April 2016 - coreboot - mail.coreboot.org

New Defects reported by Coverity Scan for coreboot
by scan-admin＠coverity.com April 8, 2016

April 8, 2016

Hi, Please find the latest report on new defect(s) introduced to coreboot found with Coverity Scan. 20 new defect(s) introduced to coreboot found with Coverity Scan. 152 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 20 of 20 defect(s) ** CID 1353346: Memory - illegal accesses (OVERRUN) /3rdparty/chromeec/chip/lm4/pwm.c: 63 in pwm_init() ________________________________________________________________________________________________________ *** CID 1353346: Memory - illegal accesses (OVERRUN) /3rdparty/chromeec/chip/lm4/pwm.c: 63 in pwm_init() 57 58 static void pwm_init(void) 59 { 60 int i; 61 62 for (i = 0; i < PWM_CH_COUNT; ++i) >>> CID 1353346: Memory - illegal accesses (OVERRUN) >>> Overrunning array "pwm_channels" of 1 8-byte elements at element index 1 (byte offset 8) using index "i" (which evaluates to 1). 63 fan_channel_setup(pwm_channels[i].channel, 64 (pwm_channels[i].flags & 65 PWM_CONFIG_HAS_RPM_MODE) 66 ? FAN_USE_RPM_MODE : 0); 67 } 68 69 /* The chip-specific fan module initializes before this. */ ** CID 1353342: (OVERRUN) /3rdparty/chromeec/common/pwm.c: 41 in cc_pwm_duty() /3rdparty/chromeec/common/pwm.c: 41 in cc_pwm_duty() /3rdparty/chromeec/common/pwm.c: 41 in cc_pwm_duty() /3rdparty/chromeec/common/pwm.c: 35 in cc_pwm_duty() ________________________________________________________________________________________________________ *** CID 1353342: (OVERRUN) /3rdparty/chromeec/common/pwm.c: 41 in cc_pwm_duty() 35 for (ch = 0; ch < PWM_CH_COUNT; ch++) 36 print_channel(ch); 37 return EC_SUCCESS; 38 } 39 40 ch = strtoi(argv[1], &e, 0); >>> CID 1353342: (OVERRUN) >>> Checking "ch >= PWM_CH_COUNT" implies that "ch" is between 0 and 1 (inclusive) on the false branch. 41 if (*e || ch < 0 || ch >= PWM_CH_COUNT) 42 return EC_ERROR_PARAM1; 43 44 if (argc > 2) { 45 percent = strtoi(argv[2], &e, 0); 46 if (*e || percent > 100) { /3rdparty/chromeec/common/pwm.c: 41 in cc_pwm_duty() 35 for (ch = 0; ch < PWM_CH_COUNT; ch++) 36 print_channel(ch); 37 return EC_SUCCESS; 38 } 39 40 ch = strtoi(argv[1], &e, 0); >>> CID 1353342: (OVERRUN) >>> Checking "ch >= PWM_CH_COUNT" implies that "ch" is between 0 and 1 (inclusive) on the false branch. 41 if (*e || ch < 0 || ch >= PWM_CH_COUNT) 42 return EC_ERROR_PARAM1; 43 44 if (argc > 2) { 45 percent = strtoi(argv[2], &e, 0); 46 if (*e || percent > 100) { /3rdparty/chromeec/common/pwm.c: 41 in cc_pwm_duty() 35 for (ch = 0; ch < PWM_CH_COUNT; ch++) 36 print_channel(ch); 37 return EC_SUCCESS; 38 } 39 40 ch = strtoi(argv[1], &e, 0); >>> CID 1353342: (OVERRUN) >>> Checking "ch >= PWM_CH_COUNT" implies that "ch" is between 0 and 1 (inclusive) on the false branch. 41 if (*e || ch < 0 || ch >= PWM_CH_COUNT) 42 return EC_ERROR_PARAM1; 43 44 if (argc > 2) { 45 percent = strtoi(argv[2], &e, 0); 46 if (*e || percent > 100) { /3rdparty/chromeec/common/pwm.c: 35 in cc_pwm_duty() 29 int percent = 0; 30 int ch; 31 char *e; 32 33 if (argc < 2) { 34 ccprintf("PWM channels:\n"); >>> CID 1353342: (OVERRUN) >>> Checking "ch < PWM_CH_COUNT" implies that "ch" may be up to 1 on the true branch. 35 for (ch = 0; ch < PWM_CH_COUNT; ch++) 36 print_channel(ch); 37 return EC_SUCCESS; 38 } 39 40 ch = strtoi(argv[1], &e, 0); ** CID 1353304: Memory - corruptions (OVERRUN) ________________________________________________________________________________________________________ *** CID 1353304: Memory - corruptions (OVERRUN) /3rdparty/chromeec/common/mkbp_event.c: 39 in set_host_interrupt() 33 /** 34 * Assert host keyboard interrupt line. 35 */ 36 static void set_host_interrupt(int active) 37 { 38 /* interrupt host by using active low EC_INT signal */ >>> CID 1353304: Memory - corruptions (OVERRUN) >>> Overrunning callee's array of size 44 by passing argument "GPIO_EC_INT_L" in call to "gpio_set_level". 39 gpio_set_level(GPIO_EC_INT_L, !active); 40 } 41 42 void mkbp_send_event(uint8_t event_type) 43 { 44 set_event(event_type); ** CID 1353297: (OVERRUN) ________________________________________________________________________________________________________ *** CID 1353297: (OVERRUN) /3rdparty/chromeec/common/usb_charger.c: 61 in usb_charger_port_is_sourcing_vbus() 55 } 56 } 57 58 int usb_charger_port_is_sourcing_vbus(int port) 59 { 60 if (port == 0) >>> CID 1353297: (OVERRUN) >>> Overrunning callee's array of size 44 by passing argument "GPIO_USB_C0_5V_EN" in call to "gpio_get_level". 61 return gpio_get_level(GPIO_USB_C0_5V_EN); 62 #if CONFIG_USB_PD_PORT_COUNT >= 2 63 else if (port == 1) 64 return gpio_get_level(GPIO_USB_C1_5V_EN); 65 #endif 66 /* Not a valid port */ /3rdparty/chromeec/common/usb_charger.c: 64 in usb_charger_port_is_sourcing_vbus() 58 int usb_charger_port_is_sourcing_vbus(int port) 59 { 60 if (port == 0) 61 return gpio_get_level(GPIO_USB_C0_5V_EN); 62 #if CONFIG_USB_PD_PORT_COUNT >= 2 63 else if (port == 1) >>> CID 1353297: (OVERRUN) >>> Overrunning callee's array of size 44 by passing argument "GPIO_USB_C1_5V_EN" in call to "gpio_get_level". 64 return gpio_get_level(GPIO_USB_C1_5V_EN); 65 #endif 66 /* Not a valid port */ 67 return 0; 68 } 69 /3rdparty/chromeec/common/usb_charger.c: 61 in usb_charger_port_is_sourcing_vbus() 55 } 56 } 57 58 int usb_charger_port_is_sourcing_vbus(int port) 59 { 60 if (port == 0) >>> CID 1353297: (OVERRUN) >>> Overrunning callee's array of size 44 by passing argument "GPIO_USB_C0_5V_EN" in call to "gpio_get_level". 61 return gpio_get_level(GPIO_USB_C0_5V_EN); 62 #if CONFIG_USB_PD_PORT_COUNT >= 2 63 else if (port == 1) 64 return gpio_get_level(GPIO_USB_C1_5V_EN); 65 #endif 66 /* Not a valid port */ /3rdparty/chromeec/common/usb_charger.c: 64 in usb_charger_port_is_sourcing_vbus() 58 int usb_charger_port_is_sourcing_vbus(int port) 59 { 60 if (port == 0) 61 return gpio_get_level(GPIO_USB_C0_5V_EN); 62 #if CONFIG_USB_PD_PORT_COUNT >= 2 63 else if (port == 1) >>> CID 1353297: (OVERRUN) >>> Overrunning callee's array of size 44 by passing argument "GPIO_USB_C1_5V_EN" in call to "gpio_get_level". 64 return gpio_get_level(GPIO_USB_C1_5V_EN); 65 #endif 66 /* Not a valid port */ 67 return 0; 68 } 69 ** CID 1353286: Memory - corruptions (OVERRUN) ________________________________________________________________________________________________________ *** CID 1353286: Memory - corruptions (OVERRUN) /3rdparty/chromeec/power/braswell.c: 340 in enter_pseudo_g3() 334 void enter_pseudo_g3(void) 335 { 336 CPRINTS("Enter Psuedo G3"); 337 cflush(); 338 339 gpio_set_level(GPIO_EC_HIB_L, 1); >>> CID 1353286: Memory - corruptions (OVERRUN) >>> Overrunning callee's array of size 44 by passing argument "GPIO_SMC_SHUTDOWN" in call to "gpio_set_level". 340 gpio_set_level(GPIO_SMC_SHUTDOWN, 1); 341 342 /* Power to EC should shut down now */ 343 while (1) 344 ; 345 } ** CID 1353265: (OVERRUN) ________________________________________________________________________________________________________ *** CID 1353265: (OVERRUN) /3rdparty/chromeec/common/system.c: 644 in system_get_board_version() 638 int v = 0; 639 640 #ifdef CONFIG_BOARD_VERSION 641 #ifdef CONFIG_BOARD_SPECIFIC_VERSION 642 v = board_get_version(); 643 #else >>> CID 1353265: (OVERRUN) >>> Overrunning callee's array of size 44 by passing argument "GPIO_BOARD_VERSION1" in call to "gpio_get_level". 644 if (gpio_get_level(GPIO_BOARD_VERSION1)) 645 v |= 0x01; 646 if (gpio_get_level(GPIO_BOARD_VERSION2)) 647 v |= 0x02; 648 if (gpio_get_level(GPIO_BOARD_VERSION3)) 649 v |= 0x04; /3rdparty/chromeec/common/system.c: 646 in system_get_board_version() 640 #ifdef CONFIG_BOARD_VERSION 641 #ifdef CONFIG_BOARD_SPECIFIC_VERSION 642 v = board_get_version(); 643 #else 644 if (gpio_get_level(GPIO_BOARD_VERSION1)) 645 v |= 0x01; >>> CID 1353265: (OVERRUN) >>> Overrunning callee's array of size 44 by passing argument "GPIO_BOARD_VERSION2" in call to "gpio_get_level". 646 if (gpio_get_level(GPIO_BOARD_VERSION2)) 647 v |= 0x02; 648 if (gpio_get_level(GPIO_BOARD_VERSION3)) 649 v |= 0x04; 650 #endif 651 #endif /3rdparty/chromeec/common/system.c: 648 in system_get_board_version() 642 v = board_get_version(); 643 #else 644 if (gpio_get_level(GPIO_BOARD_VERSION1)) 645 v |= 0x01; 646 if (gpio_get_level(GPIO_BOARD_VERSION2)) 647 v |= 0x02; >>> CID 1353265: (OVERRUN) >>> Overrunning callee's array of size 44 by passing argument "GPIO_BOARD_VERSION3" in call to "gpio_get_level". 648 if (gpio_get_level(GPIO_BOARD_VERSION3)) 649 v |= 0x04; 650 #endif 651 #endif 652 653 return v; ** CID 1353263: (OVERRUN) ________________________________________________________________________________________________________ *** CID 1353263: (OVERRUN) /3rdparty/chromeec/power/braswell.c: 226 in power_handle_state() 220 msleep(15); 221 222 /* 223 * Throttle CPU if necessary. This should only be asserted 224 * when +VCCP is powered (it is by now). 225 */ >>> CID 1353263: (OVERRUN) >>> Overrunning callee's array of size 44 by passing argument "GPIO_CPU_PROCHOT" in call to "gpio_set_level". 226 gpio_set_level(GPIO_CPU_PROCHOT, throttle_cpu); 227 228 /* Set SYS and CORE PWROK */ 229 gpio_set_level(GPIO_PCH_SYS_PWROK, 1); 230 231 return POWER_S0; /3rdparty/chromeec/power/braswell.c: 271 in power_handle_state() 265 enable_sleep(SLEEP_MASK_AP_RUN); 266 267 /* 268 * Deassert prochot since CPU is off and we're about to drop 269 * +VCCP. 270 */ >>> CID 1353263: (OVERRUN) >>> Overrunning callee's array of size 44 by passing argument "GPIO_CPU_PROCHOT" in call to "gpio_set_level". 271 gpio_set_level(GPIO_CPU_PROCHOT, 0); 272 273 return POWER_S3; 274 275 case POWER_S3S5: 276 /3rdparty/chromeec/power/braswell.c: 162 in power_handle_state() 156 if (power_wait_signals(IN_PGOOD_S5)) { 157 chipset_force_shutdown(); 158 return POWER_G3; 159 } 160 161 /* Deassert RSMRST# */ >>> CID 1353263: (OVERRUN) >>> Overrunning callee's array of size 44 by passing argument "GPIO_PCH_RSMRST_L" in call to "gpio_set_level". 162 gpio_set_level(GPIO_PCH_RSMRST_L, 1); 163 return POWER_S5; 164 165 case POWER_S5: 166 /* Check for SLP S4 */ 167 if (gpio_get_level(GPIO_PCH_SLP_S4_L) == 1) /3rdparty/chromeec/power/braswell.c: 309 in power_handle_state() 303 304 return POWER_G3; 305 } 306 307 if (gpio_get_level(GPIO_PCH_SUSPWRDNACK) == 1) { 308 /* Assert RSMRST# */ >>> CID 1353263: (OVERRUN) >>> Overrunning callee's array of size 44 by passing argument "GPIO_PCH_RSMRST_L" in call to "gpio_set_level". 309 gpio_set_level(GPIO_PCH_RSMRST_L, 0); 310 311 /* Config pins for SOC G3 */ 312 gpio_config_module(MODULE_GPIO, 1); 313 314 /* Enter SOC G3 */ /3rdparty/chromeec/power/braswell.c: 318 in power_handle_state() 312 gpio_config_module(MODULE_GPIO, 1); 313 314 /* Enter SOC G3 */ 315 #ifdef CONFIG_PMIC 316 gpio_set_level(GPIO_PCH_SYS_PWROK, 0); 317 udelay(1); >>> CID 1353263: (OVERRUN) >>> Overrunning callee's array of size 44 by passing argument "GPIO_PCH_RSMRST_L" in call to "gpio_set_level". 318 gpio_set_level(GPIO_PCH_RSMRST_L, 0); 319 #else 320 gpio_set_level(GPIO_SUSPWRDNACK_SOC_EC, 1); 321 #endif 322 CPRINTS("Enter SOC G3"); 323 /3rdparty/chromeec/power/braswell.c: 307 in power_handle_state() 301 302 CPRINTS("Enter SOC G3"); 303 304 return POWER_G3; 305 } 306 >>> CID 1353263: (OVERRUN) >>> Overrunning callee's array of size 44 by passing argument "GPIO_PCH_SUSPWRDNACK" in call to "gpio_get_level". 307 if (gpio_get_level(GPIO_PCH_SUSPWRDNACK) == 1) { 308 /* Assert RSMRST# */ 309 gpio_set_level(GPIO_PCH_RSMRST_L, 0); 310 311 /* Config pins for SOC G3 */ 312 gpio_config_module(MODULE_GPIO, 1); ** CID 1353262: Memory - corruptions (OVERRUN) ________________________________________________________________________________________________________ *** CID 1353262: Memory - corruptions (OVERRUN) /3rdparty/chromeec/power/braswell.c: 67 in chipset_force_shutdown() 61 * Force power off. This condition will reset once the state machine 62 * transitions to G3. 63 */ 64 #ifndef CONFIG_PMIC 65 gpio_set_level(GPIO_PCH_SYS_PWROK, 0); 66 #endif >>> CID 1353262: Memory - corruptions (OVERRUN) >>> Overrunning callee's array of size 44 by passing argument "GPIO_PCH_RSMRST_L" in call to "gpio_set_level". 67 gpio_set_level(GPIO_PCH_RSMRST_L, 0); 68 forcing_shutdown = 1; 69 } 70 71 void chipset_reset(int cold_reset) 72 { ** CID 1353249: Memory - corruptions (OVERRUN) ________________________________________________________________________________________________________ *** CID 1353249: Memory - corruptions (OVERRUN) /3rdparty/chromeec/power/braswell.c: 108 in chipset_throttle_cpu() 102 } 103 } 104 105 void chipset_throttle_cpu(int throttle) 106 { 107 if (chipset_in_state(CHIPSET_STATE_ON)) >>> CID 1353249: Memory - corruptions (OVERRUN) >>> Overrunning callee's array of size 44 by passing argument "GPIO_CPU_PROCHOT" in call to "gpio_set_level". 108 gpio_set_level(GPIO_CPU_PROCHOT, throttle); 109 } 110 111 enum power_state power_chipset_init(void) 112 { 113 /* Pause in S5 when shutting down. */ ** CID 1353248: (OVERRUN) ________________________________________________________________________________________________________ *** CID 1353248: (OVERRUN) /3rdparty/chromeec/power/braswell.c: 99 in chipset_reset() 93 /* 94 * Send a reset pulse to the PCH. This just causes it to 95 * assert INIT# to the CPU without dropping power or asserting 96 * PLTRST# to reset the rest of the system. The PCH uses a 16 97 * ms debounce time, so assert the signal for twice that. 98 */ >>> CID 1353248: (OVERRUN) >>> Overrunning callee's array of size 44 by passing argument "GPIO_PCH_RCIN_L" in call to "gpio_set_level". 99 gpio_set_level(GPIO_PCH_RCIN_L, 0); 100 usleep(32 * MSEC); 101 gpio_set_level(GPIO_PCH_RCIN_L, 1); 102 } 103 } 104 /3rdparty/chromeec/power/braswell.c: 101 in chipset_reset() 95 * assert INIT# to the CPU without dropping power or asserting 96 * PLTRST# to reset the rest of the system. The PCH uses a 16 97 * ms debounce time, so assert the signal for twice that. 98 */ 99 gpio_set_level(GPIO_PCH_RCIN_L, 0); 100 usleep(32 * MSEC); >>> CID 1353248: (OVERRUN) >>> Overrunning callee's array of size 44 by passing argument "GPIO_PCH_RCIN_L" in call to "gpio_set_level". 101 gpio_set_level(GPIO_PCH_RCIN_L, 1); 102 } 103 } 104 105 void chipset_throttle_cpu(int throttle) 106 { ** CID 1353243: Memory - corruptions (OVERRUN) ________________________________________________________________________________________________________ *** CID 1353243: Memory - corruptions (OVERRUN) /3rdparty/chromeec/board/kunimitsu/board.c: 629 in board_handle_reboot() 623 624 ccprintf("Restarting system with PMIC.\n"); 625 /* Flush console */ 626 cflush(); 627 628 /* Bring down all rails but RTC rail (including EC power). */ >>> CID 1353243: Memory - corruptions (OVERRUN) >>> Overrunning callee's array of size 44 by passing argument "GPIO_LDO_EN" in call to "gpio_set_level". 629 gpio_set_level(GPIO_LDO_EN, 1); 630 while (1) 631 ; /* wait here */ 632 } ** CID 1353241: Memory - corruptions (OVERRUN) ________________________________________________________________________________________________________ *** CID 1353241: Memory - corruptions (OVERRUN) /3rdparty/chromeec/common/flash.c: 409 in flash_get_protect() 403 #ifdef CONFIG_WP_ALWAYS 404 flags |= EC_FLASH_PROTECT_GPIO_ASSERTED; 405 #elif defined(CONFIG_WP_ACTIVE_HIGH) 406 if (gpio_get_level(GPIO_WP)) 407 flags |= EC_FLASH_PROTECT_GPIO_ASSERTED; 408 #else >>> CID 1353241: Memory - corruptions (OVERRUN) >>> Overrunning callee's array of size 44 by passing argument "GPIO_WP_L" in call to "gpio_get_level". 409 if (!gpio_get_level(GPIO_WP_L)) 410 flags |= EC_FLASH_PROTECT_GPIO_ASSERTED; 411 #endif 412 413 #ifdef CONFIG_FLASH_PSTATE 414 /* Read persistent state of RO-at-boot flag */ ** CID 1353215: Memory - corruptions (OVERRUN) ________________________________________________________________________________________________________ *** CID 1353215: Memory - corruptions (OVERRUN) /3rdparty/chromeec/power/braswell.c: 132 in power_chipset_init() 126 CPRINTS("already in S0"); 127 return POWER_S0; 128 } else { 129 /* Force all signals to their G3 states */ 130 CPRINTS("forcing G3"); 131 gpio_set_level(GPIO_PCH_SYS_PWROK, 0); >>> CID 1353215: Memory - corruptions (OVERRUN) >>> Overrunning callee's array of size 44 by passing argument "GPIO_PCH_RSMRST_L" in call to "gpio_set_level". 132 gpio_set_level(GPIO_PCH_RSMRST_L, 0); 133 134 /*wireless_set_state(WIRELESS_OFF);*/ 135 } 136 } 137 ** CID 1353203: (OVERRUN) ________________________________________________________________________________________________________ *** CID 1353203: (OVERRUN) /3rdparty/chromeec/board/chell/board.c: 181 in board_reset_pd_mcu() 175 176 /** 177 * Reset PD MCU 178 */ 179 void board_reset_pd_mcu(void) 180 { >>> CID 1353203: (OVERRUN) >>> Overrunning callee's array of size 44 by passing argument "GPIO_PD_RST_L" in call to "gpio_set_level". 181 gpio_set_level(GPIO_PD_RST_L, 0); 182 usleep(100); 183 gpio_set_level(GPIO_PD_RST_L, 1); 184 } 185 186 void board_rtc_reset(void) /3rdparty/chromeec/board/chell/board.c: 183 in board_reset_pd_mcu() 177 * Reset PD MCU 178 */ 179 void board_reset_pd_mcu(void) 180 { 181 gpio_set_level(GPIO_PD_RST_L, 0); 182 usleep(100); >>> CID 1353203: (OVERRUN) >>> Overrunning callee's array of size 44 by passing argument "GPIO_PD_RST_L" in call to "gpio_set_level". 183 gpio_set_level(GPIO_PD_RST_L, 1); 184 } 185 186 void board_rtc_reset(void) 187 { 188 CPRINTS("Asserting RTCRST# to PCH"); ** CID 1353199: (OVERRUN) ________________________________________________________________________________________________________ *** CID 1353199: (OVERRUN) /3rdparty/chromeec/chip/mec1322/system.c: 266 in system_hibernate() 260 /* 261 * Leave USB-C charging enabled in hibernate, in order to 262 * allow wake-on-plug. 5V enable must be pulled low. 263 */ 264 #if CONFIG_USB_PD_PORT_COUNT > 0 265 gpio_set_flags(GPIO_USB_C0_5V_EN, GPIO_PULL_DOWN | GPIO_INPUT); >>> CID 1353199: (OVERRUN) >>> Overrunning callee's array of size 44 by passing argument "GPIO_USB_C0_CHARGE_EN_L" in call to "gpio_set_level". 266 gpio_set_level(GPIO_USB_C0_CHARGE_EN_L, 0); 267 #endif 268 #if CONFIG_USB_PD_PORT_COUNT > 1 269 gpio_set_flags(GPIO_USB_C1_5V_EN, GPIO_PULL_DOWN | GPIO_INPUT); 270 gpio_set_level(GPIO_USB_C1_CHARGE_EN_L, 0); 271 #endif /3rdparty/chromeec/chip/mec1322/system.c: 270 in system_hibernate() 264 #if CONFIG_USB_PD_PORT_COUNT > 0 265 gpio_set_flags(GPIO_USB_C0_5V_EN, GPIO_PULL_DOWN | GPIO_INPUT); 266 gpio_set_level(GPIO_USB_C0_CHARGE_EN_L, 0); 267 #endif 268 #if CONFIG_USB_PD_PORT_COUNT > 1 269 gpio_set_flags(GPIO_USB_C1_5V_EN, GPIO_PULL_DOWN | GPIO_INPUT); >>> CID 1353199: (OVERRUN) >>> Overrunning callee's array of size 44 by passing argument "GPIO_USB_C1_CHARGE_EN_L" in call to "gpio_set_level". 270 gpio_set_level(GPIO_USB_C1_CHARGE_EN_L, 0); 271 #endif 272 #endif /* CONFIG_USB_PD_PORT_COUNT */ 273 274 if (hibernate_wake_pins_used > 0) { 275 for (i = 0; i < hibernate_wake_pins_used; ++i) { ** CID 1353189: (OVERRUN) ________________________________________________________________________________________________________ *** CID 1353189: (OVERRUN) /3rdparty/chromeec/board/chell/board.c: 303 in board_set_active_charge_port() 297 int board_set_active_charge_port(int charge_port) 298 { 299 /* charge port is a realy physical port */ 300 int is_real_port = (charge_port >= 0 && 301 charge_port < CONFIG_USB_PD_PORT_COUNT); 302 /* check if we are source vbus on that port */ >>> CID 1353189: (OVERRUN) >>> Overrunning callee's array of size 44 by passing argument "(charge_port == 0) ? GPIO_USB_C0_5V_EN : GPIO_USB_C1_5V_EN" (which evaluates to 54) in call to "gpio_get_level". 303 int source = gpio_get_level(charge_port == 0 ? GPIO_USB_C0_5V_EN : 304 GPIO_USB_C1_5V_EN); 305 306 if (is_real_port && source) { 307 CPRINTS("Skip enable p%d", charge_port); 308 return EC_ERROR_INVAL; /3rdparty/chromeec/board/chell/board.c: 319 in board_set_active_charge_port() 313 if (charge_port == CHARGE_PORT_NONE) { 314 /* Disable both ports */ 315 gpio_set_level(GPIO_USB_C0_CHARGE_EN_L, 1); 316 gpio_set_level(GPIO_USB_C1_CHARGE_EN_L, 1); 317 } else { 318 /* Make sure non-charging port is disabled */ >>> CID 1353189: (OVERRUN) >>> Overrunning callee's array of size 44 by passing argument "charge_port ? GPIO_USB_C0_CHARGE_EN_L : GPIO_USB_C1_CHARGE_EN_L" (which evaluates to 57) in call to "gpio_set_level". 319 gpio_set_level(charge_port ? GPIO_USB_C0_CHARGE_EN_L : 320 GPIO_USB_C1_CHARGE_EN_L, 1); 321 /* Enable charging port */ 322 gpio_set_level(charge_port ? GPIO_USB_C1_CHARGE_EN_L : 323 GPIO_USB_C0_CHARGE_EN_L, 0); 324 } /3rdparty/chromeec/board/chell/board.c: 322 in board_set_active_charge_port() 316 gpio_set_level(GPIO_USB_C1_CHARGE_EN_L, 1); 317 } else { 318 /* Make sure non-charging port is disabled */ 319 gpio_set_level(charge_port ? GPIO_USB_C0_CHARGE_EN_L : 320 GPIO_USB_C1_CHARGE_EN_L, 1); 321 /* Enable charging port */ >>> CID 1353189: (OVERRUN) >>> Overrunning callee's array of size 44 by passing argument "charge_port ? GPIO_USB_C1_CHARGE_EN_L : GPIO_USB_C0_CHARGE_EN_L" (which evaluates to 56) in call to "gpio_set_level". 322 gpio_set_level(charge_port ? GPIO_USB_C1_CHARGE_EN_L : 323 GPIO_USB_C0_CHARGE_EN_L, 0); 324 } 325 326 return EC_SUCCESS; 327 } /3rdparty/chromeec/board/chell/board.c: 315 in board_set_active_charge_port() 309 } 310 311 CPRINTS("New chg p%d", charge_port); 312 313 if (charge_port == CHARGE_PORT_NONE) { 314 /* Disable both ports */ >>> CID 1353189: (OVERRUN) >>> Overrunning callee's array of size 44 by passing argument "GPIO_USB_C0_CHARGE_EN_L" in call to "gpio_set_level". 315 gpio_set_level(GPIO_USB_C0_CHARGE_EN_L, 1); 316 gpio_set_level(GPIO_USB_C1_CHARGE_EN_L, 1); 317 } else { 318 /* Make sure non-charging port is disabled */ 319 gpio_set_level(charge_port ? GPIO_USB_C0_CHARGE_EN_L : 320 GPIO_USB_C1_CHARGE_EN_L, 1); /3rdparty/chromeec/board/chell/board.c: 316 in board_set_active_charge_port() 310 311 CPRINTS("New chg p%d", charge_port); 312 313 if (charge_port == CHARGE_PORT_NONE) { 314 /* Disable both ports */ 315 gpio_set_level(GPIO_USB_C0_CHARGE_EN_L, 1); >>> CID 1353189: (OVERRUN) >>> Overrunning callee's array of size 44 by passing argument "GPIO_USB_C1_CHARGE_EN_L" in call to "gpio_set_level". 316 gpio_set_level(GPIO_USB_C1_CHARGE_EN_L, 1); 317 } else { 318 /* Make sure non-charging port is disabled */ 319 gpio_set_level(charge_port ? GPIO_USB_C0_CHARGE_EN_L : 320 GPIO_USB_C1_CHARGE_EN_L, 1); 321 /* Enable charging port */ /3rdparty/chromeec/board/kunimitsu/board.c: 551 in board_set_active_charge_port() 545 int board_set_active_charge_port(int charge_port) 546 { 547 /* charge port is a realy physical port */ 548 int is_real_port = (charge_port >= 0 && 549 charge_port < CONFIG_USB_PD_PORT_COUNT); 550 /* check if we are source vbus on that port */ >>> CID 1353189: (OVERRUN) >>> Overrunning callee's array of size 44 by passing argument "(charge_port == 0) ? GPIO_USB_C0_5V_EN : GPIO_USB_C1_5V_EN" (which evaluates to 56) in call to "gpio_get_level". 551 int source = gpio_get_level(charge_port == 0 ? GPIO_USB_C0_5V_EN : 552 GPIO_USB_C1_5V_EN); 553 554 if (is_real_port && source) { 555 CPRINTS("Skip enable p%d", charge_port); 556 return EC_ERROR_INVAL; /3rdparty/chromeec/board/kunimitsu/board.c: 567 in board_set_active_charge_port() 561 if (charge_port == CHARGE_PORT_NONE) { 562 /* Disable both ports */ 563 gpio_set_level(GPIO_USB_C0_CHARGE_EN_L, 1); 564 gpio_set_level(GPIO_USB_C1_CHARGE_EN_L, 1); 565 } else { 566 /* Make sure non-charging port is disabled */ >>> CID 1353189: (OVERRUN) >>> Overrunning callee's array of size 44 by passing argument "charge_port ? GPIO_USB_C0_CHARGE_EN_L : GPIO_USB_C1_CHARGE_EN_L" (which evaluates to 59) in call to "gpio_set_level". 567 gpio_set_level(charge_port ? GPIO_USB_C0_CHARGE_EN_L : 568 GPIO_USB_C1_CHARGE_EN_L, 1); 569 /* Enable charging port */ 570 gpio_set_level(charge_port ? GPIO_USB_C1_CHARGE_EN_L : 571 GPIO_USB_C0_CHARGE_EN_L, 0); 572 } /3rdparty/chromeec/board/kunimitsu/board.c: 570 in board_set_active_charge_port() 564 gpio_set_level(GPIO_USB_C1_CHARGE_EN_L, 1); 565 } else { 566 /* Make sure non-charging port is disabled */ 567 gpio_set_level(charge_port ? GPIO_USB_C0_CHARGE_EN_L : 568 GPIO_USB_C1_CHARGE_EN_L, 1); 569 /* Enable charging port */ >>> CID 1353189: (OVERRUN) >>> Overrunning callee's array of size 44 by passing argument "charge_port ? GPIO_USB_C1_CHARGE_EN_L : GPIO_USB_C0_CHARGE_EN_L" (which evaluates to 58) in call to "gpio_set_level". 570 gpio_set_level(charge_port ? GPIO_USB_C1_CHARGE_EN_L : 571 GPIO_USB_C0_CHARGE_EN_L, 0); 572 } 573 574 return EC_SUCCESS; 575 } /3rdparty/chromeec/board/kunimitsu/board.c: 563 in board_set_active_charge_port() 557 } 558 559 CPRINTS("New chg p%d", charge_port); 560 561 if (charge_port == CHARGE_PORT_NONE) { 562 /* Disable both ports */ >>> CID 1353189: (OVERRUN) >>> Overrunning callee's array of size 44 by passing argument "GPIO_USB_C0_CHARGE_EN_L" in call to "gpio_set_level". 563 gpio_set_level(GPIO_USB_C0_CHARGE_EN_L, 1); 564 gpio_set_level(GPIO_USB_C1_CHARGE_EN_L, 1); 565 } else { 566 /* Make sure non-charging port is disabled */ 567 gpio_set_level(charge_port ? GPIO_USB_C0_CHARGE_EN_L : 568 GPIO_USB_C1_CHARGE_EN_L, 1); /3rdparty/chromeec/board/kunimitsu/board.c: 564 in board_set_active_charge_port() 558 559 CPRINTS("New chg p%d", charge_port); 560 561 if (charge_port == CHARGE_PORT_NONE) { 562 /* Disable both ports */ 563 gpio_set_level(GPIO_USB_C0_CHARGE_EN_L, 1); >>> CID 1353189: (OVERRUN) >>> Overrunning callee's array of size 44 by passing argument "GPIO_USB_C1_CHARGE_EN_L" in call to "gpio_set_level". 564 gpio_set_level(GPIO_USB_C1_CHARGE_EN_L, 1); 565 } else { 566 /* Make sure non-charging port is disabled */ 567 gpio_set_level(charge_port ? GPIO_USB_C0_CHARGE_EN_L : 568 GPIO_USB_C1_CHARGE_EN_L, 1); 569 /* Enable charging port */ ** CID 1353188: Memory - corruptions (OVERRUN) ________________________________________________________________________________________________________ *** CID 1353188: Memory - corruptions (OVERRUN) /3rdparty/chromeec/board/kunimitsu/board.c: 524 in board_init() 518 519 /* Enable pericom BC1.2 interrupts */ 520 gpio_enable_interrupt(GPIO_USB_C0_BC12_INT_L); 521 gpio_enable_interrupt(GPIO_USB_C1_BC12_INT_L); 522 523 /* Provide AC status to the PCH */ >>> CID 1353188: Memory - corruptions (OVERRUN) >>> Overrunning callee's array of size 44 by passing argument "GPIO_PCH_ACOK" in call to "gpio_set_level". 524 gpio_set_level(GPIO_PCH_ACOK, extpower_is_present()); 525 } 526 DECLARE_HOOK(HOOK_INIT, board_init, HOOK_PRIO_DEFAULT); 527 528 /** 529 * Buffer the AC present GPIO to the PCH. ** CID 1353187: Memory - corruptions (OVERRUN) ________________________________________________________________________________________________________ *** CID 1353187: Memory - corruptions (OVERRUN) /3rdparty/chromeec/board/kunimitsu/board.c: 533 in board_extpower() 527 528 /** 529 * Buffer the AC present GPIO to the PCH. 530 */ 531 static void board_extpower(void) 532 { >>> CID 1353187: Memory - corruptions (OVERRUN) >>> Overrunning callee's array of size 44 by passing argument "GPIO_PCH_ACOK" in call to "gpio_set_level". 533 gpio_set_level(GPIO_PCH_ACOK, extpower_is_present()); 534 } 535 DECLARE_HOOK(HOOK_AC_CHANGE, board_extpower, HOOK_PRIO_DEFAULT); 536 537 /** 538 * Set active charge port -- only one port can be active at a time. ** CID 1353185: (OVERRUN) ________________________________________________________________________________________________________ *** CID 1353185: (OVERRUN) /3rdparty/chromeec/board/chell/board.c: 344 in board_chipset_startup() 338 } 339 340 /* Called on AP S5 -> S3 transition */ 341 static void board_chipset_startup(void) 342 { 343 gpio_set_level(GPIO_USB1_ENABLE, 1); >>> CID 1353185: (OVERRUN) >>> Overrunning callee's array of size 44 by passing argument "GPIO_ENABLE_TOUCHPAD" in call to "gpio_set_level". 344 gpio_set_level(GPIO_ENABLE_TOUCHPAD, 1); 345 } 346 DECLARE_HOOK(HOOK_CHIPSET_STARTUP, board_chipset_startup, HOOK_PRIO_DEFAULT); 347 348 /* Called on AP S3 -> S5 transition */ 349 static void board_chipset_shutdown(void) /3rdparty/chromeec/board/chell/board.c: 343 in board_chipset_startup() 337 CONFIG_CHARGER_INPUT_CURRENT)); 338 } 339 340 /* Called on AP S5 -> S3 transition */ 341 static void board_chipset_startup(void) 342 { >>> CID 1353185: (OVERRUN) >>> Overrunning callee's array of size 44 by passing argument "GPIO_USB1_ENABLE" in call to "gpio_set_level". 343 gpio_set_level(GPIO_USB1_ENABLE, 1); 344 gpio_set_level(GPIO_ENABLE_TOUCHPAD, 1); 345 } 346 DECLARE_HOOK(HOOK_CHIPSET_STARTUP, board_chipset_startup, HOOK_PRIO_DEFAULT); 347 348 /* Called on AP S3 -> S5 transition */ ** CID 1353184: (OVERRUN) ________________________________________________________________________________________________________ *** CID 1353184: (OVERRUN) /3rdparty/chromeec/board/chell/board.c: 352 in board_chipset_shutdown() 346 DECLARE_HOOK(HOOK_CHIPSET_STARTUP, board_chipset_startup, HOOK_PRIO_DEFAULT); 347 348 /* Called on AP S3 -> S5 transition */ 349 static void board_chipset_shutdown(void) 350 { 351 gpio_set_level(GPIO_USB1_ENABLE, 0); >>> CID 1353184: (OVERRUN) >>> Overrunning callee's array of size 44 by passing argument "GPIO_ENABLE_TOUCHPAD" in call to "gpio_set_level". 352 gpio_set_level(GPIO_ENABLE_TOUCHPAD, 0); 353 } 354 DECLARE_HOOK(HOOK_CHIPSET_SHUTDOWN, board_chipset_shutdown, HOOK_PRIO_DEFAULT); 355 356 /* Called on AP S3 -> S0 transition */ 357 static void board_chipset_resume(void) /3rdparty/chromeec/board/chell/board.c: 351 in board_chipset_shutdown() 345 } 346 DECLARE_HOOK(HOOK_CHIPSET_STARTUP, board_chipset_startup, HOOK_PRIO_DEFAULT); 347 348 /* Called on AP S3 -> S5 transition */ 349 static void board_chipset_shutdown(void) 350 { >>> CID 1353184: (OVERRUN) >>> Overrunning callee's array of size 44 by passing argument "GPIO_USB1_ENABLE" in call to "gpio_set_level". 351 gpio_set_level(GPIO_USB1_ENABLE, 0); 352 gpio_set_level(GPIO_ENABLE_TOUCHPAD, 0); 353 } 354 DECLARE_HOOK(HOOK_CHIPSET_SHUTDOWN, board_chipset_shutdown, HOOK_PRIO_DEFAULT); 355 356 /* Called on AP S3 -> S0 transition */ ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://scan.coverity.com/projects/coreboot?tab=overview To manage Coverity Scan email notifications for "coreboot(a)coreboot.org", click https://scan.coverity.com/subscriptions/edit?email=coreboot%40coreboot.org&…

1 0

Re: [coreboot] Regarding offset adjustment for building coreboot.
by Nico Huber April 8, 2016

April 8, 2016

Hi Patrick, On 08.04.2016 09:57, Patrick Georgi via coreboot wrote: > 2016-04-08 9:51 GMT+02:00 rajashaker Goud <rajashakergoudranga(a)gmail.com>: >> I have build coreboot with release payload. > > [ stripped to list only the empty regions] >> Name Offset Type Size >> (empty) 0xd8380 null 48152 >> (empty) 0x105840 null 1880 >> (empty) 0x10e000 null 8088 >> (empty) 0x150000 null 311192 >> (empty) 0x1e8c00 null 58200 >> (empty) 0x1ff9c0 null 536 > That makes approx. 450K of free space in your image > >> but when i build debug am facing space issue: >> E: Could not add [payloads/external/uefi/UEFIPAYLOAD.fd, 886346 bytes (865 >> KB)@0x0]; too big? > This is indicates a 865K image. How is that supposed to fit? you also stripped: fallback/payload 0x1b140 payload 769955 I guess he means that a fresh build with a bigger (865KiB instead of 752KiB) payload fails. Nico -- M. Sc. Nico Huber Senior Berater SINA-Softwareentwicklung Netzwerk- & Client-Sicherheit / Network & Client Security Division Öffentliche Auftraggeber / Public Authorities secunet Security Networks AG Tel.: +49-201-5454-3635, Fax: +49-201-5454-1325 E-Mail: nico.huber(a)secunet.com Mergenthalerallee 77, 65760 Eschborn, Deutschland www.secunet.com ______________________________________________________________________ Sitz: Kronprinzenstraße 30, 45128 Essen, Deutschland Amtsgericht Essen HRB 13615 Vorstand: Dr. Rainer Baumgart (Vors.), Thomas Pleines Aufsichtsratsvorsitzender: Dr. Peter Zattler ______________________________________________________________________

2 1

Re: [coreboot] Regarding offset adjustment for building coreboot.
by Nico Huber April 8, 2016

April 8, 2016

Hi Rajashaker, On 08.04.2016 09:51, rajashaker Goud wrote: > So in my case i need to adjust the offset coz after config i have empty > space available. > please help me in changing the offset. > i dont have idea regarding which part of code need to change to adjust > offset. I don't know how to change the offsets. Some might not be chosen arbitrarily at all. But maybe there is another simple option: Did you already try to increase the size of your CBFS (CONFIG_CBFS_SIZE)? It may be as large as the "bios" partition of your flash chip. Hope that helps, Nico -- M. Sc. Nico Huber Senior Berater SINA-Softwareentwicklung Netzwerk- & Client-Sicherheit / Network & Client Security Division Öffentliche Auftraggeber / Public Authorities secunet Security Networks AG Tel.: +49-201-5454-3635, Fax: +49-201-5454-1325 E-Mail: nico.huber(a)secunet.com Mergenthalerallee 77, 65760 Eschborn, Deutschland www.secunet.com ______________________________________________________________________ Sitz: Kronprinzenstraße 30, 45128 Essen, Deutschland Amtsgericht Essen HRB 13615 Vorstand: Dr. Rainer Baumgart (Vors.), Thomas Pleines Aufsichtsratsvorsitzender: Dr. Peter Zattler ______________________________________________________________________

1 0

Re: [coreboot] Regarding offset adjustment for building coreboot.
by Patrick Georgi April 8, 2016

April 8, 2016

2016-04-08 9:51 GMT+02:00 rajashaker Goud <rajashakergoudranga(a)gmail.com>: > I have build coreboot with release payload. [ stripped to list only the empty regions] > Name Offset Type Size > (empty) 0xd8380 null 48152 > (empty) 0x105840 null 1880 > (empty) 0x10e000 null 8088 > (empty) 0x150000 null 311192 > (empty) 0x1e8c00 null 58200 > (empty) 0x1ff9c0 null 536 That makes approx. 450K of free space in your image > but when i build debug am facing space issue: > E: Could not add [payloads/external/uefi/UEFIPAYLOAD.fd, 886346 bytes (865 > KB)@0x0]; too big? This is indicates a 865K image. How is that supposed to fit? Patrick -- Google Germany GmbH, ABC-Str. 19, 20354 Hamburg Registergericht und -nummer: Hamburg, HRB 86891, Sitz der Gesellschaft: Hamburg Geschäftsführer: Matthew Scott Sucherman, Paul Terence Manicle

1 0

Regarding offset adjustment for building coreboot.
by rajashaker Goud April 8, 2016

April 8, 2016

Hi All, I have build coreboot with release payload. Name Offset Type Size bootsplash.img 0x0 bootsplash 37443 cmos_layout.bin 0x9280 cmos_layout 1132 fspd.bin 0x9740 (unknown) 4608 fallback/ramstage 0xa980 stage 67423 fallback/payload 0x1b140 payload 769955 config 0xd7140 raw 4623 (empty) 0xd8380 null 48152 cpu_microcode_blob.bin 0xe3fc0 microcode 137232 (empty) 0x105840 null 1880 mrc.cache 0x105fc0 (unknown) 32768 (empty) 0x10e000 null 8088 uefi_nvs.bin 0x10ffc0 (unknown) 262144 (empty) 0x150000 null 311192 fsp.bin 0x19bfc0 (unknown) 314368 (empty) 0x1e8c00 null 58200 fallback/romstage 0x1f6f80 stage 35253 (empty) 0x1ff9c0 null 536 but when i build debug am facing space issue: E: Could not add [payloads/external/uefi/UEFIPAYLOAD.fd, 886346 bytes (865 KB)@0x0]; too big? E: Failed to add 'payloads/external/uefi/UEFIPAYLOAD.fd' into ROM image. make: *** [build/coreboot.rom] Error 1 So in my case i need to adjust the offset coz after config i have empty space available. please help me in changing the offset. i dont have idea regarding which part of code need to change to adjust offset. Thanks in advance. -- Thanks, Rajashaker Goud Ranga

1 0

Linux as payload
by daoud yessine April 7, 2016

April 7, 2016

Hi how to build coreboot with linux as payload ? I need Bzimage only ? what about the file system ? thanks ᐧ

1 0

Community Meeting
by Zaolin April 7, 2016

April 7, 2016

Hi folks, Paul and I came up with the idea of doing a coreboot community meeting every 2 weeks. The plan for this meeting is to sync the development state between us and provide some sort of better communication and organization. Therefore we will provide an initial agenda which can change and be improved by all. The meeting will be announced two weeks before the next via coreboot ml so that you have time to do your planning. The meeting room is provided by discordapp (the next solution), you need to use chrome/chromium or install a desktop app. The channel can be accessed via link: https://discord.gg/0vhZlDE5b2njfGK7 Every meeting will be documented by a report. The report is published after the meeting via a link the coreboot wiki. More information can be found under the following link: https://www.coreboot.org/Coreboot_community_meeting The only rule in this meeting is to be kind to each other. ### So no flamewar, offence or individual criticism ! ### 2nd Coreboot Community Meeting ==================================================== Date: 18.04.2016 San Francisco time: Begin at 09.00 a.m. Berlin time: Begin at 18.00 p.m. Meeting time: Max. 1 hour. Who is invited: Everyone who is or intends to become developer ! Agenda: ----------- 1) Introduction -> Everyone introduces themselves (Only for new developers). Every developer gives a short overview what he did the last two weeks and what he want to do the next two weeks. (max. 5 min. per person, daily scrum like). 2) News -> Developers with interesting news keep the other up-to-date but no discussion. 3) Maintainer Orga -> Issues -> Requests 4) Project Orga -> Gather topics which need to be discussed or improve the project itself. -> Find tasks and developer which a responsible for a task. 5) Admin Orga -> Access requests -> Questions -> Issues 6) GSoC Orga 7) Other topics which are not on the agenda. 99) Developer Topics / Split Up / Have fun to discuss your idea -> Gather developer topics which seem to be important and interesting to solve. -> Gather groups of developers who are interested in the same topic. -> For deeper information exchange split up in different jitsi meet channels and close meeting. 100) End ===================================================== Best Regards Zaolin

1 0

Overclocking
by Jean Reus April 5, 2016

April 5, 2016

I have a toshiba chromebook 2 with a intel celeron, with oviously linux installed and coreboot/seabios so is there a way to add a overclocking feature or how can i add one myself, or is there a posibility of overclocking in linux? Thanks in advance Jean

1 0

New Defects reported by Coverity Scan for coreboot
by scan-admin＠coverity.com April 5, 2016

April 5, 2016

Hi, Please find the latest report on new defect(s) introduced to coreboot found with Coverity Scan. 200 new defect(s) introduced to coreboot found with Coverity Scan. 3 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 20 of 200 defect(s) ** CID 1353327: Memory - corruptions (OVERRUN) ________________________________________________________________________________________________________ *** CID 1353327: Memory - corruptions (OVERRUN) /3rdparty/chromeec/driver/als_opt3001.c: 34 in opt3001_i2c_write() 28 */ 29 static int opt3001_i2c_write(const int reg, int data) 30 { 31 int ret; 32 33 data = ((data << 8) & 0xFF00) | ((data >> 8) & 0x00FF); >>> CID 1353327: Memory - corruptions (OVERRUN) >>> Overrunning callee's array of size 2 by passing argument "MEC1322_I2C2" in call to "i2c_write16". 34 ret = i2c_write16(I2C_PORT_ALS, OPT3001_I2C_ADDR, reg, data); 35 36 return ret; 37 } 38 39 /** ** CID 1353326: Memory - corruptions (OVERRUN) ________________________________________________________________________________________________________ *** CID 1353326: Memory - corruptions (OVERRUN) /3rdparty/chromeec/driver/als_opt3001.c: 18 in opt3001_i2c_read() 12 * Read register from OPT3001 light sensor. 13 */ 14 static int opt3001_i2c_read(const int reg, int *data_ptr) 15 { 16 int ret; 17 >>> CID 1353326: Memory - corruptions (OVERRUN) >>> Overrunning callee's array of size 2 by passing argument "MEC1322_I2C2" in call to "i2c_read16". 18 ret = i2c_read16(I2C_PORT_ALS, OPT3001_I2C_ADDR, reg, data_ptr); 19 if (!ret) 20 *data_ptr = ((*data_ptr << 8) & 0xFF00) | 21 ((*data_ptr >> 8) & 0x00FF); 22 23 return ret; ** CID 1353325: Memory - illegal accesses (OVERRUN) /3rdparty/chromeec/driver/temp_sensor/bd99992gw.c: 65 in bd99992gw_init() ________________________________________________________________________________________________________ *** CID 1353325: Memory - illegal accesses (OVERRUN) /3rdparty/chromeec/driver/temp_sensor/bd99992gw.c: 65 in bd99992gw_init() 59 int i; 60 int active_channel_count = 0; 61 uint8_t pointer_reg = BD99992GW_REG_ADC1ADDR0; 62 63 /* Mark active channels from the board temp sensor table */ 64 for (i = 0; i < TEMP_SENSOR_COUNT; ++i) >>> CID 1353325: Memory - illegal accesses (OVERRUN) >>> Overrunning array "temp_sensors" of 4 20-byte elements at element index 4 (byte offset 80) using index "i" (which evaluates to 4). 65 if (temp_sensors[i].read == bd99992gw_get_val) 66 active_channels[active_channel_count++] = 67 temp_sensors[i].idx; 68 69 /* Make sure we don't have too many active channels. */ 70 ASSERT(active_channel_count <= ARRAY_SIZE(active_channels)); ** CID 1353324: Memory - corruptions (OVERRUN) /3rdparty/chromeec/driver/temp_sensor/bd99992gw.c: 74 in bd99992gw_init() ________________________________________________________________________________________________________ *** CID 1353324: Memory - corruptions (OVERRUN) /3rdparty/chromeec/driver/temp_sensor/bd99992gw.c: 74 in bd99992gw_init() 68 69 /* Make sure we don't have too many active channels. */ 70 ASSERT(active_channel_count <= ARRAY_SIZE(active_channels)); 71 72 /* Mark the first unused channel so we know where to stop searching */ 73 if (active_channel_count != ARRAY_SIZE(active_channels)) >>> CID 1353324: Memory - corruptions (OVERRUN) >>> Overrunning array "active_channels" of 8 4-byte elements at element index 9 (byte offset 36) using index "active_channel_count" (which evaluates to 9). 74 active_channels[active_channel_count] = 75 BD99992GW_ADC_CHANNEL_NONE; 76 77 /* Now write pointer regs with channel to monitor */ 78 for (i = 0; i < active_channel_count; ++i) 79 /* Write stop bit on last channel */ ** CID 1353322: (OVERRUN) ________________________________________________________________________________________________________ *** CID 1353322: (OVERRUN) /3rdparty/chromeec/driver/charger/isl9237.c: 407 in console_command_amon_bmon() 401 * Get charger AMON and BMON current. 402 */ 403 static int console_command_amon_bmon(int argc, char **argv) 404 { 405 int adc, curr, val, ret; 406 >>> CID 1353322: (OVERRUN) >>> Overrunning callee's array of size 2 by passing argument "MEC1322_I2C3" in call to "i2c_read16". 407 ret = i2c_read16(I2C_PORT_CHARGER, I2C_ADDR_CHARGER, 408 ISL9237_REG_CONTROL1, &val); 409 if (ret) 410 return ret; 411 412 /* Enable monitor */ /3rdparty/chromeec/driver/charger/isl9237.c: 417 in console_command_amon_bmon() 411 412 /* Enable monitor */ 413 val &= ~ISL9237_C1_DISABLE_MON; 414 if (argc == 1 || (argc >= 2 && argv[1][0] == 'a')) { 415 /* Switch to AMON */ 416 val &= ~ISL9237_C1_SELECT_BMON; >>> CID 1353322: (OVERRUN) >>> Overrunning callee's array of size 2 by passing argument "MEC1322_I2C3" in call to "i2c_write16". 417 ret = i2c_write16(I2C_PORT_CHARGER, I2C_ADDR_CHARGER, 418 ISL9237_REG_CONTROL1, val); 419 if (ret) 420 return ret; 421 422 adc = adc_read_channel(ADC_AMON_BMON); /3rdparty/chromeec/driver/charger/isl9237.c: 430 in console_command_amon_bmon() 424 CPRINTF("AMON: %d uV, %d mA\n", adc, curr); 425 } 426 427 if (argc == 1 || (argc >= 2 && argv[1][0] == 'b')) { 428 /* Switch to BMON */ 429 val |= ISL9237_C1_SELECT_BMON; >>> CID 1353322: (OVERRUN) >>> Overrunning callee's array of size 2 by passing argument "MEC1322_I2C3" in call to "i2c_write16". 430 ret = i2c_write16(I2C_PORT_CHARGER, I2C_ADDR_CHARGER, 431 ISL9237_REG_CONTROL1, val); 432 if (ret) 433 return ret; 434 435 adc = adc_read_channel(ADC_AMON_BMON); ** CID 1353321: Memory - corruptions (OVERRUN) ________________________________________________________________________________________________________ *** CID 1353321: Memory - corruptions (OVERRUN) /3rdparty/chromeec/driver/charger/isl9237.c: 58 in raw_write16() 52 { 53 return i2c_read16(I2C_PORT_CHARGER, I2C_ADDR_CHARGER, offset, value); 54 } 55 56 static inline int raw_write16(int offset, int value) 57 { >>> CID 1353321: Memory - corruptions (OVERRUN) >>> Overrunning callee's array of size 2 by passing argument "MEC1322_I2C3" in call to "i2c_write16". 58 return i2c_write16(I2C_PORT_CHARGER, I2C_ADDR_CHARGER, offset, value); 59 } 60 61 static int isl9237_set_current(uint16_t current) 62 { 63 return raw_write16(ISL9237_REG_CHG_CURRENT, CURRENT_TO_REG(current)); ** CID 1353320: Memory - corruptions (OVERRUN) ________________________________________________________________________________________________________ *** CID 1353320: Memory - corruptions (OVERRUN) /3rdparty/chromeec/driver/charger/isl9237.c: 53 in raw_read16() 47 { 48 return i2c_read8(I2C_PORT_CHARGER, I2C_ADDR_CHARGER, offset, value); 49 } 50 51 static inline int raw_read16(int offset, int *value) 52 { >>> CID 1353320: Memory - corruptions (OVERRUN) >>> Overrunning callee's array of size 2 by passing argument "MEC1322_I2C3" in call to "i2c_read16". 53 return i2c_read16(I2C_PORT_CHARGER, I2C_ADDR_CHARGER, offset, value); 54 } 55 56 static inline int raw_write16(int offset, int value) 57 { 58 return i2c_write16(I2C_PORT_CHARGER, I2C_ADDR_CHARGER, offset, value); ** CID 1353317: (OVERRUN) /3rdparty/chromeec/common/temp_sensor.c: 153 in temp_sensor_command_get_info() /3rdparty/chromeec/common/temp_sensor.c: 153 in temp_sensor_command_get_info() ________________________________________________________________________________________________________ *** CID 1353317: (OVERRUN) /3rdparty/chromeec/common/temp_sensor.c: 153 in temp_sensor_command_get_info() 147 struct ec_response_temp_sensor_get_info *r = args->response; 148 int id = p->id; 149 150 if (id >= TEMP_SENSOR_COUNT) 151 return EC_RES_ERROR; 152 >>> CID 1353317: (OVERRUN) >>> Overrunning array "temp_sensors" of 4 20-byte elements at element index 14 (byte offset 280) using index "id" (which evaluates to 14). 153 strzcpy(r->sensor_name, temp_sensors[id].name, sizeof(r->sensor_name)); 154 r->sensor_type = temp_sensors[id].type; 155 156 args->response_size = sizeof(*r); 157 158 return EC_RES_SUCCESS; 159 } 160 DECLARE_HOST_COMMAND(EC_CMD_TEMP_SENSOR_GET_INFO, 161 temp_sensor_command_get_info, /3rdparty/chromeec/common/temp_sensor.c: 153 in temp_sensor_command_get_info() 147 struct ec_response_temp_sensor_get_info *r = args->response; 148 int id = p->id; 149 150 if (id >= TEMP_SENSOR_COUNT) 151 return EC_RES_ERROR; 152 >>> CID 1353317: (OVERRUN) >>> Overrunning array "temp_sensors" of 4 20-byte elements at element index 4 (byte offset 80) using index "id" (which evaluates to 4). 153 strzcpy(r->sensor_name, temp_sensors[id].name, sizeof(r->sensor_name)); 154 r->sensor_type = temp_sensors[id].type; 155 156 args->response_size = sizeof(*r); 157 158 return EC_RES_SUCCESS; 159 } 160 DECLARE_HOST_COMMAND(EC_CMD_TEMP_SENSOR_GET_INFO, 161 temp_sensor_command_get_info, ** CID 1353316: (OVERRUN) /3rdparty/chromeec/common/temp_sensor.c: 114 in command_temps() /3rdparty/chromeec/common/temp_sensor.c: 114 in command_temps() ________________________________________________________________________________________________________ *** CID 1353316: (OVERRUN) /3rdparty/chromeec/common/temp_sensor.c: 114 in command_temps() 108 if (rv) 109 rv1 = rv; 110 111 switch (rv) { 112 case EC_SUCCESS: 113 ccprintf("%d K = %d C", t, K_TO_C(t)); >>> CID 1353316: (OVERRUN) >>> Overrunning array "thermal_params" of 4 20-byte elements at element index 14 (byte offset 280) using index "i" (which evaluates to 14). 114 if (thermal_params[i].temp_fan_off && 115 thermal_params[i].temp_fan_max) 116 ccprintf(" %d%%", 117 thermal_fan_percent( 118 thermal_params[i].temp_fan_off, 119 thermal_params[i].temp_fan_max, /3rdparty/chromeec/common/temp_sensor.c: 114 in command_temps() 108 if (rv) 109 rv1 = rv; 110 111 switch (rv) { 112 case EC_SUCCESS: 113 ccprintf("%d K = %d C", t, K_TO_C(t)); >>> CID 1353316: (OVERRUN) >>> Overrunning array "thermal_params" of 4 20-byte elements at element index 4 (byte offset 80) using index "i" (which evaluates to 4). 114 if (thermal_params[i].temp_fan_off && 115 thermal_params[i].temp_fan_max) 116 ccprintf(" %d%%", 117 thermal_fan_percent( 118 thermal_params[i].temp_fan_off, 119 thermal_params[i].temp_fan_max, ** CID 1353315: (OVERRUN) /3rdparty/chromeec/common/temp_sensor.c: 106 in command_temps() /3rdparty/chromeec/common/temp_sensor.c: 106 in command_temps() ________________________________________________________________________________________________________ *** CID 1353315: (OVERRUN) /3rdparty/chromeec/common/temp_sensor.c: 106 in command_temps() 100 static int command_temps(int argc, char **argv) 101 { 102 int t, i; 103 int rv, rv1 = EC_SUCCESS; 104 105 for (i = 0; i < TEMP_SENSOR_COUNT; ++i) { >>> CID 1353315: (OVERRUN) >>> Overrunning array "temp_sensors" of 4 20-byte elements at element index 14 (byte offset 280) using index "i" (which evaluates to 14). 106 ccprintf(" %-20s: ", temp_sensors[i].name); 107 rv = temp_sensor_read(i, &t); 108 if (rv) 109 rv1 = rv; 110 111 switch (rv) { /3rdparty/chromeec/common/temp_sensor.c: 106 in command_temps() 100 static int command_temps(int argc, char **argv) 101 { 102 int t, i; 103 int rv, rv1 = EC_SUCCESS; 104 105 for (i = 0; i < TEMP_SENSOR_COUNT; ++i) { >>> CID 1353315: (OVERRUN) >>> Overrunning array "temp_sensors" of 4 20-byte elements at element index 4 (byte offset 80) using index "i" (which evaluates to 4). 106 ccprintf(" %-20s: ", temp_sensors[i].name); 107 rv = temp_sensor_read(i, &t); 108 if (rv) 109 rv1 = rv; 110 111 switch (rv) { ** CID 1353314: (OVERRUN) /3rdparty/chromeec/common/temp_sensor.c: 26 in temp_sensor_read() /3rdparty/chromeec/common/temp_sensor.c: 26 in temp_sensor_read() ________________________________________________________________________________________________________ *** CID 1353314: (OVERRUN) /3rdparty/chromeec/common/temp_sensor.c: 26 in temp_sensor_read() 20 const struct temp_sensor_t *sensor; 21 22 if (id < 0 || id >= TEMP_SENSOR_COUNT) 23 return EC_ERROR_INVAL; 24 sensor = temp_sensors + id; 25 >>> CID 1353314: (OVERRUN) >>> Overrunning array of 4 20-byte elements at element index 14 (byte offset 280) by dereferencing pointer "sensor". 26 return sensor->read(sensor->idx, temp_ptr); 27 } 28 29 static void update_mapped_memory(void) 30 { 31 int i, t; /3rdparty/chromeec/common/temp_sensor.c: 26 in temp_sensor_read() 20 const struct temp_sensor_t *sensor; 21 22 if (id < 0 || id >= TEMP_SENSOR_COUNT) 23 return EC_ERROR_INVAL; 24 sensor = temp_sensors + id; 25 >>> CID 1353314: (OVERRUN) >>> Overrunning array of 4 20-byte elements at element index 4 (byte offset 80) by dereferencing pointer "sensor". 26 return sensor->read(sensor->idx, temp_ptr); 27 } 28 29 static void update_mapped_memory(void) 30 { 31 int i, t; ** CID 1353310: (OVERRUN) ________________________________________________________________________________________________________ *** CID 1353310: (OVERRUN) /3rdparty/chromeec/board/glados/battery.c: 50 in board_cut_off_battery() 44 /* Ship mode command must be sent twice to take effect */ 45 buf[0] = SB_MANUFACTURER_ACCESS & 0xff; 46 buf[1] = PARAM_CUT_OFF_LOW; 47 buf[2] = PARAM_CUT_OFF_HIGH; 48 49 i2c_lock(I2C_PORT_BATTERY, 1); >>> CID 1353310: (OVERRUN) >>> Overrunning callee's array of size 2 by passing argument "MEC1322_I2C3" in call to "i2c_xfer". 50 rv = i2c_xfer(I2C_PORT_BATTERY, BATTERY_ADDR, buf, 3, NULL, 0, 51 I2C_XFER_SINGLE); 52 rv |= i2c_xfer(I2C_PORT_BATTERY, BATTERY_ADDR, buf, 3, NULL, 0, 53 I2C_XFER_SINGLE); 54 i2c_lock(I2C_PORT_BATTERY, 0); 55 /3rdparty/chromeec/board/glados/battery.c: 52 in board_cut_off_battery() 46 buf[1] = PARAM_CUT_OFF_LOW; 47 buf[2] = PARAM_CUT_OFF_HIGH; 48 49 i2c_lock(I2C_PORT_BATTERY, 1); 50 rv = i2c_xfer(I2C_PORT_BATTERY, BATTERY_ADDR, buf, 3, NULL, 0, 51 I2C_XFER_SINGLE); >>> CID 1353310: (OVERRUN) >>> Overrunning callee's array of size 2 by passing argument "MEC1322_I2C3" in call to "i2c_xfer". 52 rv |= i2c_xfer(I2C_PORT_BATTERY, BATTERY_ADDR, buf, 3, NULL, 0, 53 I2C_XFER_SINGLE); 54 i2c_lock(I2C_PORT_BATTERY, 0); 55 56 return rv; 57 } ** CID 1353309: Memory - corruptions (OVERRUN) /3rdparty/chromeec/common/gpio.c: 260 in gpio_command_get() ________________________________________________________________________________________________________ *** CID 1353309: Memory - corruptions (OVERRUN) /3rdparty/chromeec/common/gpio.c: 260 in gpio_command_get() 254 args->response_size = sizeof(r_v1->get_count); 255 break; 256 case EC_GPIO_GET_INFO: 257 if (p_v1->get_info.index >= GPIO_COUNT) 258 return EC_RES_ERROR; 259 >>> CID 1353309: Memory - corruptions (OVERRUN) >>> Assigning: "i" = "(*p_v1).get_info.index". The value of "i" may now be up to 80. 260 i = p_v1->get_info.index; 261 len = strlen(g[i].name); 262 memcpy(r_v1->get_info.name, g[i].name, len+1); 263 r_v1->get_info.val = gpio_get_level(i); 264 r_v1->get_info.flags = g[i].flags; 265 args->response_size = sizeof(r_v1->get_info); ** CID 1353308: Memory - illegal accesses (OVERRUN) /3rdparty/chromeec/common/gpio.c: 261 in gpio_command_get() ________________________________________________________________________________________________________ *** CID 1353308: Memory - illegal accesses (OVERRUN) /3rdparty/chromeec/common/gpio.c: 261 in gpio_command_get() 255 break; 256 case EC_GPIO_GET_INFO: 257 if (p_v1->get_info.index >= GPIO_COUNT) 258 return EC_RES_ERROR; 259 260 i = p_v1->get_info.index; >>> CID 1353308: Memory - illegal accesses (OVERRUN) >>> Overrunning array of 78 16-byte elements at element index 80 (byte offset 1280) by dereferencing pointer "g + i". 261 len = strlen(g[i].name); 262 memcpy(r_v1->get_info.name, g[i].name, len+1); 263 r_v1->get_info.val = gpio_get_level(i); 264 r_v1->get_info.flags = g[i].flags; 265 args->response_size = sizeof(r_v1->get_info); 266 break; ** CID 1353307: Memory - corruptions (OVERRUN) /3rdparty/chromeec/common/gpio.c: 169 in command_gpio_get() ________________________________________________________________________________________________________ *** CID 1353307: Memory - corruptions (OVERRUN) /3rdparty/chromeec/common/gpio.c: 169 in command_gpio_get() 163 ccprintf(" %d%c %s\n", v, (changed ? '*' : ' '), g->name); 164 165 return EC_SUCCESS; 166 } 167 168 /* Otherwise print them all */ >>> CID 1353307: Memory - corruptions (OVERRUN) >>> Checking "i < GPIO_COUNT" implies that "i" may be up to 80 on the true branch. 169 for (i = 0; i < GPIO_COUNT; i++, g++) { 170 if (!g->mask) 171 continue; /* Skip unsupported signals */ 172 173 v = gpio_get_level(i); 174 changed = last_val_changed(i, v); ** CID 1353306: Memory - illegal accesses (OVERRUN) /3rdparty/chromeec/common/gpio.c: 170 in command_gpio_get() ________________________________________________________________________________________________________ *** CID 1353306: Memory - illegal accesses (OVERRUN) /3rdparty/chromeec/common/gpio.c: 170 in command_gpio_get() 164 165 return EC_SUCCESS; 166 } 167 168 /* Otherwise print them all */ 169 for (i = 0; i < GPIO_COUNT; i++, g++) { >>> CID 1353306: Memory - illegal accesses (OVERRUN) >>> Overrunning array of 78 16-byte elements at element index 80 (byte offset 1280) by dereferencing pointer "g". 170 if (!g->mask) 171 continue; /* Skip unsupported signals */ 172 173 v = gpio_get_level(i); 174 changed = last_val_changed(i, v); 175 ccprintf(" %d%c %s\n", v, (changed ? '*' : ' '), g->name); ** CID 1353305: Memory - illegal accesses (OVERRUN) /3rdparty/chromeec/common/gpio.c: 33 in find_signal_by_name() ________________________________________________________________________________________________________ *** CID 1353305: Memory - illegal accesses (OVERRUN) /3rdparty/chromeec/common/gpio.c: 33 in find_signal_by_name() 27 int i; 28 29 if (!name || !*name) 30 return GPIO_COUNT; 31 32 for (i = 0; i < GPIO_COUNT; i++, g++) { >>> CID 1353305: Memory - illegal accesses (OVERRUN) >>> Overrunning array of 78 16-byte elements at element index 80 (byte offset 1280) by dereferencing pointer "g". 33 if (g->mask && !strcasecmp(name, g->name)) 34 return i; 35 } 36 37 return GPIO_COUNT; 38 } ** CID 1353293: Memory - corruptions (OVERRUN) ________________________________________________________________________________________________________ *** CID 1353293: Memory - corruptions (OVERRUN) /3rdparty/chromeec/driver/battery/smart.c: 32 in sbc_write() 26 { 27 return i2c_read16(I2C_PORT_CHARGER, CHARGER_ADDR, cmd, param); 28 } 29 30 test_mockable int sbc_write(int cmd, int param) 31 { >>> CID 1353293: Memory - corruptions (OVERRUN) >>> Overrunning callee's array of size 2 by passing argument "MEC1322_I2C3" in call to "i2c_write16". 32 return i2c_write16(I2C_PORT_CHARGER, CHARGER_ADDR, cmd, param); 33 } 34 35 test_mockable int sb_read(int cmd, int *param) 36 { 37 #ifdef CONFIG_BATTERY_CUT_OFF ** CID 1353292: Memory - corruptions (OVERRUN) ________________________________________________________________________________________________________ *** CID 1353292: Memory - corruptions (OVERRUN) /3rdparty/chromeec/driver/battery/smart.c: 27 in sbc_read() 21 #define BATTERY_NO_RESPONSE_TIMEOUT (1000*MSEC) 22 23 static int fake_state_of_charge = -1; 24 25 test_mockable int sbc_read(int cmd, int *param) 26 { >>> CID 1353292: Memory - corruptions (OVERRUN) >>> Overrunning callee's array of size 2 by passing argument "MEC1322_I2C3" in call to "i2c_read16". 27 return i2c_read16(I2C_PORT_CHARGER, CHARGER_ADDR, cmd, param); 28 } 29 30 test_mockable int sbc_write(int cmd, int param) 31 { 32 return i2c_write16(I2C_PORT_CHARGER, CHARGER_ADDR, cmd, param); ** CID 1353291: Memory - corruptions (OVERRUN) ________________________________________________________________________________________________________ *** CID 1353291: Memory - corruptions (OVERRUN) /3rdparty/chromeec/driver/battery/smart.c: 69 in sb_write() 63 if (battery_is_cut_off()) 64 return EC_RES_ACCESS_DENIED; 65 #endif 66 #ifdef CONFIG_SMBUS 67 return smbus_write_word(I2C_PORT_BATTERY, BATTERY_ADDR, cmd, param); 68 #else >>> CID 1353291: Memory - corruptions (OVERRUN) >>> Overrunning callee's array of size 2 by passing argument "MEC1322_I2C3" in call to "i2c_write16". 69 return i2c_write16(I2C_PORT_BATTERY, BATTERY_ADDR, cmd, param); 70 #endif 71 } 72 73 int sb_read_string(int port, int slave_addr, int offset, uint8_t *data, 74 int len) ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://scan.coverity.com/projects/coreboot?tab=overview To manage Coverity Scan email notifications for "coreboot(a)coreboot.org", click https://scan.coverity.com/subscriptions/edit?email=coreboot%40coreboot.org&…

1 0

Libpayload dies with NMI exception on qemu-q35
by Jonathan Neuschäfer April 5, 2016

April 5, 2016

Hi, I just tried to boot coreinfo in qemu-q35, and it got an NMI exception after a second: > Run img/coreinfo > Calling addr 0x00100000 > <coreinfo starts and shows information> > Non-Maskable-Interrupt Exception > Error code: n/a > EIP: 0x00104175 > CS: 0x0010 > EFLAGS: 0x00000093 > EAX: 0x52797503 > ECX: 0x00000000 > EDX: 0x00000001 > EBX: 0x5a769ba0 > ESP: 0x0015917c > EBP: 0x0000011a > ESI: 0x31ef541a > EDI: 0x00000001 > DS: 0x0018 > ES: 0x0018 > SS: 0x0018 > FS: 0x0018 > GS: 0x0018 > Dumping stack: > 0x159360: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 > 0x159340: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 > 0x159320: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 > 0x159300: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 > 0x1592e0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 > 0x1592c0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 > 0x1592a0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 > 0x159280: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 > 0x159260: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 > 0x159240: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 > 0x159220: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 > 0x159200: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 > 0x1591e0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 > 0x1591c0: 00000000 00000000 00100051 00006fb4 00000000 00000000 00000000 00000000 > 0x1591a0: 001591d0 001591c0 ffe27904 001020d0 0010546b 00104d07 00104f88 001020d0 > 0x159180: 00006fb4 001591d0 001591a8 0010209c 000001f4 00000000 001591d0 00006fb4 > 0x159160: 00000000 001591d0 00006fb4 001591d0 00104175 00000010 00000093 001591d0 This happens reliably both with and without SeaBIOS and in both qemu-system-i386 and qemu-system-x86_64 (version 2.5.0). The coreinfo application code is apparently irrelevant: I replaced coreinfo's main() with a printf and an endless loop and still get the same result. What could be causing this? Jonathan

2 1