November 2016 - coreboot - mail.coreboot.org

Re: [coreboot] Fund a TALOS Secure Workstation as coreboot build system
by Pierre P Nov. 8, 2016

Nov. 8, 2016

Hi, I'd like to help fund a build server for coreboot, how is it done ? Thanks, Pierre ________________________________ From: coreboot <coreboot-bounces(a)coreboot.org> on behalf of Martin Roth <gaumless(a)gmail.com> Sent: Monday, November 7, 2016 10:22 PM To: David Hendricks Cc: Paul Menzel; coreboot Subject: Re: [coreboot] Fund a TALOS Secure Workstation as coreboot build system Update: After the weekend, we're up to $3700 with 5 contributors. Martin On Sun, Nov 6, 2016 at 1:01 PM, David Hendricks <david.hendricks(a)gmail.com<mailto:david.hendricks@gmail.com>> wrote: On Fri, Nov 4, 2016 at 9:36 AM, Martin Roth <gaumless(a)gmail.com<mailto:gaumless@gmail.com>> wrote: Is getting a Talos workstation as a build server something that people are interested in contributing money for? Yes, this needs to happen. So far, we've got $2500 pledged from two contributors out of the $7500 needed to get a server. I'll match up to $2000 worth of small/moderate pledges ($250 or less). So if 10 people pledge $200 I'll chip in $2000 to bring us to $6500.

1 0

northbridge Intel 82846 ==>southbridge Intel 82801GX (ICH7) ==>IT8718 which is UART (I/0)
by Riko Ho Nov. 8, 2016

Nov. 8, 2016

I have no idea as well, I'm a beginner on coreboot stuff..you know better than me... What I'm thinking, I need to find a way for initializing northbridge Intel 82946 ==>southbridge Intel 82801GX (ICH7) ==>IT8718 which is UART (I/0) since it has GPIO as well... I got no idea on how to initialize northbridge yet.... what do you reckon ? can CPU talk directly to IT8718F in this case ? or it needs NB and SB ? Is any more documentations for Intel 82946 ? or that's the only one we can obtain ? It doesn't matter if we can not find it, I want to learn, it's very good if we can solve it...but it's not, I have nothing to loose... On 8/11/2016 7:25 AM, Idwer Vollering wrote: > I don't know, what do you think? > > 2016-11-08 0:07 GMT+01:00 Riko Ho <antonius.riko(a)gmail.com>: >> On 7/11/2016 10:55 AM, Idwer Vollering wrote: >> >> / >> >> 2016-11-07 2:59 GMT+01:00 Riko Ho <antonius.riko(a)gmail.com>: >> >> Next line you're talking about : >> | f000:0f10 66becc8100e0 mov esi, 0xe00081cc >> | f000:0f16 67268b06 mov ax, [es:esi] >> | f000:0f1a 0d0010 or ax, 0x1000 >> >> ====== >> From what I recall is nico_h on IRC hinted that the PCIe bus must be >> up in order to be able to use the UART. >> There could be code for this that touches PCIEXBAR around these lines: >> ||||||| f000:0f10 66becc8100e0 mov esi, 0xe00081cc >> ||||||| f000:0f16 67268b06 mov ax, word es:[esi] >> ||||||| f000:0f1a 0d0010 or ax, 0x1000 >> >> Since this writes to ax, the C code could look like this: >> MCHBAR16(0xe00081cc) |=0x1000; >> This would end up in romstage.c >> ====== >> >> in which function I put that MCHBAR16(0xe00081cc) |=0x1000; on romstage.c ? >> >> No idea, it might belong in src/northbridge/intel/i945/raminit.c >> instead. The C macro, MCHBAR16(), I mentioned was an example and won't >> be useful for PCIEXBAR. >> >> So what should we do for getting the correct PCIEXBAR and making UART >> running ? >> >> ===== >> I suggest that you read at least chapter "5 Host Bridge/DRAM >> Controller Registers (Device 0, Function 0) " starting on page 75. >> ===== >> >> Ok, I will do that, but I'm sure I have a lot of questions in relation >> with the reversed code and romstage.c and this chapter 5. >> >> -- >> /***/ >> Kind Regards >> Riko Ho >> /***/ >> >> >> >> -- >> /*===*/ >> Kind regards, >> Riko Ho >> /*===*/ -- */*===*/ Kind regards, Riko Ho /*===*/ *

1 0

Weird issue: payloads not showing after seabios
by Charlotte Plusplus Nov. 7, 2016

Nov. 7, 2016

Hello I am sorry if this is a total noob question, but I can't get any other payload to show other that the default seabios payload or memtest86. nvramcui, tint, coreinfo (all automatically added by coreboot as secondary payloads) or grub (added manually with cbfstool) show nothing, or cause a reboot. I first thought that was due to my ram issues, but even after finding low DDR3 that works reliably in coreboot, I still can't get other payloads. Just to be sure I tried everything: - I used CONFIG_MAINBOARD_DO_NATIVE_VGA_INIT: weird font (maybe because I have a FHD 1680x1080 screen instead of some different hardcoded resolution) - I tried CONFIG_VGA_ROM_RUN: garbled screen with wavy lines I am back to none of these options, and a VGA rom initialized by Seabios. I am using version 1.9.3 and the current coreboot head. I am now trying with seabios 1.10 (d7adf6044a4c772b497e97272adf97426b34a249) I have read https://www.coreboot.org/SeaBIOS#coreboot. I use at the moment the .config attached, but I don't understand what is happening. I don't have debug output yet, I just ordered a FT232H, as it was far less expansive than a BBB. It will only arrive next week. I think at least something should show on the screen when I press Esc and select another payload. Only memtest86 works at the moment. I am making some stupid mistake?? $ cat /opt/coreboot/blobs/payloads/seabios-minime.config CONFIG_USE_OPTION_TABLE=y CONFIG_COLLECT_TIMESTAMPS=y CONFIG_USE_BLOBS=y CONFIG_VENDOR_LENOVO=y CONFIG_CBFS_SIZE=0x680000 CONFIG_BOARD_LENOVO_W520=y CONFIG_USBDEBUG=y CONFIG_ENABLE_VMX=y CONFIG_PCIEXP_CLK_PM=y CONFIG_CONSOLE_USB=y

1 0

Re: [coreboot] Fund a TALOS Secure Workstation as coreboot build system
by Martin Roth Nov. 7, 2016

Nov. 7, 2016

Update: After the weekend, we're up to $3700 with 5 contributors. Martin On Sun, Nov 6, 2016 at 1:01 PM, David Hendricks <david.hendricks(a)gmail.com> wrote: > > > On Fri, Nov 4, 2016 at 9:36 AM, Martin Roth <gaumless(a)gmail.com> wrote: > >> Is getting a Talos workstation as a build server something that people >> are interested in contributing money for? >> > > Yes, this needs to happen. > > >> So far, we've got $2500 pledged from two contributors out of the $7500 >> needed to get a server. >> > > I'll match up to $2000 worth of small/moderate pledges ($250 or less). So > if 10 people pledge $200 I'll chip in $2000 to bring us to $6500. >

1 0

Re: [coreboot] Removing Intel ME from the X230 coreboot
by Federico Amedeo Izzo Nov. 7, 2016

Nov. 7, 2016

On 11/06/2016 10:11 AM, Charlotte Plusplus wrote: > Hello > > Did you release any of your work to remove the ME for a X230? > > I am interested in attempting that on a W520. On > https://www.coreboot.org/pipermail/coreboot/2016-September/082049.html > you mention you left ROMP, BUP, KERNEL, POLICY and FTCS. Any update on > that? Is it the minimal set?? > > I assume you made a script that takes a ME firmware, reads it > partition, then dd some parts of it to 0xFF. Can I please get a copy?? > > Thanks! > Hello, Lately I worked with Nicola Corna on disabling the intel ME, following the results of Trammell Hudson. We also made a python script that removes all the partitions but FTPR and the corresponding entry in the FPT table, the results boots fine on a Sandy Bridge X220 & X220t but leads to a brick on Nehalem X201. You can find more details here along with the script https://www.coreboot.org/pipermail/coreboot/2016-November/082331.html Federico

2 1

Re: [coreboot] Patch: support for the Lenovo Thinkpad W520
by Patrick Rudolph Nov. 7, 2016

Nov. 7, 2016

Hello Charlotte, thanks for adding support for W520. Am 06.11.2016 um 09:33 schrieb Charlotte Plusplus: > Hello > > I am new to coreboot. I tried to run coreboot on my Thinkpad W520 to > replace my Sandy Bridge CPU by a Ivy Bridge CPU, since several people > reported it worked very well. > > Following their suggestions, I simply tried to flash a T520 image to > save time. It didn't work at all. I was very angry I had wasted almost > 2 days doing that. So I took the time to port coreboot to the Thinkpad > W520 following the specs from > http://kythuatphancung.vn/uploads/download/5165b_Wistron_Kendo-3_WS_-_10222… > and explore the issues I had (black screen, no boot) > > First, please find the patch attached to add support to the Thinkpad > W520 mainboard. This patch is based on the T520 mainboard as the W520 > is very close. However, it needed romstage additions for ram init (cf > p103 of the pdf) Please use git ( https://www.coreboot.org/Development_Guidelines#How_to_contribute ) and gerrit ( http://review.coreboot.org/#/q/status:open ) to upload your patch. This allows easy reviewing and commenting, including an automatic build for every change made. > > I can now boot with various combinations of population of the Dimm > slots, with the 4 slots all working, and the Dimm correctly identified > by memtest > > However, I can not use my normal 8Gb Dimm sticks. One of them work, > but 2x8Gb does not work most of the time. I get errors in memtest when > I am lucky to boot. The sticks are DDR3L 2133 (bus speed 1066 MHz) and > they worked fine with the bios 1.36: I tested the sticks for over 24h > with memtest86 7.1 just a week ago to check how hot my old CPU would > get. Please note that I didn't test anything beyond DDR3-800. Some people reported that DDR3-1866 is working. Can you try to limit max frequency to DDR3-1333 or DDR3-1600 (using max_mem_clock_mhz) and tell if it's working ? > After further investigation, if I run memtest86 7.1 on the bios 1.36, > it shows the correct information and timings: tCL-tRCD-tRP-tRAS are > 11-11-11-29, and the RAM is running at 1066MHz. > > If I run memtest86 on coreboot, it shows the RAM is running at 931MHz > with timings 10-10-10-28. All this would be fine if it didn't cause > errors on the memtest86! It looks like the SPD decoding is buggy, and > instead of using the optimal configuration (11-11-11) coreboot picks > the next one. CL11 is optimal configuration for DDR3-2133, but not for DDR3-1866. The choosen CL value is correct. > > I would be happy to fix that but I don't know where to look. I > correctly put max_mem_clock_mhz = 1066 in devicetree.cb so I don't > understand. Can I hardcode timing settings? Is there any other place I > should check for SPD issues? No you can't hardcode timings. Native raminit is done in coreboot/src/northbridge/intel/sandybridge/raminit.c Please have a look at this file first. I don't think that there are SPD issues, but there might be issues with frequencies of + DDR3-1600. > > There are some other W520 specific issues. I will try to prepare a > wiki page to explain them. The big ones are: > - the bottom plastic case is conductive: if you add a J100 header, > you must trim the ends or you will have shorts and the computer will > not boot > - if you flash with a raspberry pi, you do not need external power. > the 3V from pin 17 are enough. WP and HOLD can be left floating if you > want. But you must insert all the pins at once, otherwise the W25Q64 > may not respond (it is weird, I see no logical reason, but it works > reliably) > - native graphics initialization gave me video artifacts in seabios. > Using the VGA bios fixed that > > On https://www.coreboot.org/Board:lenovo/t520 I see issues: > yellow USB port isn't powered in power-off state. > DisplayPort only connected to Discrete GPU > TPM. At the moment there is only basic support inside coreboot... > Boot time issues ( keyboard rest timeout ) > ultrabay hot plug (event missing?) > some power management states missing > > I am new to coreboot. I could try to add the missing power management > states. But can I please ask for pointers and suggestions? What is > missing? Is there any documentation? Power management is done through ACPI. You'd need to figure out which ACPI functions are used by your operating system and implement/fix them. > Also, in romstage I am not sure of : > /* Disable unused devices (board specific) */ > RCBA32(FD) = 0x1ee51fe3; You can dump the value stock lenovo bios sets at boot using the inteltool, that ships in coreboot's utils folder. > > The W520 is a bit different from a t420 and I think it may not be the > same. How do I compute this number? > > Also, can I please ask for some help on USBDEBUG? I have a FT232R > cable and enabled CONFIG_USBDEBUG_DONGLE_FTDI_FT232H. But I receive > nothing. Is it necessary to have a FT232H? I looked at the code and it > does not seem very specific. Having debug information would be helpful > to fix these ram issues. I'm using BeagleBone Black for USBDEBUG. I cannot tell if FT232R is working, too. Please note that you have to use the USB port that has USBDEBUG capabilities. Other USB ports do not work. There's no fix rule where to find it. Some thinkpads have it on the back, some are on the side. Please use lspci to identifiy it first. For more information have a look at the wiki ( https://www.coreboot.org/EHCI_Debug_Port ) Once you got USBDEBUG working, please provide a full raminit log. It may help to fix the remaining issue. Regards, Patrick > > Charlotte > >

3 3

New Defects reported by Coverity Scan for coreboot
by scan-admin＠coverity.com Nov. 7, 2016

Nov. 7, 2016

Hi, Please find the latest report on new defect(s) introduced to coreboot found with Coverity Scan. 19 new defect(s) introduced to coreboot found with Coverity Scan. 32 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 19 of 19 defect(s) ** CID 1365395: Insecure data handling (TAINTED_SCALAR) /3rdparty/vboot/futility/cmd_bdb.c: 470 in do_verify() ________________________________________________________________________________________________________ *** CID 1365395: Insecure data handling (TAINTED_SCALAR) /3rdparty/vboot/futility/cmd_bdb.c: 470 in do_verify() 464 { 465 uint8_t *bdb = NULL; 466 uint8_t *key_digest = NULL; 467 uint32_t bdb_size, key_digest_size; 468 int rv = -1; 469 >>> CID 1365395: Insecure data handling (TAINTED_SCALAR) >>> Assigning: "bdb" = "read_file", which taints "bdb". 470 bdb = read_file(bdb_filename, &bdb_size); 471 if (!bdb) { 472 fprintf(stderr, "Unable to load BDB\n"); 473 goto exit; 474 } 475 ** CID 1365394: Insecure data handling (TAINTED_SCALAR) /3rdparty/vboot/futility/cmd_vbutil_key.c: 122 in do_unpack() ________________________________________________________________________________________________________ *** CID 1365394: Insecure data handling (TAINTED_SCALAR) /3rdparty/vboot/futility/cmd_vbutil_key.c: 122 in do_unpack() 116 117 if (!infile) { 118 fprintf(stderr, "Need file to unpack\n"); 119 return 1; 120 } 121 >>> CID 1365394: Insecure data handling (TAINTED_SCALAR) >>> Assigning: "pubkey" = "vb2_read_packed_key", which taints "pubkey". 122 pubkey = vb2_read_packed_key(infile); 123 if (pubkey) { 124 printf("Public Key file: %s\n", infile); 125 printf("Algorithm: %u %s\n", pubkey->algorithm, 126 vb1_crypto_name(pubkey->algorithm)); 127 printf("Key Version: %u\n", pubkey->key_version); ** CID 1365393: (TAINTED_SCALAR) /3rdparty/vboot/futility/cmd_bdb.c: 340 in do_resign() /3rdparty/vboot/futility/cmd_bdb.c: 340 in do_resign() /3rdparty/vboot/futility/cmd_bdb.c: 340 in do_resign() /3rdparty/vboot/futility/cmd_bdb.c: 340 in do_resign() /3rdparty/vboot/futility/cmd_bdb.c: 340 in do_resign() ________________________________________________________________________________________________________ *** CID 1365393: (TAINTED_SCALAR) /3rdparty/vboot/futility/cmd_bdb.c: 340 in do_resign() 334 335 if (!bdb_filename) { 336 fprintf(stderr, "BDB file must be specified\n"); 337 goto exit; 338 } 339 >>> CID 1365393: (TAINTED_SCALAR) >>> Assigning: "bdb" = "read_file", which taints "bdb". 340 bdb = read_file(bdb_filename, &bdb_size); 341 if (!bdb) { 342 fprintf(stderr, "Unable to read %s\n", bdb_filename); 343 goto exit; 344 } 345 /3rdparty/vboot/futility/cmd_bdb.c: 340 in do_resign() 334 335 if (!bdb_filename) { 336 fprintf(stderr, "BDB file must be specified\n"); 337 goto exit; 338 } 339 >>> CID 1365393: (TAINTED_SCALAR) >>> Assigning: "bdb" = "read_file", which taints "bdb". 340 bdb = read_file(bdb_filename, &bdb_size); 341 if (!bdb) { 342 fprintf(stderr, "Unable to read %s\n", bdb_filename); 343 goto exit; 344 } 345 /3rdparty/vboot/futility/cmd_bdb.c: 340 in do_resign() 334 335 if (!bdb_filename) { 336 fprintf(stderr, "BDB file must be specified\n"); 337 goto exit; 338 } 339 >>> CID 1365393: (TAINTED_SCALAR) >>> Assigning: "bdb" = "read_file", which taints "bdb". 340 bdb = read_file(bdb_filename, &bdb_size); 341 if (!bdb) { 342 fprintf(stderr, "Unable to read %s\n", bdb_filename); 343 goto exit; 344 } 345 /3rdparty/vboot/futility/cmd_bdb.c: 340 in do_resign() 334 335 if (!bdb_filename) { 336 fprintf(stderr, "BDB file must be specified\n"); 337 goto exit; 338 } 339 >>> CID 1365393: (TAINTED_SCALAR) >>> Assigning: "bdb" = "read_file", which taints "bdb". 340 bdb = read_file(bdb_filename, &bdb_size); 341 if (!bdb) { 342 fprintf(stderr, "Unable to read %s\n", bdb_filename); 343 goto exit; 344 } 345 /3rdparty/vboot/futility/cmd_bdb.c: 340 in do_resign() 334 335 if (!bdb_filename) { 336 fprintf(stderr, "BDB file must be specified\n"); 337 goto exit; 338 } 339 >>> CID 1365393: (TAINTED_SCALAR) >>> Assigning: "bdb" = "read_file", which taints "bdb". 340 bdb = read_file(bdb_filename, &bdb_size); 341 if (!bdb) { 342 fprintf(stderr, "Unable to read %s\n", bdb_filename); 343 goto exit; 344 } 345 ** CID 1365392: (TAINTED_SCALAR) /3rdparty/vboot/futility/cmd_vbutil_keyblock.c: 106 in Pack() /3rdparty/vboot/futility/cmd_vbutil_keyblock.c: 106 in Pack() /3rdparty/vboot/futility/cmd_vbutil_keyblock.c: 106 in Pack() ________________________________________________________________________________________________________ *** CID 1365392: (TAINTED_SCALAR) /3rdparty/vboot/futility/cmd_vbutil_keyblock.c: 106 in Pack() 100 if (!datapubkey) { 101 fprintf(stderr, 102 "vbutil_keyblock: Must specify data public key.\n"); 103 return 1; 104 } 105 >>> CID 1365392: (TAINTED_SCALAR) >>> Assigning: "data_key" = "vb2_read_packed_key", which taints "data_key". 106 struct vb2_packed_key *data_key = vb2_read_packed_key(datapubkey); 107 if (!data_key) { 108 fprintf(stderr, "vbutil_keyblock: Error reading data key.\n"); 109 return 1; 110 } 111 /3rdparty/vboot/futility/cmd_vbutil_keyblock.c: 106 in Pack() 100 if (!datapubkey) { 101 fprintf(stderr, 102 "vbutil_keyblock: Must specify data public key.\n"); 103 return 1; 104 } 105 >>> CID 1365392: (TAINTED_SCALAR) >>> Assigning: "data_key" = "vb2_read_packed_key", which taints "data_key". 106 struct vb2_packed_key *data_key = vb2_read_packed_key(datapubkey); 107 if (!data_key) { 108 fprintf(stderr, "vbutil_keyblock: Error reading data key.\n"); 109 return 1; 110 } 111 /3rdparty/vboot/futility/cmd_vbutil_keyblock.c: 106 in Pack() 100 if (!datapubkey) { 101 fprintf(stderr, 102 "vbutil_keyblock: Must specify data public key.\n"); 103 return 1; 104 } 105 >>> CID 1365392: (TAINTED_SCALAR) >>> Assigning: "data_key" = "vb2_read_packed_key", which taints "data_key". 106 struct vb2_packed_key *data_key = vb2_read_packed_key(datapubkey); 107 if (!data_key) { 108 fprintf(stderr, "vbutil_keyblock: Error reading data key.\n"); 109 return 1; 110 } 111 ** CID 1365391: (TAINTED_SCALAR) /3rdparty/vboot/futility/cmd_vbutil_firmware.c: 160 in do_vblock() /3rdparty/vboot/futility/cmd_vbutil_firmware.c: 126 in do_vblock() ________________________________________________________________________________________________________ *** CID 1365391: (TAINTED_SCALAR) /3rdparty/vboot/futility/cmd_vbutil_firmware.c: 160 in do_vblock() 154 /* Write the output file */ 155 FILE *f = fopen(outfile, "wb"); 156 if (!f) { 157 VbExError("Can't open output file %s\n", outfile); 158 goto vblock_cleanup; 159 } >>> CID 1365391: (TAINTED_SCALAR) >>> Passing tainted variable "keyblock->keyblock_size" to a tainted sink. 160 int i = ((1 != fwrite(keyblock, keyblock->keyblock_size, 1, f)) || 161 (1 != fwrite(preamble, preamble->preamble_size, 1, f))); 162 fclose(f); 163 if (i) { 164 VbExError("Can't write output file %s\n", outfile); 165 unlink(outfile); /3rdparty/vboot/futility/cmd_vbutil_firmware.c: 126 in do_vblock() 120 signing_key = vb2_read_private_key(signprivate); 121 if (!signing_key) { 122 VbExError("Error reading signing key.\n"); 123 goto vblock_cleanup; 124 } 125 >>> CID 1365391: (TAINTED_SCALAR) >>> Assigning: "kernel_subkey" = "vb2_read_packed_key", which taints "kernel_subkey". 126 kernel_subkey = vb2_read_packed_key(kernelkey_file); 127 if (!kernel_subkey) { 128 VbExError("Error reading kernel subkey.\n"); 129 goto vblock_cleanup; 130 } 131 ** CID 1365390: Insecure data handling (TAINTED_SCALAR) /3rdparty/vboot/futility/cmd_bdb.c: 110 in do_add() ________________________________________________________________________________________________________ *** CID 1365390: Insecure data handling (TAINTED_SCALAR) /3rdparty/vboot/futility/cmd_bdb.c: 110 in do_add() 104 } 105 /* Copy up to the end of hashes. This implicitly clears the data 106 * sig because it's not copied. */ 107 memcpy(new_bdb, bdb, vb2_offset_of(bdb, bdb_get_data_sig(bdb))); 108 109 /* Update new BDB header */ >>> CID 1365390: Insecure data handling (TAINTED_SCALAR) >>> Assigning: "bdb_header" = "bdb_get_header", which taints "bdb_header". 110 bdb_header = (struct bdb_header *)bdb_get_header(new_bdb); 111 bdb_header->bdb_size += sizeof(*new_hash); 112 113 data_header = (struct bdb_data *)bdb_get_data(new_bdb); 114 115 /* Update new hash. We're overwriting the data signature, which ** CID 1365389: Memory - corruptions (OVERRUN) ________________________________________________________________________________________________________ *** CID 1365389: Memory - corruptions (OVERRUN) /src/mainboard/intel/kblrvp/romstage.c: 32 in mainboard_memory_init_params() 26 27 void mainboard_memory_init_params(FSPM_UPD *mupd) 28 { 29 FSP_M_CONFIG *mem_cfg; 30 mem_cfg = &mupd->FspmConfig; 31 >>> CID 1365389: Memory - corruptions (OVERRUN) >>> Overrunning array "mem_cfg->DqByteMapCh0" of 12 bytes by passing it to a function which accesses it at byte offset 23. 32 mainboard_fill_dq_map_data(&mem_cfg->DqByteMapCh0); 33 mainboard_fill_dqs_map_data(&mem_cfg->DqsMapCpu2DramCh0); 34 mainboard_fill_rcomp_res_data(&mem_cfg->RcompResistor); 35 mainboard_fill_rcomp_strength_data(&mem_cfg->RcompTarget); 36 37 mem_cfg->DqPinsInterleaved = 0; ** CID 1365388: Memory - corruptions (OVERRUN) ________________________________________________________________________________________________________ *** CID 1365388: Memory - corruptions (OVERRUN) /src/mainboard/intel/kblrvp/romstage.c: 33 in mainboard_memory_init_params() 27 void mainboard_memory_init_params(FSPM_UPD *mupd) 28 { 29 FSP_M_CONFIG *mem_cfg; 30 mem_cfg = &mupd->FspmConfig; 31 32 mainboard_fill_dq_map_data(&mem_cfg->DqByteMapCh0); >>> CID 1365388: Memory - corruptions (OVERRUN) >>> Overrunning array "mem_cfg->DqsMapCpu2DramCh0" of 8 bytes by passing it to a function which accesses it at byte offset 15. 33 mainboard_fill_dqs_map_data(&mem_cfg->DqsMapCpu2DramCh0); 34 mainboard_fill_rcomp_res_data(&mem_cfg->RcompResistor); 35 mainboard_fill_rcomp_strength_data(&mem_cfg->RcompTarget); 36 37 mem_cfg->DqPinsInterleaved = 0; 38 mem_cfg->MemorySpdPtr00 = mainboard_get_spd_data(); 39 if (mainboard_has_dual_channel_mem()) 40 mem_cfg->MemorySpdPtr10 = mem_cfg->MemorySpdPtr00; 41 mem_cfg->MemorySpdDataLen = SPD_LEN; ** CID 1365387: (RESOURCE_LEAK) /3rdparty/vboot/futility/cmd_bdb.c: 360 in do_resign() /3rdparty/vboot/futility/cmd_bdb.c: 362 in do_resign() /3rdparty/vboot/futility/cmd_bdb.c: 373 in do_resign() /3rdparty/vboot/futility/cmd_bdb.c: 375 in do_resign() ________________________________________________________________________________________________________ *** CID 1365387: (RESOURCE_LEAK) /3rdparty/vboot/futility/cmd_bdb.c: 360 in do_resign() 354 if (!key) { 355 fprintf(stderr, "Unable to read BDB key\n"); 356 goto exit; 357 } 358 if (install_bdbkey(&bdb, key)) { 359 fprintf(stderr, "Unable to install new BDB key\n"); >>> CID 1365387: (RESOURCE_LEAK) >>> Variable "key" going out of scope leaks the storage it points to. 360 goto exit; 361 } 362 } 363 364 if (datakey_pub_filename) { 365 struct bdb_key *key = bdb_create_key(datakey_pub_filename, /3rdparty/vboot/futility/cmd_bdb.c: 362 in do_resign() 356 goto exit; 357 } 358 if (install_bdbkey(&bdb, key)) { 359 fprintf(stderr, "Unable to install new BDB key\n"); 360 goto exit; 361 } >>> CID 1365387: (RESOURCE_LEAK) >>> Variable "key" going out of scope leaks the storage it points to. 362 } 363 364 if (datakey_pub_filename) { 365 struct bdb_key *key = bdb_create_key(datakey_pub_filename, 366 datakey_version, NULL); 367 if (!key) { /3rdparty/vboot/futility/cmd_bdb.c: 373 in do_resign() 367 if (!key) { 368 fprintf(stderr, "Unable to read data key\n"); 369 goto exit; 370 } 371 if (install_datakey(&bdb, key)) { 372 fprintf(stderr, "Unable to install new data key\n"); >>> CID 1365387: (RESOURCE_LEAK) >>> Variable "key" going out of scope leaks the storage it points to. 373 goto exit; 374 } 375 } 376 377 /* Check validity for the new bdb key */ 378 rv = bdb_verify(bdb, bdb_size_of(bdb), NULL); /3rdparty/vboot/futility/cmd_bdb.c: 375 in do_resign() 369 goto exit; 370 } 371 if (install_datakey(&bdb, key)) { 372 fprintf(stderr, "Unable to install new data key\n"); 373 goto exit; 374 } >>> CID 1365387: (RESOURCE_LEAK) >>> Variable "key" going out of scope leaks the storage it points to. 375 } 376 377 /* Check validity for the new bdb key */ 378 rv = bdb_verify(bdb, bdb_size_of(bdb), NULL); 379 if (rv == BDB_ERROR_HEADER_SIG) { 380 /* This is expected failure if we installed a new BDB key. ** CID 1365386: Memory - corruptions (OVERRUN) /src/soc/intel/skylake/chip_fsp20.c: 148 in platform_fsp_silicon_init_params_cb() ________________________________________________________________________________________________________ *** CID 1365386: Memory - corruptions (OVERRUN) /src/soc/intel/skylake/chip_fsp20.c: 148 in platform_fsp_silicon_init_params_cb() 142 memcpy(params->SataPortsEnable, config->SataPortsEnable, 143 sizeof(params->SataPortsEnable)); 144 memcpy(params->SataPortsDevSlp, config->SataPortsDevSlp, 145 sizeof(params->SataPortsDevSlp)); 146 memcpy(params->PcieRpClkReqSupport, config->PcieRpClkReqSupport, 147 sizeof(params->PcieRpClkReqSupport)); >>> CID 1365386: Memory - corruptions (OVERRUN) >>> Overrunning array "config->PcieRpClkReqNumber" of 20 bytes by passing it to a function which accesses it at byte offset 23 using argument "24UL". [Note: The source code implementation of the function has been overridden by a builtin model.] 148 memcpy(params->PcieRpClkReqNumber, config->PcieRpClkReqNumber, 149 sizeof(params->PcieRpClkReqNumber)); 150 151 memcpy(params->SerialIoDevMode, config->SerialIoDevMode, 152 sizeof(params->SerialIoDevMode)); 153 ** CID 1365385: Memory - corruptions (OVERRUN) /src/soc/intel/skylake/chip_fsp20.c: 146 in platform_fsp_silicon_init_params_cb() ________________________________________________________________________________________________________ *** CID 1365385: Memory - corruptions (OVERRUN) /src/soc/intel/skylake/chip_fsp20.c: 146 in platform_fsp_silicon_init_params_cb() 140 } 141 142 memcpy(params->SataPortsEnable, config->SataPortsEnable, 143 sizeof(params->SataPortsEnable)); 144 memcpy(params->SataPortsDevSlp, config->SataPortsDevSlp, 145 sizeof(params->SataPortsDevSlp)); >>> CID 1365385: Memory - corruptions (OVERRUN) >>> Overrunning array "config->PcieRpClkReqSupport" of 20 bytes by passing it to a function which accesses it at byte offset 23 using argument "24UL". [Note: The source code implementation of the function has been overridden by a builtin model.] 146 memcpy(params->PcieRpClkReqSupport, config->PcieRpClkReqSupport, 147 sizeof(params->PcieRpClkReqSupport)); 148 memcpy(params->PcieRpClkReqNumber, config->PcieRpClkReqNumber, 149 sizeof(params->PcieRpClkReqNumber)); 150 151 memcpy(params->SerialIoDevMode, config->SerialIoDevMode, ** CID 1353028: Error handling issues (NEGATIVE_RETURNS) /util/amdfwtool/amdfwtool.c: 284 in integrate_psp_firmwares() ________________________________________________________________________________________________________ *** CID 1353028: Error handling issues (NEGATIVE_RETURNS) /util/amdfwtool/amdfwtool.c: 284 in integrate_psp_firmwares() 278 pspdir[4+4*i+2] = 1; 279 pspdir[4+4*i+3] = 0; 280 } else if (fw_table[i].filename != NULL) { 281 pspdir[4+4*i+0] = fw_table[i].type; 282 283 fd = open (fw_table[i].filename, O_RDONLY); >>> CID 1353028: Error handling issues (NEGATIVE_RETURNS) >>> "fd" is passed to a parameter that cannot be negative. [Note: The source code implementation of the function has been overridden by a builtin model.] 284 fstat(fd, &fd_stat); 285 pspdir[4+4*i+1] = fd_stat.st_size; 286 287 pspdir[4+4*i+2] = pos + ROM_BASE_ADDRESS; 288 pspdir[4+4*i+3] = 0; 289 ** CID 1353027: Error handling issues (NEGATIVE_RETURNS) /util/amdfwtool/amdfwtool.c: 239 in integrate_firmwares() ________________________________________________________________________________________________________ *** CID 1353027: Error handling issues (NEGATIVE_RETURNS) /util/amdfwtool/amdfwtool.c: 239 in integrate_firmwares() 233 struct stat fd_stat; 234 int i; 235 236 for (i = 0; fw_table[i].type != AMD_FW_INVALID; i ++) { 237 if (fw_table[i].filename != NULL) { 238 fd = open (fw_table[i].filename, O_RDONLY); >>> CID 1353027: Error handling issues (NEGATIVE_RETURNS) >>> "fd" is passed to a parameter that cannot be negative. [Note: The source code implementation of the function has been overridden by a builtin model.] 239 fstat(fd, &fd_stat); 240 241 switch (fw_table[i].type) { 242 case AMD_FW_IMC: 243 pos = ALIGN(pos, 0x10000); 244 romsig[1] = pos + ROM_BASE_ADDRESS; ** CID 1353021: Error handling issues (CHECKED_RETURN) /util/amdfwtool/amdfwtool.c: 290 in integrate_psp_firmwares() ________________________________________________________________________________________________________ *** CID 1353021: Error handling issues (CHECKED_RETURN) /util/amdfwtool/amdfwtool.c: 290 in integrate_psp_firmwares() 284 fstat(fd, &fd_stat); 285 pspdir[4+4*i+1] = fd_stat.st_size; 286 287 pspdir[4+4*i+2] = pos + ROM_BASE_ADDRESS; 288 pspdir[4+4*i+3] = 0; 289 >>> CID 1353021: Error handling issues (CHECKED_RETURN) >>> "read(int, void *, size_t)" returns the number of bytes read, but it is ignored. 290 read (fd, base+pos, fd_stat.st_size); 291 292 pos += fd_stat.st_size; 293 pos = ALIGN(pos, 0x100); 294 close (fd); 295 } else { ** CID 1353020: Error handling issues (CHECKED_RETURN) /util/amdfwtool/amdfwtool.c: 284 in integrate_psp_firmwares() ________________________________________________________________________________________________________ *** CID 1353020: Error handling issues (CHECKED_RETURN) /util/amdfwtool/amdfwtool.c: 284 in integrate_psp_firmwares() 278 pspdir[4+4*i+2] = 1; 279 pspdir[4+4*i+3] = 0; 280 } else if (fw_table[i].filename != NULL) { 281 pspdir[4+4*i+0] = fw_table[i].type; 282 283 fd = open (fw_table[i].filename, O_RDONLY); >>> CID 1353020: Error handling issues (CHECKED_RETURN) >>> Calling "fstat(fd, &fd_stat)" without checking return value. This library function may fail and return an error code. [Note: The source code implementation of the function has been overridden by a builtin model.] 284 fstat(fd, &fd_stat); 285 pspdir[4+4*i+1] = fd_stat.st_size; 286 287 pspdir[4+4*i+2] = pos + ROM_BASE_ADDRESS; 288 pspdir[4+4*i+3] = 0; 289 ** CID 1353019: Error handling issues (CHECKED_RETURN) /util/amdfwtool/amdfwtool.c: 257 in integrate_firmwares() ________________________________________________________________________________________________________ *** CID 1353019: Error handling issues (CHECKED_RETURN) /util/amdfwtool/amdfwtool.c: 257 in integrate_firmwares() 251 break; 252 default: 253 /* Error */ 254 break; 255 } 256 >>> CID 1353019: Error handling issues (CHECKED_RETURN) >>> "read(int, void *, size_t)" returns the number of bytes read, but it is ignored. 257 read (fd, base+pos, fd_stat.st_size); 258 259 pos += fd_stat.st_size; 260 pos = ALIGN(pos, 0x100); 261 close (fd); 262 } ** CID 1353018: Error handling issues (CHECKED_RETURN) /util/amdfwtool/amdfwtool.c: 239 in integrate_firmwares() ________________________________________________________________________________________________________ *** CID 1353018: Error handling issues (CHECKED_RETURN) /util/amdfwtool/amdfwtool.c: 239 in integrate_firmwares() 233 struct stat fd_stat; 234 int i; 235 236 for (i = 0; fw_table[i].type != AMD_FW_INVALID; i ++) { 237 if (fw_table[i].filename != NULL) { 238 fd = open (fw_table[i].filename, O_RDONLY); >>> CID 1353018: Error handling issues (CHECKED_RETURN) >>> Calling "fstat(fd, &fd_stat)" without checking return value. This library function may fail and return an error code. [Note: The source code implementation of the function has been overridden by a builtin model.] 239 fstat(fd, &fd_stat); 240 241 switch (fw_table[i].type) { 242 case AMD_FW_IMC: 243 pos = ALIGN(pos, 0x10000); 244 romsig[1] = pos + ROM_BASE_ADDRESS; ** CID 1347358: Error handling issues (NEGATIVE_RETURNS) /util/amdfwtool/amdfwtool.c: 586 in main() ________________________________________________________________________________________________________ *** CID 1347358: Error handling issues (NEGATIVE_RETURNS) /util/amdfwtool/amdfwtool.c: 586 in main() 580 current = integrate_psp_firmwares(rom, current, psp2dir, amd_psp2_fw_table); 581 #endif 582 } 583 #endif 584 585 targetfd = open(output, O_RDWR | O_CREAT | O_TRUNC, 0666); >>> CID 1347358: Error handling issues (NEGATIVE_RETURNS) >>> "targetfd" is passed to a parameter that cannot be negative. 586 write(targetfd, amd_romsig, current - AMD_ROMSIG_OFFSET); 587 close(targetfd); 588 free(rom); 589 590 return 0; ** CID 1347333: Memory - illegal accesses (UNINIT) /util/amdfwtool/amdfwtool.c: 585 in main() ________________________________________________________________________________________________________ *** CID 1347333: Memory - illegal accesses (UNINIT) /util/amdfwtool/amdfwtool.c: 585 in main() 579 #else 580 current = integrate_psp_firmwares(rom, current, psp2dir, amd_psp2_fw_table); 581 #endif 582 } 583 #endif 584 >>> CID 1347333: Memory - illegal accesses (UNINIT) >>> Using uninitialized value "output" when calling "open". 585 targetfd = open(output, O_RDWR | O_CREAT | O_TRUNC, 0666); 586 write(targetfd, amd_romsig, current - AMD_ROMSIG_OFFSET); 587 close(targetfd); 588 free(rom); 589 590 return 0; ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V0… To manage Coverity Scan email notifications for "coreboot(a)coreboot.org", click https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V0…

1 0

Re: [coreboot] It appears the build process still uses unverified http wget sources
by Taiidan＠gmx.com Nov. 6, 2016

Nov. 6, 2016

I suppose you are correct, but would you have rather I didn't mention it? I would love to, however I do not have the scripting skills required to ensure proper verification and unfortunately there are multiple dependencies that don't publish gpg signatures. It isn't an easy task if we want close to 100% assurance. https://blog.invisiblethings.org/2016/05/30/build-security.html Simply changing the build process to https is an improvement over what we have now but I do would rather not do a half baked solution that depends on on the goodwill of every CA. GMP_ARCHIVE="https://mirrors.kernel.org/gnu/gmp/gmp-${GMP_VERSION}.tar.xz" MPFR_ARCHIVE="https://mirrors.kernel.org/gnu/mpfr/mpfr-${MPFR_VERSION}.tar.xz" MPC_ARCHIVE="https://mirrors.kernel.org/gnu/mpc/mpc-${MPC_VERSION}.tar.gz" LIBELF_ARCHIVE="https://fossies.org/linux/misc/libelf-${LIBELF_VERSION}.tar.gz" GCC_ARCHIVE="https://mirrors.kernel.org/gnu/gcc/gcc-${GCC_VERSION}/gcc-${GCC_VERSION}.ta…" BINUTILS_ARCHIVE="https://mirrors.kernel.org/gnu/binutils/binutils-${BINUTILS_VERSION}.tar.bz2" GDB_ARCHIVE="https://mirrors.kernel.org/gnu/gdb/gdb-${GDB_VERSION}.tar.xz" IASL_ARCHIVE="https://acpica.org/sites/acpica/files/acpica-unix2-${IASL_VERSION}.tar.gz" PYTHON_ARCHIVE="https://www.python.org/ftp/python/${PYTHON_VERSION}/Python-${PYTHON_VERSION…" EXPAT_ARCHIVE="https://downloads.sourceforge.net/sourceforge/expat/expat-${EXPAT_VERSION}.…" MAKE_ARCHIVE="https://mirrors.kernel.org/gnu/make/make-${MAKE_VERSION}.tar.bz2" On 11/06/2016 05:02 PM, Nico Huber wrote: > On 06.11.2016 22:44, Taiidan(a)gmx.com wrote: >> It is 2016 not 2001 and MITM's are a regular thing so this is a serious >> issue. > Yes, YOU haven't fixed that yet.

2 1

It appears the build process still uses unverified http wget sources
by Taiidan＠gmx.com Nov. 6, 2016

Nov. 6, 2016

It is 2016 not 2001 and MITM's are a regular thing so this is a serious issue.

2 1

Re: [coreboot] radare
by Riko Ho Nov. 6, 2016

Nov. 6, 2016

Hi Rafael, For example I want to see the asm code for the whole 512Kbytes....is that possible ? How ? Thanks On 5/11/2016 3:36 AM, Rafael Machado wrote: > Hi > > You can use the pd command. > p = Print > d = disassemby > > You can also add the number of instruction you whant to see. For example: > > pd 10 > > Thanks > Rafael Machado > > Em qua, 2 de nov de 2016 às 04:01, Riko Ho <antonius.riko(a)gmail.com > <mailto:antonius.riko@gmail.com>> escreveu: > > Everyone, Idwer, > > I have radare question : > > I played until this point : > c:>radare2 -e asm.bits=16 -e io.va <http://io.va>=true i946gz.bin > -- radare2 is WYSIWYF - what you see is what you fix > [f000:fff0]> S $s-0x10000 0xF000:0x0000 0x10000 0x10000 bootblk rwx > [f000:fff0]> e asm.segoff=true > [f000:fff0]> s 0xf000:0xffff0 > [f000:ffff]> > > How can I see the assembler code from there ? It's started from > FFFF0....I'm sure the last byte instruction is jump to 0x00000 > > Cheers > > -- > coreboot mailing list: coreboot(a)coreboot.org > <mailto:coreboot@coreboot.org> > https://www.coreboot.org/mailman/listinfo/coreboot > -- */*===*/ Kind regards, Riko Ho /*===*/ *

2 1