u32 nodeid, u32 cpuindex) CONTROL = sspr + 0x8d; STATUS = sspr + 0x8f; - sprintf((char*)CPU, "%02x", (char)cpuindex); + snprintf((char*)CPU, 3, "%02x", (char)cpuindex); *CPUIN = (u8) cpuindex; for(i=0;i<sysconf.p_state_num;i++) { diff --git a/src/northbridge/amd/amdfam10/northbridge.c b/src/northbridge/amd/amdfam10/northbridge.c index 6bcab41..26e040f 100644 --- a/src/northbridge/amd/amdfam10/northbridge.c +++ b/src/northbridge/amd/amdfam10/northbridge.c @@ -541,8 +541,8 @@ static void amdfam10_set_resource(device_t dev, struct resource *resource, store_conf_mmio_addr(nodeid, link_num, reg, (resource->index >>24), rbase>>8, rend>>8); } resource->flags |= IORESOURCE_STORED; - sprintf(buf, " <node %x link %x>", - nodeid, link_num); + snprintf(buf, sizeof (buf), " <node %x link %x>", + nodeid, link_num); report_resource_stored(dev, resource, buf); } diff --git a/src/northbridge/amd/amdk8/northbridge.c b/src/northbridge/amd/amdk8/northbridge.c index 8f0a11b..b0acdf7 100644 --- a/src/northbridge/amd/amdk8/northbridge.c +++ b/src/northbridge/amd/amdk8/northbridge.c @@ -479,8 +479,8 @@ static void amdk8_set_resource(device_t dev, struct resource *resource, unsigned f1_write_config32(reg, base); } resource->flags |= IORESOURCE_STORED; - sprintf(buf, " <node %x link %x>", - nodeid, link_num); + snprintf(buf, sizeof (buf), " <node %x link %x>", + nodeid, link_num); report_resource_stored(dev, resource, buf); }

1 0

Patch set updated for coreboot: 7433ddf Remove sprintf
by Vladimir Serbinenko 26 Nov '13

26 Nov '13

Vladimir Serbinenko (phcoder(a)gmail.com) just uploaded a new patch set to gerrit, which you can find at http://review.coreboot.org/4280 -gerrit commit 7433ddffb80fae3ed527c2ed0d0deeadb7004570 Author: Vladimir Serbinenko <phcoder(a)gmail.com> Date: Tue Nov 26 02:42:52 2013 +0100 Remove sprintf Remove sprintf as if you can't easily use snprintf then you probably have buffer overflow. Change-Id: Ic4570e099a52d743aca938a2bfadb95981adc503 Signed-off-by: Vladimir Serbinenko <phcoder(a)gmail.com> --- src/console/vsprintf.c | 14 -------------- src/include/string.h | 1 - 2 files changed, 15 deletions(-) diff --git a/src/console/vsprintf.c b/src/console/vsprintf.c index f055d61..53729b5 100644 --- a/src/console/vsprintf.c +++ b/src/console/vsprintf.c @@ -57,20 +57,6 @@ static int vsnprintf(char *buf, size_t size, const char *fmt, va_list args) return i; } -int sprintf(char *buf, const char *fmt, ...) -{ - va_list args; - int i; - - va_start(args, fmt); - /* A trick: we have at most (size_t)-1 adressable space anyway, so - if we output so much we'll crash anyway. */ - i = vsnprintf(buf, -1, fmt, args); - va_end(args); - - return i; -} - int snprintf(char *buf, size_t size, const char *fmt, ...) { va_list args; diff --git a/src/include/string.h b/src/include/string.h index dc125e1..b4d0268 100644 --- a/src/include/string.h +++ b/src/include/string.h @@ -16,7 +16,6 @@ void *memset(void *s, int c, size_t n); int memcmp(const void *s1, const void *s2, size_t n); void *memchr(const void *s, int c, size_t n); #if !defined(__PRE_RAM__) -int sprintf(char * buf, const char *fmt, ...); int snprintf(char * buf, size_t size, const char *fmt, ...); #endif

1 0

Patch merged into coreboot/master: 994611a lynxpoint: Add an inverted input GPIO type
by gerrit＠coreboot.org 26 Nov '13

26 Nov '13

the following patch was just integrated into master: commit 994611a6377cac10e7cc372450018ac625a7cd32 Author: Duncan Laurie <dlaurie(a)chromium.org> Date: Wed May 29 07:48:47 2013 -0700 lynxpoint: Add an inverted input GPIO type The wake device input pins are active low and the GPIOs need to be set as inverted when they are marked as an input so they are not spuriously logged. suspend/resume on slippy with trackpad wake: 8 | 2013-05-29 07:43:14 | ACPI Enter | S3 9 | 2013-05-29 07:43:18 | ACPI Wake | S3 10 | 2013-05-29 07:43:18 | Wake Source | GPIO | 12 and with power button wake: 11 | 2013-05-29 07:43:35 | ACPI Enter | S3 12 | 2013-05-29 07:43:40 | EC Event | Power Button 13 | 2013-05-29 07:43:40 | ACPI Wake | S3 14 | 2013-05-29 07:43:40 | Wake Source | Power Button | 0 Change-Id: I15d38dcc9b2fb4b2b0eb27da358fa3c343e22323 Signed-off-by: Duncan Laurie <dlaurie(a)chromium.org> Reviewed-on: https://gerrit.chromium.org/gerrit/56940 Reviewed-by: Aaron Durbin <adurbin(a)chromium.org> Reviewed-on: http://review.coreboot.org/4209 Tested-by: build bot (Jenkins) Reviewed-by: Stefan Reinauer <stefan.reinauer(a)coreboot.org> See http://review.coreboot.org/4209 for details. -gerrit

1 0

← Newer
1
2
3
4
5
6
7
8
...
86
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

coreboot-gerrit November 2013