coreboot August 2016

coreboot@coreboot.org

53 participants
132 discussions

X220t missing ACPI events
by Nicola Corna 23 Aug '16

23 Aug '16

Hello everyone, I have a X220t with coreboot and I've noticed that two ACPI events are missing from the original BIOS: video/tabletmode TBLT 0000008A 00000000 video/tabletmode TBLT 0000008A 00000001 These two are the ACPI events generated when the screen is flipped into "tablet" or "laptop" positions. They are very useful because, when in "tablet" position, the back of the screen touches the trackpoint and generates random movements; with these ACPI events I could instruct the acpi daemon to disable the trackpoint in the tablet configuration. Unfortunately I have no experience of ACPI tables, but I can easily flash the original BIOS and provide any dump or log if needed. Any help? Thanks Nicola Corna

1 0

New on blogs.coreboot.org: [GSOC] Panic Room, Recap
by WordPress 23 Aug '16

23 Aug '16

1 0

Re: [coreboot] Why my ACPI device conflicts with "PCI Bus"
by Marshall Dawson 22 Aug '16

22 Aug '16

Hi Zheng, What version of Windows are you using? I've seen differences in the behavior of the arbiters as Windows has matured. I don't notice anything incorrect in your ASL. Does your FUR1 device come up with no conflicts, and only FUR0 has problems? Are you able to run WinDbg and get the failure? Depending on the generation, you might have Ethernet or USB available for debug as well, if you need a different option. I might start with this: https://msdn.microsoft.com/en-us/library/windows/hardware/ff562124(v=vs.85)… ... using "!arbiter 2" to dump the memory assigned in the system. That would hopefully show you the conflict ('C' flag) and ownership, possibly giving you additional clues and a direction to look. In theory, this should be somewhat identical to looking at resources-by-connection in the Device Manager, but you'll have more options for debugging. Maybe also dump the device tree with "!devnode 0 1" and make sure items are scoped where you believe they should be. The fact that FEDC6000 is used by PCI Bus seems pretty odd, like the bus consumes the memory without bridging or arbitrating it. Unless I missed it, I don't see anything like that in your DSDT. As an experiment, maybe try adding a ResourceProducer for FEDC6000 under PCI0 and see if the problem goes away. If it does, I'll have to think more about what that means. Thanks, Marshall On Mon, Aug 22, 2016 at 6:20 AM, Zheng Bao <fishbaoz(a)hotmail.com> wrote: > Hi, All, > > I am debugging the UART device on Bettong(AMD Carrizo). > > > The device > > " > Device(FUR0) { > Name(_HID,"AMD0020") > Name(_UID,0x0) > Name(_CRS, ResourceTemplate() { > IRQ(Edge, ActiveHigh, Exclusive) {10} > Memory32Fixed(ReadWrite, 0xFEDC6000, 0x2000) > }) > Method (_STA, 0x0, NotSerialized) { > Return (0x0F) > } > } > " > > is added to DSDT. On linux, it doesnt show any error or warning. On > Windows, > > the device manager can show the DEVICE "AMD0020". But it says the > 0xFEDC6000 > > is used by other device "PCI Bus". > > I checked the whole DSDT and can not find which device conflicts with that? > > > Any suggestion what else I can check? > > > Zheng > > -- > coreboot mailing list: coreboot(a)coreboot.org > https://www.coreboot.org/mailman/listinfo/coreboot >

1 0

Why my ACPI device conflicts with "PCI Bus"
by Zheng Bao 22 Aug '16

22 Aug '16

Hi, All, I am debugging the UART device on Bettong(AMD Carrizo). The device " Device(FUR0) { Name(_HID,"AMD0020") Name(_UID,0x0) Name(_CRS, ResourceTemplate() { IRQ(Edge, ActiveHigh, Exclusive) {10} Memory32Fixed(ReadWrite, 0xFEDC6000, 0x2000) }) Method (_STA, 0x0, NotSerialized) { Return (0x0F) } } " is added to DSDT. On linux, it doesnt show any error or warning. On Windows, the device manager can show the DEVICE "AMD0020". But it says the 0xFEDC6000 is used by other device "PCI Bus". I checked the whole DSDT and can not find which device conflicts with that? Any suggestion what else I can check? Zheng

1 0

New on blogs.coreboot.org: [GSOC] Panic Room, week #8, *
by WordPress 22 Aug '16

22 Aug '16

1 0

ASUS KGPE-D16 Automated Test Failure [master]
by Raptor Engineering Automated Coreboot Test Stand 21 Aug '16

21 Aug '16

The ASUS KGPE-D16 fails verification for branch master as of commit 64444268e2eecf235af9dd77b5f6cee8c0365fc5 The following tests failed: BOOT_FAILURE Commits since last successful test: 6444426 mb/asus/[kgpe-d16|kcma-d8]: Fix whitespace errors in devicetree.cb 5a85951 3rdparty/blobs: Update to get AGESA binary for pcengines/apu2 See attached log for details This message was automatically generated from Raptor Engineering's ASUS KGPE-D16 test stand Want to test on your own equipment? Check out https://www.raptorengineering.com/content/REACTS/intro.html Raptor Engineering also offers coreboot consulting services! Please visit https://www.raptorengineering.com for more information Please contact Timothy Pearson at Raptor Engineering <tpearson(a)raptorengineering.com> regarding any issues stemming from this notification

1 0

GNU Libreboot, version 20160818 released
by Leah Rowe 20 Aug '16

20 Aug '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 GNU Libreboot 20160818 This is a brand GNU release. Libreboot joined the GNU project on 14 May 2016. This 18 August 2016 release is the first GNU release of libreboot. Get it from https://libreboot.org/download/ NEW BOARDS ADDED: * ASUS Chromebook C201 (ARM laptop) (thanks to Paul Kocialkowski) * Gigabyte GA-G41M-ES2L motherboard (desktop) (thanks to Damien Zammit) * Intel D510MO motherboard (desktop) (thanks to Damien Zammit) * ASUS KCMA-D8 motherboard (desktop) (thanks to Timothy Pearson) * ASUS KFSN4-DRE motherboard (server) (thanks to Timothy Pearson) * ASUS KGPE-D16 motherboard (server) (thanks to Timothy Pearson) For details development history on these boards, refer to the git log and documentation. For boards previously supported, many fixes from upstream have been merged. Other changes (compared to libreboot 20150518), for libreboot in general or for previously supported systems: (this is a summary. For more detailed change list, refer to the git log) 256MiB VRAM allocated on GM45 (X200, T400, T500, R400) instead of 32MiB. This is an improvement over both Lenovo BIOS and Libreboot 20150518, allowing video decoding at 1080p to be smoother. (thanks Arthur Heymans) To clarify, GM45 video performance in libreboot 20160818 is better than on the original BIOS and the previous libreboot release. 64MiB VRAM on i945 (X60, T60, MacBook2,1) now supported in coreboot-libre, and used by default (in the previous release, it was 8MiB allocated). Thanks to Arthur Heymans. Higher battery life on GM45 (X200, T400, T500, R400) due to higher cstates now being supported (thanks Arthur Heymans). C4 power states also supported. Higher battery life on i945 (X60, T60, MacBook2,1) due to better CPU C-state settings. (Deep C4, Dynamicl L2 shrinking, C2E). Text mode on GM45 (X200, T400, T500, R400) now works, making it possible to use MemTest86+ comfortably. (thanks to Nick High from coreboot) Dual channel LVDS displays on GM45 (T400, T500) are now automatically detected in coreboot-libre. (thanks Vladimir Serbinenko from coreboot) Partial fix in coreboot-libre for GRUB display on GM45, for dual channel LVDS higher resolution LCD panels (T400, T500). (thanks Arthur Heymans) Massively improved GRUB configuration, making it easier to boot more encrypted systems automatically, and generally a more useful menu for booting the system (thanks go to Klemens Nanni of the autoboot project). Libreboot now uses the grub.cfg provided by the installed GNU/Linux distribution automatically, if present, switching to that configuration. This is done across many partitions, where libreboot actively searches for a configuration file (also on LVM volumes and encrypted volumes). This should make libreboot more easy to use for non-technical users, without having to modify the GRUB configuration used in libreboot. Utilities archives is now source only. You will need to compile the packages in there (build scripts included, and a script for installing build dependencies in Trisquel 7). (binary utility archives are planned again in the next release, when the new build system is merged) SeaGRUB is now the default payload on all x86 boards. (SeaBIOS configured to load a compressed GRUB payload from CBFS immediately, without providing an interface in SeaBIOS. This way, GRUB is still used but now BIOS services are available, so you get the best of both worlds). Thanks go to Timothy Pearson of coreboot for this idea. crossgcc is now downloaded and built as a separate module to coreboot-libre, with a universal revision used to build all boards. Individual boards now have their own coreboot revision and patches, independently of each other board. This makes maintenance easier. Updated all utilities, and modules (coreboot, GRUB, etc) to newer versions, with various bugfixes and improvements upstream. RTC century byte issue now fixed on GM45 in coreboot-libre, so the date should now be correctly displayed when running the latest linux kernel, instead of seeing 1970-01-01 when you boot (thanks to Alexander Couzens from coreboot) Build system now uses multiple CPU cores when building, speeding up building for some people. Manually specifying how many cores are needed is also possible, for those using the build system in a chroot environment. (thanks go to Timothy Pearson from coreboot) In the build system (git repository), https:// is now used when cloning coreboot. http:// is used as a fallback for GRUB, if git:// fail s. New payload, the depthcharge bootloader (free bootloader maintained by Google) for use on the ASUS Chromebook C201. (thanks go to Paul Kocialkowski) Various fixes to the ich9gen utility (e.g. flash component density is now set correctly in the descriptor, gbe-less descriptors now supported) The official documentation included in the release in provided in texinfo format, instead of HTML; this was one of the requirements for joining GNU. (the other requirement is a new build system, to comply with GNU standards, e.g. Makefiles, and common Makefile entries present in all GNU software. As of Libreboot 20160818, this new build system is not yet merged, but will be in the release afterwards) ChangeLog and NEWS files are included in the release, to comply with GNU standards (they are dumps of the git-log output) - -- Leah Rowe Libreboot developer Use free software. Free as in freedom. https://www.gnu.org/philosophy/free-sw.html Use a free operating system, GNU/Linux. https://www.gnu.org/ Use a free BIOS. https://libreboot.org/ Support freedom. Join the Free Software Foundation. https://fsf.org/ Minifree Ltd, trading as Ministry of Freedom | Registered in England, No. 9361826 | VAT No. GB202190462 Registered Office: 19 Hilton Road, Canvey Island, Essex SS8 9QA, UK | Web: http://minifree.org/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) iQEcBAEBAgAGBQJXtj3mAAoJEP9Ft0z50c+U4LwH/j2XFJpkNJOm2YCRaHgyoS16 y9xRcFIP37gdXwUqwMO5CdE7OaJtK3FKo80Em9/qEDoEmsCik2f1wF4nwXpILAfK 0rDGkBn24FJrz0OoMYH21HEUyISg5zZ+LGHPCS87WPLQTXe+bRWjjatdOVnQnwH4 PKV/vrJSEJ2CUnsPFvvPZsgwWEitT67YJ8otLBZuAwEO/GElcfwrGyWY3K0AWOKD KF2+g+eQzx3zNS1coO06YITq5dfvAAoaJu9pOqJR29Fw3rPcV2EPeLI+vR47FqRO pQ7PgvlLW5tm9+WOHIj0EH7wUJYYv/TiWoWWIpr9oW/asb7hJZ7F2eLPttKtMl0= =uiEn -----END PGP SIGNATURE-----

2 1

ASUS KFSN4-DRE (K8) Automated Test Failure [master]
by Raptor Engineering Automated Coreboot Test Stand 20 Aug '16

20 Aug '16

The ASUS KFSN4-DRE (K8) fails verification for branch master as of commit ba2b63a20abf3e5955cce43128911f90609beac1 The following tests failed: BOOT_FAILURE Commits since last successful test: ba2b63a rockchip/rk3399 & gru/kevin: support sdram 933MHz on kevin b18a666 vboot/vbnv_flash: make I/O connection agnostic 5bb9e93 vboot: provide RW region device support d10f9d5 drivers/elog: use region_device for NV storage bccaab8 lib/fmap: provide RW region device support <1 commits skipped> 7b2c781 soc/intel/apollolake: use SPI flash boot_device_rw() for ealy stages 6f11559 drivers/spi: provide optional implementation of boot_device_rw() 5180dd2 drivers/spi: include SPI flash modules for all stages c0a823c drivers/spi: ensure SPI flash is boot device for coreboot tables 2e03fbc util/lint: Add a tool to verify a single newline at the end of files See attached log for details This message was automatically generated from Raptor Engineering's ASUS KFSN4-DRE (K8) test stand Want to test on your own equipment? Check out https://www.raptorengineering.com/content/REACTS/intro.html Raptor Engineering also offers coreboot consulting services! Please visit https://www.raptorengineering.com for more information Please contact Timothy Pearson at Raptor Engineering <tpearson(a)raptorengineering.com> regarding any issues stemming from this notification

1 0

coreboot image signature
by Agrain Patrick 19 Aug '16

19 Aug '16

Hi Benoit, You may use the Boyer-Moore algo (https://en.wikipedia.org/wiki/Boyer%E2%80%93Moore_string_search_algorithm#I…) to search the string 'coreboot' in the binary file. I implemented it as-is, then: <.> uint8_t *tag = boyer_moore(start, size, "coreboot", 8); if (tag == NULL) { "Found no coreboot..." .. } <.> Hope it helps. Regards, Patrick De : coreboot [mailto:coreboot-bounces@coreboot.org] De la part de Benoit SANSONI Envoyé : vendredi 19 août 2016 11:43 À : Coreboot Objet : [coreboot] coreboot image signature Hi all, I would like to know if it is possible, via a signature or a magic number, in the coreboot.rom file to recognize that it is a "coreboot" file. I did not find anything in the Makefile.inc. Thanks in advance

1 0

New Defects reported by Coverity Scan for coreboot
by scan-admin＠coverity.com 19 Aug '16

19 Aug '16

Hi, Please find the latest report on new defect(s) introduced to coreboot found with Coverity Scan. 53 new defect(s) introduced to coreboot found with Coverity Scan. 5 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 20 of 53 defect(s) ** CID 1361695: Null pointer dereferences (NULL_RETURNS) /src/northbridge/intel/pineview/early_init.c: 45 in early_graphics_setup() ________________________________________________________________________________________________________ *** CID 1361695: Null pointer dereferences (NULL_RETURNS) /src/northbridge/intel/pineview/early_init.c: 45 in early_graphics_setup() 39 { 40 u8 reg8; 41 u16 reg16; 42 u32 reg32; 43 44 const struct device *d0f0 = dev_find_slot(0, PCI_DEVFN(0,0)); >>> CID 1361695: Null pointer dereferences (NULL_RETURNS) >>> Dereferencing a null pointer "d0f0". 45 const struct northbridge_intel_pineview_config *config = d0f0->chip_info; 46 47 pci_write_config8(D0F0, DEVEN, BOARD_DEVEN); 48 pci_write_config16(D0F0, GGC, 0x130); /* 1MB GTT 8MB UMA */ 49 50 printk(BIOS_SPEW, "Set GFX clocks..."); ** CID 1361275: (TAINTED_SCALAR) /util/cbfstool/ifwitool.c: 838 in parse_subpart_dir() ________________________________________________________________________________________________________ *** CID 1361275: (TAINTED_SCALAR) /util/cbfstool/ifwitool.c: 831 in parse_subpart_dir() 825 memcpy(hdr.name, data + offset, sizeof(hdr.name)); 826 offset += sizeof(hdr.name); 827 828 validate_subpart_dir_without_checksum((struct subpart_dir *)&hdr, name); 829 830 assert(size > subpart_dir_size(&hdr)); >>> CID 1361275: (TAINTED_SCALAR) >>> Passing tainted variable "subpart_dir_size(&hdr)" to a tainted sink. 831 alloc_buffer(subpart_dir_buf, subpart_dir_size(&hdr), "Subpart Dir"); 832 memcpy(buffer_get(subpart_dir_buf), &hdr, SUBPART_DIR_HEADER_SIZE); 833 834 /* Read Subpart Dir entries. */ 835 struct subpart_dir *subpart_dir = buffer_get(subpart_dir_buf); 836 struct subpart_dir_entry *e = &subpart_dir->e[0]; /util/cbfstool/ifwitool.c: 838 in parse_subpart_dir() 832 memcpy(buffer_get(subpart_dir_buf), &hdr, SUBPART_DIR_HEADER_SIZE); 833 834 /* Read Subpart Dir entries. */ 835 struct subpart_dir *subpart_dir = buffer_get(subpart_dir_buf); 836 struct subpart_dir_entry *e = &subpart_dir->e[0]; 837 uint32_t i; >>> CID 1361275: (TAINTED_SCALAR) >>> Using tainted variable "hdr.num_entries" as a loop boundary. 838 for (i = 0; i < hdr.num_entries; i++) { 839 memcpy(e[i].name, data + offset, sizeof(e[i].name)); 840 offset += sizeof(e[i].name); 841 offset = read_member(data, offset, sizeof(e[i].offset), 842 &e[i].offset); 843 offset = read_member(data, offset, sizeof(e[i].length), ** CID 1361274: Insecure data handling (TAINTED_SCALAR) ________________________________________________________________________________________________________ *** CID 1361274: Insecure data handling (TAINTED_SCALAR) /util/cbfstool/ifwitool.c: 717 in alloc_bpdt_buffer() 711 { 712 struct bpdt_header bpdt_header; 713 assert((offset + BPDT_HEADER_SIZE) < size); 714 bpdt_read_header((uint8_t *)data + offset, &bpdt_header, name); 715 716 /* Buffer to read BPDT header and entries. */ >>> CID 1361274: Insecure data handling (TAINTED_SCALAR) >>> Passing tainted variable "get_bpdt_size(&bpdt_header)" to a tainted sink. 717 alloc_buffer(b, get_bpdt_size(&bpdt_header), name); 718 719 struct bpdt *bpdt = buffer_get(b); 720 memcpy(&bpdt->h, &bpdt_header, BPDT_HEADER_SIZE); 721 722 /* ** CID 1361253: Memory - illegal accesses (BUFFER_SIZE_WARNING) /util/cbfstool/ifwitool.c: 1300 in init_subpart_dir_entry() ________________________________________________________________________________________________________ *** CID 1361253: Memory - illegal accesses (BUFFER_SIZE_WARNING) /util/cbfstool/ifwitool.c: 1300 in init_subpart_dir_entry() 1294 static size_t init_subpart_dir_entry(struct subpart_dir_entry *e, 1295 struct buffer *b, size_t offset) 1296 { 1297 memset(e, 0, sizeof(*e)); 1298 1299 assert(strlen(b->name) <= sizeof(e->name)); >>> CID 1361253: Memory - illegal accesses (BUFFER_SIZE_WARNING) >>> Calling strncpy with a maximum size argument of 12 bytes on destination array "e->name" of size 12 bytes might leave the destination string unterminated. 1300 strncpy((char *)e->name, (char *)b->name, sizeof(e->name)); 1301 e->offset = offset; 1302 e->length = buffer_size(b); 1303 1304 return (offset + buffer_size(b)); 1305 } ** CID 1353793: Resource leaks (RESOURCE_LEAK) /util/nvidia/cbootimage/src/data_layout.c: 1096 in resign_bl() ________________________________________________________________________________________________________ *** CID 1353793: Resource leaks (RESOURCE_LEAK) /util/nvidia/cbootimage/src/data_layout.c: 1096 in resign_bl() 1090 1091 if (read_from_image(context->input_image_filename, 1092 offset, bl_length, 1093 &image, &image_actual_size, file_type_bin)) { 1094 printf("Error reading image file %s.\n", 1095 context->input_image_filename); >>> CID 1353793: Resource leaks (RESOURCE_LEAK) >>> Variable "image" going out of scope leaks the storage it points to. 1096 return -ENOMEM; 1097 } 1098 1099 pages_in_image = ICEIL(image_actual_size, page_size); 1100 1101 /* Create a local copy of the bl */ ** CID 1353781: Control flow issues (NO_EFFECT) /util/nvidia/cbootimage/src/cbootimage.c: 242 in main() ________________________________________________________________________________________________________ *** CID 1353781: Control flow issues (NO_EFFECT) /util/nvidia/cbootimage/src/cbootimage.c: 242 in main() 236 context.input_image_filename); 237 goto fail; 238 } 239 240 /* Get BCT_SIZE from input image file */ 241 bct_size = get_bct_size_from_image(&context); >>> CID 1353781: Control flow issues (NO_EFFECT) >>> This less-than-zero comparison of an unsigned value is never true. "bct_size < 0U". 242 if (bct_size < 0) { 243 printf("Error: Invalid input image file %s\n", 244 context.input_image_filename); 245 goto fail; 246 } 247 ** CID 1353171: Null pointer dereferences (NULL_RETURNS) /src/soc/intel/skylake/romstage/romstage.c: 72 in soc_memory_init_params() ________________________________________________________________________________________________________ *** CID 1353171: Null pointer dereferences (NULL_RETURNS) /src/soc/intel/skylake/romstage/romstage.c: 72 in soc_memory_init_params() 66 { 67 const struct device *dev; 68 const struct soc_intel_skylake_config *config; 69 70 /* Set the parameters for MemoryInit */ 71 dev = dev_find_slot(0, PCI_DEVFN(PCH_DEV_SLOT_LPC, 0)); >>> CID 1353171: Null pointer dereferences (NULL_RETURNS) >>> Dereferencing a null pointer "dev". 72 config = dev->chip_info; 73 74 /* 75 * Set IGD stolen size to 64MB. The FBC hardware for skylake does not 76 * have access to the bios_reserved range so it always assumes 8MB is 77 * used and so the kernel will avoid the last 8MB of the stolen window. ** CID 1353028: Error handling issues (NEGATIVE_RETURNS) /util/amdfwtool/amdfwtool.c: 284 in integrate_psp_firmwares() ________________________________________________________________________________________________________ *** CID 1353028: Error handling issues (NEGATIVE_RETURNS) /util/amdfwtool/amdfwtool.c: 284 in integrate_psp_firmwares() 278 pspdir[4+4*i+2] = 1; 279 pspdir[4+4*i+3] = 0; 280 } else if (fw_table[i].filename != NULL) { 281 pspdir[4+4*i+0] = fw_table[i].type; 282 283 fd = open (fw_table[i].filename, O_RDONLY); >>> CID 1353028: Error handling issues (NEGATIVE_RETURNS) >>> "fd" is passed to a parameter that cannot be negative. [Note: The source code implementation of the function has been overridden by a builtin model.] 284 fstat(fd, &fd_stat); 285 pspdir[4+4*i+1] = fd_stat.st_size; 286 287 pspdir[4+4*i+2] = pos + ROM_BASE_ADDRESS; 288 pspdir[4+4*i+3] = 0; 289 ** CID 1353027: Error handling issues (NEGATIVE_RETURNS) /util/amdfwtool/amdfwtool.c: 239 in integrate_firmwares() ________________________________________________________________________________________________________ *** CID 1353027: Error handling issues (NEGATIVE_RETURNS) /util/amdfwtool/amdfwtool.c: 239 in integrate_firmwares() 233 struct stat fd_stat; 234 int i; 235 236 for (i = 0; fw_table[i].type != AMD_FW_INVALID; i ++) { 237 if (fw_table[i].filename != NULL) { 238 fd = open (fw_table[i].filename, O_RDONLY); >>> CID 1353027: Error handling issues (NEGATIVE_RETURNS) >>> "fd" is passed to a parameter that cannot be negative. [Note: The source code implementation of the function has been overridden by a builtin model.] 239 fstat(fd, &fd_stat); 240 241 switch (fw_table[i].type) { 242 case AMD_FW_IMC: 243 pos = ALIGN(pos, 0x10000); 244 romsig[1] = pos + ROM_BASE_ADDRESS; ** CID 1353022: Error handling issues (CHECKED_RETURN) /util/nvidia/cbootimage/src/cbootimage.c: 297 in main() ________________________________________________________________________________________________________ *** CID 1353022: Error handling issues (CHECKED_RETURN) /util/nvidia/cbootimage/src/cbootimage.c: 297 in main() 291 begin_update(&context); 292 /* Signing the bct. */ 293 e = sign_bct(&context, context.bct); 294 if (e != 0) 295 printf("Signing BCT failed, error: %d.\n", e); 296 >>> CID 1353022: Error handling issues (CHECKED_RETURN) >>> Calling "fwrite" without checking return value (as is done elsewhere 34 out of 42 times). 297 fwrite(context.bct, 1, context.bct_size, 298 context.raw_file); 299 printf("New BCT file %s has been successfully generated!\n", 300 context.output_image_filename); 301 goto fail; 302 } ** CID 1353021: Error handling issues (CHECKED_RETURN) /util/amdfwtool/amdfwtool.c: 290 in integrate_psp_firmwares() ________________________________________________________________________________________________________ *** CID 1353021: Error handling issues (CHECKED_RETURN) /util/amdfwtool/amdfwtool.c: 290 in integrate_psp_firmwares() 284 fstat(fd, &fd_stat); 285 pspdir[4+4*i+1] = fd_stat.st_size; 286 287 pspdir[4+4*i+2] = pos + ROM_BASE_ADDRESS; 288 pspdir[4+4*i+3] = 0; 289 >>> CID 1353021: Error handling issues (CHECKED_RETURN) >>> "read(int, void *, size_t)" returns the number of bytes read, but it is ignored. 290 read (fd, base+pos, fd_stat.st_size); 291 292 pos += fd_stat.st_size; 293 pos = ALIGN(pos, 0x100); 294 close (fd); 295 } else { ** CID 1353020: Error handling issues (CHECKED_RETURN) /util/amdfwtool/amdfwtool.c: 284 in integrate_psp_firmwares() ________________________________________________________________________________________________________ *** CID 1353020: Error handling issues (CHECKED_RETURN) /util/amdfwtool/amdfwtool.c: 284 in integrate_psp_firmwares() 278 pspdir[4+4*i+2] = 1; 279 pspdir[4+4*i+3] = 0; 280 } else if (fw_table[i].filename != NULL) { 281 pspdir[4+4*i+0] = fw_table[i].type; 282 283 fd = open (fw_table[i].filename, O_RDONLY); >>> CID 1353020: Error handling issues (CHECKED_RETURN) >>> Calling "fstat(fd, &fd_stat)" without checking return value. This library function may fail and return an error code. [Note: The source code implementation of the function has been overridden by a builtin model.] 284 fstat(fd, &fd_stat); 285 pspdir[4+4*i+1] = fd_stat.st_size; 286 287 pspdir[4+4*i+2] = pos + ROM_BASE_ADDRESS; 288 pspdir[4+4*i+3] = 0; 289 ** CID 1353019: Error handling issues (CHECKED_RETURN) /util/amdfwtool/amdfwtool.c: 257 in integrate_firmwares() ________________________________________________________________________________________________________ *** CID 1353019: Error handling issues (CHECKED_RETURN) /util/amdfwtool/amdfwtool.c: 257 in integrate_firmwares() 251 break; 252 default: 253 /* Error */ 254 break; 255 } 256 >>> CID 1353019: Error handling issues (CHECKED_RETURN) >>> "read(int, void *, size_t)" returns the number of bytes read, but it is ignored. 257 read (fd, base+pos, fd_stat.st_size); 258 259 pos += fd_stat.st_size; 260 pos = ALIGN(pos, 0x100); 261 close (fd); 262 } ** CID 1353018: Error handling issues (CHECKED_RETURN) /util/amdfwtool/amdfwtool.c: 239 in integrate_firmwares() ________________________________________________________________________________________________________ *** CID 1353018: Error handling issues (CHECKED_RETURN) /util/amdfwtool/amdfwtool.c: 239 in integrate_firmwares() 233 struct stat fd_stat; 234 int i; 235 236 for (i = 0; fw_table[i].type != AMD_FW_INVALID; i ++) { 237 if (fw_table[i].filename != NULL) { 238 fd = open (fw_table[i].filename, O_RDONLY); >>> CID 1353018: Error handling issues (CHECKED_RETURN) >>> Calling "fstat(fd, &fd_stat)" without checking return value. This library function may fail and return an error code. [Note: The source code implementation of the function has been overridden by a builtin model.] 239 fstat(fd, &fd_stat); 240 241 switch (fw_table[i].type) { 242 case AMD_FW_IMC: 243 pos = ALIGN(pos, 0x10000); 244 romsig[1] = pos + ROM_BASE_ADDRESS; ** CID 1347358: Error handling issues (NEGATIVE_RETURNS) /util/amdfwtool/amdfwtool.c: 586 in main() ________________________________________________________________________________________________________ *** CID 1347358: Error handling issues (NEGATIVE_RETURNS) /util/amdfwtool/amdfwtool.c: 586 in main() 580 current = integrate_psp_firmwares(rom, current, psp2dir, amd_psp2_fw_table); 581 #endif 582 } 583 #endif 584 585 targetfd = open(output, O_RDWR | O_CREAT | O_TRUNC, 0666); >>> CID 1347358: Error handling issues (NEGATIVE_RETURNS) >>> "targetfd" is passed to a parameter that cannot be negative. 586 write(targetfd, amd_romsig, current - AMD_ROMSIG_OFFSET); 587 close(targetfd); 588 free(rom); 589 590 return 0; ** CID 1347335: (UNINIT) /util/cbfstool/elfheaders.c: 1002 in write_phdrs() /util/cbfstool/elfheaders.c: 999 in write_phdrs() /util/cbfstool/elfheaders.c: 1001 in write_phdrs() /util/cbfstool/elfheaders.c: 1003 in write_phdrs() ________________________________________________________________________________________________________ *** CID 1347335: (UNINIT) /util/cbfstool/elfheaders.c: 1002 in write_phdrs() 996 * (sh_size == file size). This is standard in that 997 * an ELF section doesn't have a file size component. */ 998 if (sec->shdr.sh_flags & SHF_EXECINSTR) 999 phdr.p_flags |= PF_X | PF_R; 1000 if (sec->shdr.sh_flags & SHF_WRITE) 1001 phdr.p_flags |= PF_W; >>> CID 1347335: (UNINIT) >>> Using uninitialized value "phdr.p_filesz". 1002 phdr.p_filesz += buffer_size(&sec->content); 1003 phdr.p_memsz += sec->shdr.sh_size; 1004 } 1005 } 1006 1007 /* Write out the last phdr. */ /util/cbfstool/elfheaders.c: 999 in write_phdrs() 993 } else { 994 /* Accumulate file size and memsize. The assumption 995 * is that each section is either NOBITS or full 996 * (sh_size == file size). This is standard in that 997 * an ELF section doesn't have a file size component. */ 998 if (sec->shdr.sh_flags & SHF_EXECINSTR) >>> CID 1347335: (UNINIT) >>> Using uninitialized value "phdr.p_flags". 999 phdr.p_flags |= PF_X | PF_R; 1000 if (sec->shdr.sh_flags & SHF_WRITE) 1001 phdr.p_flags |= PF_W; 1002 phdr.p_filesz += buffer_size(&sec->content); 1003 phdr.p_memsz += sec->shdr.sh_size; 1004 } /util/cbfstool/elfheaders.c: 1001 in write_phdrs() 995 * is that each section is either NOBITS or full 996 * (sh_size == file size). This is standard in that 997 * an ELF section doesn't have a file size component. */ 998 if (sec->shdr.sh_flags & SHF_EXECINSTR) 999 phdr.p_flags |= PF_X | PF_R; 1000 if (sec->shdr.sh_flags & SHF_WRITE) >>> CID 1347335: (UNINIT) >>> Using uninitialized value "phdr.p_flags". 1001 phdr.p_flags |= PF_W; 1002 phdr.p_filesz += buffer_size(&sec->content); 1003 phdr.p_memsz += sec->shdr.sh_size; 1004 } 1005 } 1006 /util/cbfstool/elfheaders.c: 1003 in write_phdrs() 997 * an ELF section doesn't have a file size component. */ 998 if (sec->shdr.sh_flags & SHF_EXECINSTR) 999 phdr.p_flags |= PF_X | PF_R; 1000 if (sec->shdr.sh_flags & SHF_WRITE) 1001 phdr.p_flags |= PF_W; 1002 phdr.p_filesz += buffer_size(&sec->content); >>> CID 1347335: (UNINIT) >>> Using uninitialized value "phdr.p_memsz". 1003 phdr.p_memsz += sec->shdr.sh_size; 1004 } 1005 } 1006 1007 /* Write out the last phdr. */ 1008 if (num_needs_write != num_written) { ** CID 1347333: Memory - illegal accesses (UNINIT) /util/amdfwtool/amdfwtool.c: 585 in main() ________________________________________________________________________________________________________ *** CID 1347333: Memory - illegal accesses (UNINIT) /util/amdfwtool/amdfwtool.c: 585 in main() 579 #else 580 current = integrate_psp_firmwares(rom, current, psp2dir, amd_psp2_fw_table); 581 #endif 582 } 583 #endif 584 >>> CID 1347333: Memory - illegal accesses (UNINIT) >>> Using uninitialized value "output" when calling "open". 585 targetfd = open(output, O_RDWR | O_CREAT | O_TRUNC, 0666); 586 write(targetfd, amd_romsig, current - AMD_ROMSIG_OFFSET); 587 close(targetfd); 588 free(rom); 589 590 return 0; ** CID 1325840: Memory - illegal accesses (OVERRUN) /util/cbfstool/cbfs_image.c: 1406 in cbfs_print_entry_info() ________________________________________________________________________________________________________ *** CID 1325840: Memory - illegal accesses (OVERRUN) /util/cbfstool/cbfs_image.c: 1406 in cbfs_print_entry_info() 1400 while ((hash = cbfs_file_get_next_hash(entry, hash)) != NULL) { 1401 unsigned int hash_type = ntohl(hash->hash_type); 1402 if (hash_type > CBFS_NUM_SUPPORTED_HASHES) { 1403 fprintf(fp, "invalid hash type %d\n", hash_type); 1404 break; 1405 } >>> CID 1325840: Memory - illegal accesses (OVERRUN) >>> Overrunning array "widths_cbfs_hash" of 4 8-byte elements at element index 4 (byte offset 32) using index "hash_type" (which evaluates to 4). 1406 size_t hash_len = widths_cbfs_hash[hash_type]; 1407 char *hash_str = bintohex(hash->hash_data, hash_len); 1408 uint8_t local_hash[hash_len]; 1409 if (vb2_digest_buffer(CBFS_SUBHEADER(entry), 1410 ntohl(entry->len), hash_type, local_hash, 1411 hash_len) != VB2_SUCCESS) { ** CID 1325836: Resource leaks (RESOURCE_LEAK) /util/cbfstool/cbfs_image.c: 1413 in cbfs_print_entry_info() ________________________________________________________________________________________________________ *** CID 1325836: Resource leaks (RESOURCE_LEAK) /util/cbfstool/cbfs_image.c: 1413 in cbfs_print_entry_info() 1407 char *hash_str = bintohex(hash->hash_data, hash_len); 1408 uint8_t local_hash[hash_len]; 1409 if (vb2_digest_buffer(CBFS_SUBHEADER(entry), 1410 ntohl(entry->len), hash_type, local_hash, 1411 hash_len) != VB2_SUCCESS) { 1412 fprintf(fp, "failed to hash '%s'\n", name); >>> CID 1325836: Resource leaks (RESOURCE_LEAK) >>> Variable "hash_str" going out of scope leaks the storage it points to. 1413 break; 1414 } 1415 int valid = memcmp(local_hash, hash->hash_data, hash_len) == 0; 1416 const char *valid_str = valid ? "valid" : "invalid"; 1417 1418 fprintf(fp, " hash %s:%s %s\n", ** CID 1323515: Error handling issues (CHECKED_RETURN) /util/broadcom/secimage/sbi.c: 112 in CreateSecureBootImage() ________________________________________________________________________________________________________ *** CID 1323515: Error handling issues (CHECKED_RETURN) /util/broadcom/secimage/sbi.c: 112 in CreateSecureBootImage() 106 } else { 107 return SBIUsage(); 108 } 109 --ac, ++av; 110 } 111 >>> CID 1323515: Error handling issues (CHECKED_RETURN) >>> Calling "stat(bl, &file_stat)" without checking return value. This library function may fail and return an error code. [Note: The source code implementation of the function has been overridden by a builtin model.] 112 stat(bl, &file_stat); 113 filesize = file_stat.st_size + MIN_SIZE; 114 buf = calloc(sizeof(uint8_t), filesize); 115 116 if (buf == NULL) { 117 puts("Memory allocation error"); ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V0… To manage Coverity Scan email notifications for "coreboot(a)coreboot.org", click https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V0…

1 0

← Newer
1
2
3
4
5
6
7
...
14
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

coreboot August 2016