coreboot October 2016

coreboot@coreboot.org

55 participants
148 discussions

Re: [coreboot] GPIO configuration in coreboot
by Rolf Evers-Fischer 06 Oct '16

06 Oct '16

Dear Samuthria, when you configure a pin as PAD_VAL_OUTPUT, it's input function will be disabled and you will read always 0. I assume that the hw-pin will toggle, if you measure it. Please configure this pin as 'PAD_VAL_OUTPUT_ENABLE' instead of 'PAD_VAL_OUTPUT', since this will let the input direction enabled and I expect you will get a proper result while reading the pin status. Kind regards, Rolf

1 0

Re: [coreboot] Skylake FSP 1.1 without verstage?
by Zaolin 06 Oct '16

06 Oct '16

Hey Trammell, congratulations ! I guess you are releasing the coreboot payload at the 33c3 ? Could you please submit a bug report at ticket.coreboot.org for that issue. Best Regards Philipp On 10/06/2016 01:25 AM, Trammell Hudson wrote: > On Wed, Oct 05, 2016 at 03:19:11PM -0500, Aaron Durbin wrote: >> On Wed, Oct 5, 2016 at 3:08 PM, Trammell Hudson <hudson(a)trmm.net> wrote: >>> CBFS: 'Master Header Locator' located CBFS at [a00100:ffffc0) >>> CBFS: Locating 'fallback/ramstage' >>> CBFS: Found @ offset afc0 size 12e29 >>> Decompressing stage fallback/ramstage @ 0x7abbffc0 (743408 bytes) >>> Loading module at 7abc0000/7abc0000 with entry 7abc0000. filesize: 0x28d88 memsize: 0xb57b0 >>> Processing 2472 relocs. Offset value of 0x7aac0000 >>> src/arch/x86/boot.c:223: jumping to 7abc0000 >>> >>> (and then it crashes) >> You can try writing characters to the serial console in >> src/arch/x86/c_start.S. Do you have the ability to read post codes? >> That's the best way to know how deep you are getting through c_start.S >> in the jump to ramstage. > Thanks to a servo board, I can read the port 80 codes and verified > that the instruction causing the problem is the lgdt / jmp combo > in c_start.S: > > _start: > cli > lgdt %cs:gdtaddr > #ifndef __x86_64__ > ljmp $0x10, $1f > #endif > 1: movl $0x18, %eax // <---- never reached with relocatable > > >> [...] >> I'm not sure why it's crashing (or just not spitting anything out). >> You could certainly try disabling RELOCATABLE_RAMSTAE and see if that >> fairs better. > It looks like CONFIG_SOC_INTEL_SKYLAKE forces relocatable ramstage; > I've modified src/soc/intel/skylake/Kconfig to disable it and now > it makes it all the way into the payload. > > And by adding the i915 driver to the Linux payload, it is able to > bring up the console in a miniscule font! > > https://www.flickr.com/photos/osr/30026718432/in/photostream/lightbox/ > > I'm declaring today a huge success! >

2 1

Re: [coreboot] Skylake FSP 1.1 without verstage?
by Trammell Hudson 06 Oct '16

06 Oct '16

On Wed, Oct 05, 2016 at 03:19:11PM -0500, Aaron Durbin wrote: > On Wed, Oct 5, 2016 at 3:08 PM, Trammell Hudson <hudson(a)trmm.net> wrote: > > CBFS: 'Master Header Locator' located CBFS at [a00100:ffffc0) > > CBFS: Locating 'fallback/ramstage' > > CBFS: Found @ offset afc0 size 12e29 > > Decompressing stage fallback/ramstage @ 0x7abbffc0 (743408 bytes) > > Loading module at 7abc0000/7abc0000 with entry 7abc0000. filesize: 0x28d88 memsize: 0xb57b0 > > Processing 2472 relocs. Offset value of 0x7aac0000 > > src/arch/x86/boot.c:223: jumping to 7abc0000 > > > > (and then it crashes) > > You can try writing characters to the serial console in > src/arch/x86/c_start.S. Do you have the ability to read post codes? > That's the best way to know how deep you are getting through c_start.S > in the jump to ramstage. Thanks to a servo board, I can read the port 80 codes and verified that the instruction causing the problem is the lgdt / jmp combo in c_start.S: _start: cli lgdt %cs:gdtaddr #ifndef __x86_64__ ljmp $0x10, $1f #endif 1: movl $0x18, %eax // <---- never reached with relocatable > [...] > I'm not sure why it's crashing (or just not spitting anything out). > You could certainly try disabling RELOCATABLE_RAMSTAE and see if that > fairs better. It looks like CONFIG_SOC_INTEL_SKYLAKE forces relocatable ramstage; I've modified src/soc/intel/skylake/Kconfig to disable it and now it makes it all the way into the payload. And by adding the i915 driver to the Linux payload, it is able to bring up the console in a miniscule font! https://www.flickr.com/photos/osr/30026718432/in/photostream/lightbox/ I'm declaring today a huge success! -- Trammell

2 1

Re: [coreboot] Skylake FSP 1.1 without verstage?
by Trammell Hudson 05 Oct '16

05 Oct '16

On Wed, Oct 05, 2016 at 01:59:08PM -0500, Aaron Durbin wrote: > > Does the car stage code exist somewhere else in the tree? > > Try this? [...] > > -romstage-$(CONFIG_SEPARATE_VERSTAGE) += romstage_after_verstage.S > +romstage-y += romstage_after_verstage.S That works to make it past the romstage. Now it crashes when it loads the ramstage and tries to jump into it. Progress! > The transition to skylake using C_ENVIRONMENT_BOOTBLOCK looks to have > broken this combination. I think the above should make things work for > you. Let me know. It's better, although I'm still debugging. Here is the console log (this is using the fsp.bin and microcode blob extracted from the chromebook firmware): coreboot-4.4-1781-g2fcabb8-heads Wed Oct 5 01:45:23 UTC 2016 bootblock starting... Calling FspTempRamInit FspTempRamInit returned 0x00000000 CPU: Intel(R) Core(TM) m5-6Y57 CPU @ 1.10GHz CPU: ID 406e3, Skylake D0, ucode: 00000089 CPU: AES supported, TXT supported, VT supported MCH: device id 190c (rev 08) is Skylake-Y PCH: device id 9d46 (rev 21) is Skylake-Y Premium IGD: device id 191e (rev 07) is Skylake ULX GT2 CPU: frequency set to 1100 MHz CBFS: 'Master Header Locator' located CBFS at [a00100:ffffc0) CBFS: Locating 'fallback/romstage' CBFS: Found @ offset 80 size aecc src/arch/x86/boot.c:223: jumping to ffa00200 coreboot-4.4-1781-g2fcabb8-heads Wed Oct 5 01:45:23 UTC 2016 romstage starting... CBFS: 'Master Header Locator' located CBFS at [a00100:ffffc0) CBFS: Locating 'fsp.bin' CBFS: Found @ offset 4dfec0 size 7a000 CBFS: 'Master Header Locator' located CBFS at [a00100:ffffc0) CBFS: Locating 'cpu_microcode_blob.bin' CBFS: Found @ offset 411440 size 17800 microcode: sig=0x406e3 pf=0x80 revision=0x89 microcode: updated to revision 0x89 date=2016-04-06 CONFIG_MMCONF_BASE_ADDRESS: 0xe0000000 Using FSP 1.1 FSP_INFO_HEADER: ffee0094 FSP Signature: $SKLFSP$ FSP Header Version: 2 FSP Revision: 1.9.0.0 FSP Entry Points: 0xffee0000: Image Base 0xfff58ea3: TempRamInit 0xfff58fec: FspInit 0xfff59000: MemoryInit 0xfff5900a: TempRamExit 0xfff59014: SiliconInit 0xfff58ff6: NotifyPhase 0xfff5a000: Image End PM1_STS: 0100 PM1_EN: 0000 PM1_CNT: 00001c00 TCO_STS: 0000 0000 GPE0_STS: 00000000 00000000 00000000 00000000 GPE0_EN: 00000000 00000000 00000000 00000000 GEN_PMCON: e0a40200 0000520a GBLRST_CAUSE: 00000000 00000000 Previous Sleep State: S5 MLB: board version 4 Google Chrome set keyboard backlight: 0 status (0) SPD index 1 CBFS: 'Master Header Locator' located CBFS at [a00100:ffffc0) CBFS: Locating 'spd.bin' CBFS: Found @ offset 3cd380 size 600 SPD: module type is LPDDR3 SPD: module part is K4E6E304EE-EGCF SPD: banks 8, ranks 2, rows 14, columns 11, density 4096 Mb SPD: device width 16 bits, bus width 64 bits SPD: module size is 4096 MB (per channel) FMAP: Found "FLASH" version 1.1 at a00000. FMAP: base = ff000000 size = 1000000 #areas = 3 No MRC cache found. VPD Data: 0xfff0215c UPD Data: 0xfff02198 Calling FspMemoryInit: 0xfff59000 0x00000000: NvsBufferPtr 0xfef034d8: RtBufferPtr 0xfef03480: HobListPtr FspMemoryInit returned 0x00000000 Reserving 0x0000000000200000 bytes for FSP 0x00800000: smm_size 0x7b000000: smm_base 0x7af00000: cbmem_top CBMEM: IMD: root @ 7aeff000 254 entries. IMD: root @ 7aefec00 62 entries. External stage cache: IMD: root @ 7b3ff000 254 entries. IMD: root @ 7b3fec00 62 entries. FSP_SMBIOS_MEMORY_INFO HOB: 0x7ad29500 0x7acfe000: fsp_reserved_memory_area MRC data at 7ad295a8 6256 bytes Relocate MRC DATA from 7ad295a8 to 7ac7b000 (6256 bytes) CBMEM entry for DIMM info: 0x7aefe8c0 2 DIMMs found Calling FspTempRamExit API FspTempRamExit returned successfully CBFS: 'Master Header Locator' located CBFS at [a00100:ffffc0) CBFS: Locating 'fallback/ramstage' CBFS: Found @ offset afc0 size 12e29 Decompressing stage fallback/ramstage @ 0x7abbffc0 (743408 bytes) Loading module at 7abc0000/7abc0000 with entry 7abc0000. filesize: 0x28d88 memsize: 0xb57b0 Processing 2472 relocs. Offset value of 0x7aac0000 src/arch/x86/boot.c:223: jumping to 7abc0000 (and then it crashes) -- Trammell

2 1

Skylake FSP 1.1 without verstage?
by Trammell Hudson 05 Oct '16

05 Oct '16

On Skylake with no verstage and FSP 1.1 there is no car_stage_entry function, only a weak symbol with an infinite loop in src/arch/x86/assembly_entry.S, and as a result coreboot hangs after jumping into the romstage. There is one defined in src/soc/intel/skylake/romstage/car_stage.S, but this is only linked if FSP 2.0 is used. The Chell chromebook appears to use FSP 1.1, so I don't have the FSP-S and FSP-M binaries. Does the car stage code exist somewhere else in the tree? -- Trammell

2 1

GPIO configuration in coreboot
by Samuthira Pandian T 05 Oct '16

05 Oct '16

Hi Team, We need to configure two GPIO pins as output mode and toggle it in romstage(romstage.c) and ramstage (mainboard.c). Currently we are using below function calls to toggle the gpio, but it is not working. GPIO Pin Number : 59 romstage.c ---------- configure_score_gpio(59, PAD_FUNC0 | PAD_PULL_UP | PAD_PU_10K, PAD_VAL_OUTPUT | PAD_VAL_LOW); write_score_gpio(59, PAD_VAL_LOW); printk(BIOS_NOTICE, "gpio status : %d\n", read_score_gpio(59)); // output : gpio status : 0 write_score_gpio(59, PAD_VAL_HIGH); printk(BIOS_NOTICE, "gpio status : %d\n", read_score_gpio(59)); // output : gpio status : 0 We are getting gpio status as "0" for the both the function calls. Kindly give us your input for the same. Regards, Samuthria "DISCLAIMER: This message is proprietary to Aricent and is intended solely for the use of the individual to whom it is addressed. It may contain privileged or confidential information and should not be circulated or used for any purpose other than for what it is intended. If you have received this message in error, please notify the originator immediately. If you are not the intended recipient, you are notified that you are strictly prohibited from using, copying, altering, or disclosing the contents of this message. Aricent accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus."

1 0

Re: [coreboot] How to pass custom defined data from Coreboot to GRUB2
by Paul Menzel 05 Oct '16

05 Oct '16

Dear Mohan, Am Montag, den 03.10.2016, 11:06 +0000 schrieb Mohan Shanmuga Sundaram: > I have a requirement to pass the state value of a GPIO (on Intel ATOM > Baytrail SoC) from Coreboot to GRUB2. Based on this GPIO state, I > would script the GRUB2 to configuration to select an alternative OS > from the GRUB menu list. Is there a facility to pass this custom > defined data from Coreboot to GRUB2? I suggest to use CBTABLES for that. GRUB also can read that. Thanks, Paul [1] grub-core/kern/i386/coreboot/cbtable.c PS: Please note, that coreboot is written all lowercase. PPS: Please don’t add the disclaimer to the end of your messages. PPPS: Please just send plain text messages, and no HTML ones.

2 1

New Defects reported by Coverity Scan for coreboot
by scan-admin＠coverity.com 04 Oct '16

04 Oct '16

Hi, Please find the latest report on new defect(s) introduced to coreboot found with Coverity Scan. 46 new defect(s) introduced to coreboot found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 20 of 46 defect(s) ** CID 1361275: (TAINTED_SCALAR) /util/cbfstool/ifwitool.c: 838 in parse_subpart_dir() ________________________________________________________________________________________________________ *** CID 1361275: (TAINTED_SCALAR) /util/cbfstool/ifwitool.c: 831 in parse_subpart_dir() 825 memcpy(hdr.name, data + offset, sizeof(hdr.name)); 826 offset += sizeof(hdr.name); 827 828 validate_subpart_dir_without_checksum((struct subpart_dir *)&hdr, name); 829 830 assert(size > subpart_dir_size(&hdr)); >>> CID 1361275: (TAINTED_SCALAR) >>> Passing tainted variable "subpart_dir_size(&hdr)" to a tainted sink. 831 alloc_buffer(subpart_dir_buf, subpart_dir_size(&hdr), "Subpart Dir"); 832 memcpy(buffer_get(subpart_dir_buf), &hdr, SUBPART_DIR_HEADER_SIZE); 833 834 /* Read Subpart Dir entries. */ 835 struct subpart_dir *subpart_dir = buffer_get(subpart_dir_buf); 836 struct subpart_dir_entry *e = &subpart_dir->e[0]; /util/cbfstool/ifwitool.c: 838 in parse_subpart_dir() 832 memcpy(buffer_get(subpart_dir_buf), &hdr, SUBPART_DIR_HEADER_SIZE); 833 834 /* Read Subpart Dir entries. */ 835 struct subpart_dir *subpart_dir = buffer_get(subpart_dir_buf); 836 struct subpart_dir_entry *e = &subpart_dir->e[0]; 837 uint32_t i; >>> CID 1361275: (TAINTED_SCALAR) >>> Using tainted variable "hdr.num_entries" as a loop boundary. 838 for (i = 0; i < hdr.num_entries; i++) { 839 memcpy(e[i].name, data + offset, sizeof(e[i].name)); 840 offset += sizeof(e[i].name); 841 offset = read_member(data, offset, sizeof(e[i].offset), 842 &e[i].offset); 843 offset = read_member(data, offset, sizeof(e[i].length), ** CID 1361274: Insecure data handling (TAINTED_SCALAR) ________________________________________________________________________________________________________ *** CID 1361274: Insecure data handling (TAINTED_SCALAR) /util/cbfstool/ifwitool.c: 717 in alloc_bpdt_buffer() 711 { 712 struct bpdt_header bpdt_header; 713 assert((offset + BPDT_HEADER_SIZE) < size); 714 bpdt_read_header((uint8_t *)data + offset, &bpdt_header, name); 715 716 /* Buffer to read BPDT header and entries. */ >>> CID 1361274: Insecure data handling (TAINTED_SCALAR) >>> Passing tainted variable "get_bpdt_size(&bpdt_header)" to a tainted sink. 717 alloc_buffer(b, get_bpdt_size(&bpdt_header), name); 718 719 struct bpdt *bpdt = buffer_get(b); 720 memcpy(&bpdt->h, &bpdt_header, BPDT_HEADER_SIZE); 721 722 /* ** CID 1361253: Memory - illegal accesses (BUFFER_SIZE_WARNING) /util/cbfstool/ifwitool.c: 1300 in init_subpart_dir_entry() ________________________________________________________________________________________________________ *** CID 1361253: Memory - illegal accesses (BUFFER_SIZE_WARNING) /util/cbfstool/ifwitool.c: 1300 in init_subpart_dir_entry() 1294 static size_t init_subpart_dir_entry(struct subpart_dir_entry *e, 1295 struct buffer *b, size_t offset) 1296 { 1297 memset(e, 0, sizeof(*e)); 1298 1299 assert(strlen(b->name) <= sizeof(e->name)); >>> CID 1361253: Memory - illegal accesses (BUFFER_SIZE_WARNING) >>> Calling strncpy with a maximum size argument of 12 bytes on destination array "e->name" of size 12 bytes might leave the destination string unterminated. 1300 strncpy((char *)e->name, (char *)b->name, sizeof(e->name)); 1301 e->offset = offset; 1302 e->length = buffer_size(b); 1303 1304 return (offset + buffer_size(b)); 1305 } ** CID 1353793: Resource leaks (RESOURCE_LEAK) /util/nvidia/cbootimage/src/data_layout.c: 1096 in resign_bl() ________________________________________________________________________________________________________ *** CID 1353793: Resource leaks (RESOURCE_LEAK) /util/nvidia/cbootimage/src/data_layout.c: 1096 in resign_bl() 1090 1091 if (read_from_image(context->input_image_filename, 1092 offset, bl_length, 1093 &image, &image_actual_size, file_type_bin)) { 1094 printf("Error reading image file %s.\n", 1095 context->input_image_filename); >>> CID 1353793: Resource leaks (RESOURCE_LEAK) >>> Variable "image" going out of scope leaks the storage it points to. 1096 return -ENOMEM; 1097 } 1098 1099 pages_in_image = ICEIL(image_actual_size, page_size); 1100 1101 /* Create a local copy of the bl */ ** CID 1353781: Control flow issues (NO_EFFECT) /util/nvidia/cbootimage/src/cbootimage.c: 242 in main() ________________________________________________________________________________________________________ *** CID 1353781: Control flow issues (NO_EFFECT) /util/nvidia/cbootimage/src/cbootimage.c: 242 in main() 236 context.input_image_filename); 237 goto fail; 238 } 239 240 /* Get BCT_SIZE from input image file */ 241 bct_size = get_bct_size_from_image(&context); >>> CID 1353781: Control flow issues (NO_EFFECT) >>> This less-than-zero comparison of an unsigned value is never true. "bct_size < 0U". 242 if (bct_size < 0) { 243 printf("Error: Invalid input image file %s\n", 244 context.input_image_filename); 245 goto fail; 246 } 247 ** CID 1353028: Error handling issues (NEGATIVE_RETURNS) /util/amdfwtool/amdfwtool.c: 284 in integrate_psp_firmwares() ________________________________________________________________________________________________________ *** CID 1353028: Error handling issues (NEGATIVE_RETURNS) /util/amdfwtool/amdfwtool.c: 284 in integrate_psp_firmwares() 278 pspdir[4+4*i+2] = 1; 279 pspdir[4+4*i+3] = 0; 280 } else if (fw_table[i].filename != NULL) { 281 pspdir[4+4*i+0] = fw_table[i].type; 282 283 fd = open (fw_table[i].filename, O_RDONLY); >>> CID 1353028: Error handling issues (NEGATIVE_RETURNS) >>> "fd" is passed to a parameter that cannot be negative. [Note: The source code implementation of the function has been overridden by a builtin model.] 284 fstat(fd, &fd_stat); 285 pspdir[4+4*i+1] = fd_stat.st_size; 286 287 pspdir[4+4*i+2] = pos + ROM_BASE_ADDRESS; 288 pspdir[4+4*i+3] = 0; 289 ** CID 1353027: Error handling issues (NEGATIVE_RETURNS) /util/amdfwtool/amdfwtool.c: 239 in integrate_firmwares() ________________________________________________________________________________________________________ *** CID 1353027: Error handling issues (NEGATIVE_RETURNS) /util/amdfwtool/amdfwtool.c: 239 in integrate_firmwares() 233 struct stat fd_stat; 234 int i; 235 236 for (i = 0; fw_table[i].type != AMD_FW_INVALID; i ++) { 237 if (fw_table[i].filename != NULL) { 238 fd = open (fw_table[i].filename, O_RDONLY); >>> CID 1353027: Error handling issues (NEGATIVE_RETURNS) >>> "fd" is passed to a parameter that cannot be negative. [Note: The source code implementation of the function has been overridden by a builtin model.] 239 fstat(fd, &fd_stat); 240 241 switch (fw_table[i].type) { 242 case AMD_FW_IMC: 243 pos = ALIGN(pos, 0x10000); 244 romsig[1] = pos + ROM_BASE_ADDRESS; ** CID 1353021: Error handling issues (CHECKED_RETURN) /util/amdfwtool/amdfwtool.c: 290 in integrate_psp_firmwares() ________________________________________________________________________________________________________ *** CID 1353021: Error handling issues (CHECKED_RETURN) /util/amdfwtool/amdfwtool.c: 290 in integrate_psp_firmwares() 284 fstat(fd, &fd_stat); 285 pspdir[4+4*i+1] = fd_stat.st_size; 286 287 pspdir[4+4*i+2] = pos + ROM_BASE_ADDRESS; 288 pspdir[4+4*i+3] = 0; 289 >>> CID 1353021: Error handling issues (CHECKED_RETURN) >>> "read(int, void *, size_t)" returns the number of bytes read, but it is ignored. 290 read (fd, base+pos, fd_stat.st_size); 291 292 pos += fd_stat.st_size; 293 pos = ALIGN(pos, 0x100); 294 close (fd); 295 } else { ** CID 1353020: Error handling issues (CHECKED_RETURN) /util/amdfwtool/amdfwtool.c: 284 in integrate_psp_firmwares() ________________________________________________________________________________________________________ *** CID 1353020: Error handling issues (CHECKED_RETURN) /util/amdfwtool/amdfwtool.c: 284 in integrate_psp_firmwares() 278 pspdir[4+4*i+2] = 1; 279 pspdir[4+4*i+3] = 0; 280 } else if (fw_table[i].filename != NULL) { 281 pspdir[4+4*i+0] = fw_table[i].type; 282 283 fd = open (fw_table[i].filename, O_RDONLY); >>> CID 1353020: Error handling issues (CHECKED_RETURN) >>> Calling "fstat(fd, &fd_stat)" without checking return value. This library function may fail and return an error code. [Note: The source code implementation of the function has been overridden by a builtin model.] 284 fstat(fd, &fd_stat); 285 pspdir[4+4*i+1] = fd_stat.st_size; 286 287 pspdir[4+4*i+2] = pos + ROM_BASE_ADDRESS; 288 pspdir[4+4*i+3] = 0; 289 ** CID 1353019: Error handling issues (CHECKED_RETURN) /util/amdfwtool/amdfwtool.c: 257 in integrate_firmwares() ________________________________________________________________________________________________________ *** CID 1353019: Error handling issues (CHECKED_RETURN) /util/amdfwtool/amdfwtool.c: 257 in integrate_firmwares() 251 break; 252 default: 253 /* Error */ 254 break; 255 } 256 >>> CID 1353019: Error handling issues (CHECKED_RETURN) >>> "read(int, void *, size_t)" returns the number of bytes read, but it is ignored. 257 read (fd, base+pos, fd_stat.st_size); 258 259 pos += fd_stat.st_size; 260 pos = ALIGN(pos, 0x100); 261 close (fd); 262 } ** CID 1353018: Error handling issues (CHECKED_RETURN) /util/amdfwtool/amdfwtool.c: 239 in integrate_firmwares() ________________________________________________________________________________________________________ *** CID 1353018: Error handling issues (CHECKED_RETURN) /util/amdfwtool/amdfwtool.c: 239 in integrate_firmwares() 233 struct stat fd_stat; 234 int i; 235 236 for (i = 0; fw_table[i].type != AMD_FW_INVALID; i ++) { 237 if (fw_table[i].filename != NULL) { 238 fd = open (fw_table[i].filename, O_RDONLY); >>> CID 1353018: Error handling issues (CHECKED_RETURN) >>> Calling "fstat(fd, &fd_stat)" without checking return value. This library function may fail and return an error code. [Note: The source code implementation of the function has been overridden by a builtin model.] 239 fstat(fd, &fd_stat); 240 241 switch (fw_table[i].type) { 242 case AMD_FW_IMC: 243 pos = ALIGN(pos, 0x10000); 244 romsig[1] = pos + ROM_BASE_ADDRESS; ** CID 1347358: Error handling issues (NEGATIVE_RETURNS) /util/amdfwtool/amdfwtool.c: 586 in main() ________________________________________________________________________________________________________ *** CID 1347358: Error handling issues (NEGATIVE_RETURNS) /util/amdfwtool/amdfwtool.c: 586 in main() 580 current = integrate_psp_firmwares(rom, current, psp2dir, amd_psp2_fw_table); 581 #endif 582 } 583 #endif 584 585 targetfd = open(output, O_RDWR | O_CREAT | O_TRUNC, 0666); >>> CID 1347358: Error handling issues (NEGATIVE_RETURNS) >>> "targetfd" is passed to a parameter that cannot be negative. 586 write(targetfd, amd_romsig, current - AMD_ROMSIG_OFFSET); 587 close(targetfd); 588 free(rom); 589 590 return 0; ** CID 1347333: Memory - illegal accesses (UNINIT) /util/amdfwtool/amdfwtool.c: 585 in main() ________________________________________________________________________________________________________ *** CID 1347333: Memory - illegal accesses (UNINIT) /util/amdfwtool/amdfwtool.c: 585 in main() 579 #else 580 current = integrate_psp_firmwares(rom, current, psp2dir, amd_psp2_fw_table); 581 #endif 582 } 583 #endif 584 >>> CID 1347333: Memory - illegal accesses (UNINIT) >>> Using uninitialized value "output" when calling "open". 585 targetfd = open(output, O_RDWR | O_CREAT | O_TRUNC, 0666); 586 write(targetfd, amd_romsig, current - AMD_ROMSIG_OFFSET); 587 close(targetfd); 588 free(rom); 589 590 return 0; ** CID 1325840: Memory - illegal accesses (OVERRUN) /util/cbfstool/cbfs_image.c: 1406 in cbfs_print_entry_info() ________________________________________________________________________________________________________ *** CID 1325840: Memory - illegal accesses (OVERRUN) /util/cbfstool/cbfs_image.c: 1406 in cbfs_print_entry_info() 1400 while ((hash = cbfs_file_get_next_hash(entry, hash)) != NULL) { 1401 unsigned int hash_type = ntohl(hash->hash_type); 1402 if (hash_type > CBFS_NUM_SUPPORTED_HASHES) { 1403 fprintf(fp, "invalid hash type %d\n", hash_type); 1404 break; 1405 } >>> CID 1325840: Memory - illegal accesses (OVERRUN) >>> Overrunning array "widths_cbfs_hash" of 4 8-byte elements at element index 4 (byte offset 32) using index "hash_type" (which evaluates to 4). 1406 size_t hash_len = widths_cbfs_hash[hash_type]; 1407 char *hash_str = bintohex(hash->hash_data, hash_len); 1408 uint8_t local_hash[hash_len]; 1409 if (vb2_digest_buffer(CBFS_SUBHEADER(entry), 1410 ntohl(entry->len), hash_type, local_hash, 1411 hash_len) != VB2_SUCCESS) { ** CID 1325836: Resource leaks (RESOURCE_LEAK) /util/cbfstool/cbfs_image.c: 1413 in cbfs_print_entry_info() ________________________________________________________________________________________________________ *** CID 1325836: Resource leaks (RESOURCE_LEAK) /util/cbfstool/cbfs_image.c: 1413 in cbfs_print_entry_info() 1407 char *hash_str = bintohex(hash->hash_data, hash_len); 1408 uint8_t local_hash[hash_len]; 1409 if (vb2_digest_buffer(CBFS_SUBHEADER(entry), 1410 ntohl(entry->len), hash_type, local_hash, 1411 hash_len) != VB2_SUCCESS) { 1412 fprintf(fp, "failed to hash '%s'\n", name); >>> CID 1325836: Resource leaks (RESOURCE_LEAK) >>> Variable "hash_str" going out of scope leaks the storage it points to. 1413 break; 1414 } 1415 int valid = memcmp(local_hash, hash->hash_data, hash_len) == 0; 1416 const char *valid_str = valid ? "valid" : "invalid"; 1417 1418 fprintf(fp, " hash %s:%s %s\n", ** CID 1323515: Error handling issues (CHECKED_RETURN) /util/broadcom/secimage/sbi.c: 112 in CreateSecureBootImage() ________________________________________________________________________________________________________ *** CID 1323515: Error handling issues (CHECKED_RETURN) /util/broadcom/secimage/sbi.c: 112 in CreateSecureBootImage() 106 } else { 107 return SBIUsage(); 108 } 109 --ac, ++av; 110 } 111 >>> CID 1323515: Error handling issues (CHECKED_RETURN) >>> Calling "stat(bl, &file_stat)" without checking return value. This library function may fail and return an error code. [Note: The source code implementation of the function has been overridden by a builtin model.] 112 stat(bl, &file_stat); 113 filesize = file_stat.st_size + MIN_SIZE; 114 buf = calloc(sizeof(uint8_t), filesize); 115 116 if (buf == NULL) { 117 puts("Memory allocation error"); ** CID 1323512: Null pointer dereferences (FORWARD_NULL) /util/broadcom/secimage/sbi.c: 112 in CreateSecureBootImage() ________________________________________________________________________________________________________ *** CID 1323512: Null pointer dereferences (FORWARD_NULL) /util/broadcom/secimage/sbi.c: 112 in CreateSecureBootImage() 106 } else { 107 return SBIUsage(); 108 } 109 --ac, ++av; 110 } 111 >>> CID 1323512: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "bl" to "stat", which dereferences it. [Note: The source code implementation of the function has been overridden by a builtin model.] 112 stat(bl, &file_stat); 113 filesize = file_stat.st_size + MIN_SIZE; 114 buf = calloc(sizeof(uint8_t), filesize); 115 116 if (buf == NULL) { 117 puts("Memory allocation error"); ** CID 1323511: Null pointer dereferences (FORWARD_NULL) /util/broadcom/secimage/sbi.c: 80 in CreateSecureBootImage() ________________________________________________________________________________________________________ *** CID 1323511: Null pointer dereferences (FORWARD_NULL) /util/broadcom/secimage/sbi.c: 80 in CreateSecureBootImage() 74 * Purpose : 75 * Input : none 76 * Output : none 77 *---------------------------------------------------------------------*/ 78 int CreateSecureBootImage(int ac, char **av) 79 { >>> CID 1323511: Null pointer dereferences (FORWARD_NULL) >>> Assigning: "privkey" = "NULL". 80 char *outfile, *configfile, *arg, *privkey = NULL, *bl = NULL; 81 int status = 0; 82 uint32_t sbiLen; 83 struct stat file_stat; 84 uint32_t add_header = 1; 85 outfile = *av; ** CID 1323510: Error handling issues (NEGATIVE_RETURNS) /util/broadcom/secimage/io.c: 81 in DataRead() ________________________________________________________________________________________________________ *** CID 1323510: Error handling issues (NEGATIVE_RETURNS) /util/broadcom/secimage/io.c: 81 in DataRead() 75 len = FileSizeGet(file); 76 if (len < *length) 77 *length = len; 78 else 79 /* Do not exceed the maximum length of the buffer */ 80 len = *length; >>> CID 1323510: Error handling issues (NEGATIVE_RETURNS) >>> "len" is passed to a parameter that cannot be negative. 81 if (fread((uint8_t *)buf, 1, len, file) != len) { 82 printf("Error reading data (%d bytes) from file: %s\n", 83 len, filename); 84 return -1; 85 } 86 fclose(file); ** CID 1323509: Resource leaks (RESOURCE_LEAK) /util/broadcom/secimage/io.c: 84 in DataRead() ________________________________________________________________________________________________________ *** CID 1323509: Resource leaks (RESOURCE_LEAK) /util/broadcom/secimage/io.c: 84 in DataRead() 78 else 79 /* Do not exceed the maximum length of the buffer */ 80 len = *length; 81 if (fread((uint8_t *)buf, 1, len, file) != len) { 82 printf("Error reading data (%d bytes) from file: %s\n", 83 len, filename); >>> CID 1323509: Resource leaks (RESOURCE_LEAK) >>> Variable "file" going out of scope leaks the storage it points to. 84 return -1; 85 } 86 fclose(file); 87 return 0; 88 } 89 ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V0… To manage Coverity Scan email notifications for "coreboot(a)coreboot.org", click https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V0…

1 0

Re: [coreboot] PCI passthrough on ASUS KGPE-D16
by Timothy Pearson 04 Oct '16

04 Oct '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 10/03/2016 06:09 PM, Mike Banon wrote: > Correct me if I am wrong, but I think: IOMMU support means that a > graphics card passthrough is possible (this is binary: IOMMU yes ==> > possible / no ==> not possible). If IOMMU support is buggy (which > seems to be commonly found with proprietary BIOS) maybe your system > could experience some bugs while you are using this feature. Of course > the most reliable way to find out is to try it, but I am pretty sure > that coreboot's IOMMU support is good I am 99% sure this functions correctly. It's been a while but I think it was tested early this year as part of the coreboot support bringup. Bear in mind the usual caveats apply; if you're not using the open source drivers for your card the manufacturer may have locked out passthrough, etc. nVidia is especially famous for this. - -- Timothy Pearson Raptor Engineering +1 (415) 727-8645 (direct line) +1 (512) 690-0200 (switchboard) https://www.raptorengineering.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQEcBAEBAgAGBQJX8ua0AAoJEK+E3vEXDOFbsvIH/ihDV23xro6DFexRH+m29pja MyWMeCg2o+UyL942tn2J/FZjkrBHPJVBGMkRjEUmK1VDlr/4qtwg8uNsvYBKXFQE BwgoBSwVJPkfEy9SsUQMzNXHorMbgMT7q0GJhJTGvPRMgpC4fcnQajnwASZrctc+ 2TJuuh84ZMDUgDIntzMuCijHyyS/GPnSQ3oL48Hski4Hnzxu+xvfv9EdDHSYsjSc G9rLet+HaApUrQIAiwjQjT+XrVjeZMnYR2Xlyewe6n6+pSjGRfM6K1gIPRwbQXTY 0gKfWzy+fLAmCtUn7ecA/nrAwPif2qfvuY7wL0GdXNxTePTRHOtFfLONXQ8y0O0= =rOvF -----END PGP SIGNATURE-----

1 0

Re: [coreboot] PCI passthrough on ASUS KGPE-D16
by Mike Banon 04 Oct '16

04 Oct '16

Correct me if I am wrong, but I think: IOMMU support means that a graphics card passthrough is possible (this is binary: IOMMU yes ==> possible / no ==> not possible). If IOMMU support is buggy (which seems to be commonly found with proprietary BIOS) maybe your system could experience some bugs while you are using this feature. Of course the most reliable way to find out is to try it, but I am pretty sure that coreboot's IOMMU support is good On Sun, Oct 2, 2016 at 9:04 PM, Zoran Stojsavljevic <zoran.stojsavljevic(a)gmail.com> wrote: >> Would it be possible to passthrough a graphics card to a virtual machine >> while using Coreboot/Libreboot? > > Hello opteron/AMD supporter, > > You did ask very (very, should say extremely) tricky question, you do know > this (I betcha you do, don't you)??? ;-) > > Zoran > _______ > > On Sun, Oct 2, 2016 at 6:22 PM, <opteron(a)keemail.me> wrote: >> >> Hi, >> >> would it be possible to passthrough a graphics card to a virtual machine >> while using Coreboot/Libreboot? The libreboot website says that the >> motherboard offers full IOMMU-support when using a CPU from the Opteron >> 6200/6300 series. >> >> https://wiki.archlinux.org/index.php/PCI_passthrough_via_OVMF >> https://libreboot.org/docs/hcl/kgpe-d16.html >> >> -- >> coreboot mailing list: coreboot(a)coreboot.org >> https://www.coreboot.org/mailman/listinfo/coreboot > > > > -- > coreboot mailing list: coreboot(a)coreboot.org > https://www.coreboot.org/mailman/listinfo/coreboot

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

coreboot October 2016