Jacob Garber has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/33458
Change subject: sb/amd/sr5650: Add fine-grained bounds checking
......................................................................
sb/amd/sr5650: Add fine-grained bounds checking
The code currently checks that 4 <= dev_index <= 10, which after
subtraction by 4 can index into an array of length at most 7. This is
fine for the largest cpl array (which does have length 7), but is
too large for some of the others, which are smaller. This adds bounds
checks for each array access to ensure they are all within bounds.
Change-Id: I1610d35ca6cbb6cfb42c251e75b0e8b22b64252b
Signed-off-by: Jacob Garber <jgarber1(a)ualberta.ca>
Found-by: Coverity CID 1229676
---
M src/southbridge/amd/sr5650/pcie.c
1 file changed, 22 insertions(+), 10 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/58/33458/1
diff --git a/src/southbridge/amd/sr5650/pcie.c b/src/southbridge/amd/sr5650/pcie.c
index f87fadb..e90a997 100644
--- a/src/southbridge/amd/sr5650/pcie.c
+++ b/src/southbridge/amd/sr5650/pcie.c
@@ -360,41 +360,53 @@
static void gpp3a_cpl_buf_alloc(struct device *nb_dev, struct device *dev)
{
u8 dev_index;
- u8 *slave_cpl;
u8 value;
struct southbridge_amd_sr5650_config *cfg =
(struct southbridge_amd_sr5650_config *)nb_dev->chip_info;
dev_index = dev->path.pci.devfn >> 3;
- if (dev_index < 4 || dev_index > 0xa) {
+
+ if (dev_index < 4)
return;
- }
+
+ dev_index -= 4;
switch (cfg->gpp3a_configuration) {
case 0x1: /* 4:2:0:0:0:0 */
- slave_cpl = (u8 *)&pGpp420000;
+ if (dev_index >= ARRAY_SIZE(pGpp420000))
+ return;
+ value = pGpp420000[dev_index];
break;
case 0x2: /* 4:1:1:0:0:0 */
- slave_cpl = (u8 *)&pGpp411000;
+ if (dev_index >= ARRAY_SIZE(pGpp411000))
+ return;
+ value = pGpp411000[dev_index];
break;
case 0xC: /* 2:2:2:0:0:0 */
- slave_cpl = (u8 *)&pGpp222000;
+ if (dev_index >= ARRAY_SIZE(pGpp222000))
+ return;
+ value = pGpp222000[dev_index];
break;
case 0xA: /* 2:2:1:1:0:0 */
- slave_cpl = (u8 *)&pGpp221100;
+ if (dev_index >= ARRAY_SIZE(pGpp221100))
+ return;
+ value = pGpp221100[dev_index];
break;
case 0x4: /* 2:1:1:1:1:0 */
- slave_cpl = (u8 *)&pGpp211110;
+ if (dev_index >= ARRAY_SIZE(pGpp211110))
+ return;
+ value = pGpp211110[dev_index];
break;
case 0xB: /* 1:1:1:1:1:1 */
- slave_cpl = (u8 *)&pGpp111111;
+ if (dev_index >= ARRAY_SIZE(pGpp111111))
+ return;
+ value = pGpp111111[dev_index];
break;
default: /* shouldn't be here. */
printk(BIOS_WARNING, "buggy gpp3a_configuration\n");
return;
}
- value = slave_cpl[dev_index - 4];
if (value != 0) {
set_pcie_enable_bits(dev, 0x10, 0x3f << 8, value << 8);
set_pcie_enable_bits(dev, 0x20, 1 << 11, 1 << 11);
--
To view, visit https://review.coreboot.org/c/coreboot/+/33458
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I1610d35ca6cbb6cfb42c251e75b0e8b22b64252b
Gerrit-Change-Number: 33458
Gerrit-PatchSet: 1
Gerrit-Owner: Jacob Garber <jgarber1(a)ualberta.ca>
Gerrit-MessageType: newchange
Jacob Garber has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/33409
Change subject: nb/intel/x4x: Die on unknown memory speed
......................................................................
nb/intel/x4x: Die on unknown memory speed
The speed argument should be one of the six values from the mem_clk
enum, so something is very wrong if this is not the case. Better to
die() now than return 0, which will cause a division-by-zero error
later on where this function is called.
Change-Id: Ib628c0eed3d6571bdde1df27ae213ca0691ec256
Signed-off-by: Jacob Garber <jgarber1(a)ualberta.ca>
Found-by: Coverity CID 1391088
---
M src/northbridge/intel/x4x/raminit_ddr23.c
1 file changed, 1 insertion(+), 1 deletion(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/09/33409/1
diff --git a/src/northbridge/intel/x4x/raminit_ddr23.c b/src/northbridge/intel/x4x/raminit_ddr23.c
index 422b0ff..dae10cf 100644
--- a/src/northbridge/intel/x4x/raminit_ddr23.c
+++ b/src/northbridge/intel/x4x/raminit_ddr23.c
@@ -42,7 +42,7 @@
static const u16 mhz[] = { 0, 0, 667, 800, 1067, 1333 };
if (speed >= ARRAY_SIZE(mhz))
- return 0;
+ die("RAM init: unknown DDR2 speed %u\n", speed);
return mhz[speed];
}
--
To view, visit https://review.coreboot.org/c/coreboot/+/33409
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: Ib628c0eed3d6571bdde1df27ae213ca0691ec256
Gerrit-Change-Number: 33409
Gerrit-PatchSet: 1
Gerrit-Owner: Jacob Garber <jgarber1(a)ualberta.ca>
Gerrit-MessageType: newchange
Jacob Garber has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/33383
Change subject: nb/intel/nehalem: Prevent out of bounds read
......................................................................
nb/intel/nehalem: Prevent out of bounds read
Check that clock_speed_index is non-zero before decrementing it, else we
will get a very large out of bounds array access.
Change-Id: Ic8ed1293adfe0866781bd638323977abd110777e
Signed-off-by: Jacob Garber <jgarber1(a)ualberta.ca>
Found-by: Coverity CID 1229675
---
M src/northbridge/intel/nehalem/raminit.c
1 file changed, 2 insertions(+), 1 deletion(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/83/33383/1
diff --git a/src/northbridge/intel/nehalem/raminit.c b/src/northbridge/intel/nehalem/raminit.c
index 15d6abb..72a2c57 100644
--- a/src/northbridge/intel/nehalem/raminit.c
+++ b/src/northbridge/intel/nehalem/raminit.c
@@ -598,7 +598,8 @@
for (clock_speed_index = 0; clock_speed_index < 3; clock_speed_index++) {
if (cycletime == min_cycletime[clock_speed_index])
break;
- if (cycletime > min_cycletime[clock_speed_index]) {
+ if (cycletime > min_cycletime[clock_speed_index] &&
+ clock_speed_index != 0) {
clock_speed_index--;
cycletime = min_cycletime[clock_speed_index];
break;
--
To view, visit https://review.coreboot.org/c/coreboot/+/33383
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: Ic8ed1293adfe0866781bd638323977abd110777e
Gerrit-Change-Number: 33383
Gerrit-PatchSet: 1
Gerrit-Owner: Jacob Garber <jgarber1(a)ualberta.ca>
Gerrit-MessageType: newchange
Jacob Garber has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/33790
Change subject: sb/amd/{cimx,}/sb{700,800,900}: Prevent uninitialized reads
......................................................................
sb/amd/{cimx,}/sb{700,800,900}: Prevent uninitialized reads
"There are two hard things in computer science: cache invalidation,
naming things, and off-by-one errors."
var_num records the number of initialized entries in the reg_var array.
However, this means the index of the last initialized element is one
less than the value of var_num, so we need to take that into account
when indexing into the array. This has already been fixed in several
other places (eg. sb/amd/pi/hudson/lpc.c), so let's also do so here.
Change-Id: Ibefabaca42866a3f2b22eff979c73badf86ac317
Signed-off-by: Jacob Garber <jgarber1(a)ualberta.ca>
Found-by: scan-build 8.0.0
---
M src/southbridge/amd/cimx/sb800/lpc.c
M src/southbridge/amd/cimx/sb900/lpc.c
M src/southbridge/amd/sb700/lpc.c
M src/southbridge/amd/sb800/lpc.c
4 files changed, 12 insertions(+), 12 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/90/33790/1
diff --git a/src/southbridge/amd/cimx/sb800/lpc.c b/src/southbridge/amd/cimx/sb800/lpc.c
index a88d6d3..483d185 100644
--- a/src/southbridge/amd/cimx/sb800/lpc.c
+++ b/src/southbridge/amd/cimx/sb800/lpc.c
@@ -170,11 +170,11 @@
pci_write_config32(dev, 0x48, reg_x);
/* Set WideIO for as many IOs found (fall through is on purpose) */
switch (var_num) {
- case 2:
+ case 3:
pci_write_config16(dev, 0x90, reg_var[2]);
- case 1:
+ case 2:
pci_write_config16(dev, 0x66, reg_var[1]);
- case 0:
+ case 1:
//pci_write_config16(dev, 0x64, reg_var[0]); //cause filo can not find sata
break;
}
diff --git a/src/southbridge/amd/cimx/sb900/lpc.c b/src/southbridge/amd/cimx/sb900/lpc.c
index b04ecfa..8fcb947 100644
--- a/src/southbridge/amd/cimx/sb900/lpc.c
+++ b/src/southbridge/amd/cimx/sb900/lpc.c
@@ -168,11 +168,11 @@
pci_write_config32(dev, 0x48, reg_x);
/* Set WideIO for as many IOs found (fall through is on purpose) */
switch (var_num) {
- case 2:
+ case 3:
pci_write_config16(dev, 0x90, reg_var[2]);
- case 1:
+ case 2:
pci_write_config16(dev, 0x66, reg_var[1]);
- case 0:
+ case 1:
//pci_write_config16(dev, 0x64, reg_var[0]); //cause filo can not find sata
break;
}
diff --git a/src/southbridge/amd/sb700/lpc.c b/src/southbridge/amd/sb700/lpc.c
index 6f3be03..b7f0dc3 100644
--- a/src/southbridge/amd/sb700/lpc.c
+++ b/src/southbridge/amd/sb700/lpc.c
@@ -228,11 +228,11 @@
pci_write_config32(dev, 0x48, reg_x);
/* Set WideIO for as many IOs found (fall through is on purpose) */
switch (var_num) {
- case 2:
+ case 3:
pci_write_config16(dev, 0x90, reg_var[2]);
- case 1:
+ case 2:
pci_write_config16(dev, 0x66, reg_var[1]);
- case 0:
+ case 1:
pci_write_config16(dev, 0x64, reg_var[0]);
break;
}
diff --git a/src/southbridge/amd/sb800/lpc.c b/src/southbridge/amd/sb800/lpc.c
index 649add5..74b6374 100644
--- a/src/southbridge/amd/sb800/lpc.c
+++ b/src/southbridge/amd/sb800/lpc.c
@@ -220,11 +220,11 @@
pci_write_config32(dev, 0x48, reg_x);
/* Set WideIO for as many IOs found (fall through is on purpose) */
switch (var_num) {
- case 2:
+ case 3:
pci_write_config16(dev, 0x90, reg_var[2]);
- case 1:
+ case 2:
pci_write_config16(dev, 0x66, reg_var[1]);
- case 0:
+ case 1:
pci_write_config16(dev, 0x64, reg_var[0]);
break;
}
--
To view, visit https://review.coreboot.org/c/coreboot/+/33790
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: Ibefabaca42866a3f2b22eff979c73badf86ac317
Gerrit-Change-Number: 33790
Gerrit-PatchSet: 1
Gerrit-Owner: Jacob Garber <jgarber1(a)ualberta.ca>
Gerrit-MessageType: newchange