July 2019 - coreboot - mail.coreboot.org

OpenBSD won't install on an x220 Thinkpad with Coreboot
by Robert Milton April 12, 2020

April 12, 2020

I'm trying to get OpenBSD to install on an x220 Thinkpad with Coreboot/SeaBIOS but I'm running into two problems: the ethernet device doesn't work and OpenBSD doesn't detect my HDD. dmesg said em0 wouldn't load because the EEPROM had an invalid signature. I have no idea why OpenBSD doesn't see my HDD though. It's strange because everything works fine under Linux. And I cannot seem to mount a usb drive under the OpenBSD installer to attach dmesg errors. I originally posted this as a bug report to bug report mailing list but Theo said it would be better suited for Coreboot's and wasn't a bug in OpenBSD.

4 4

Optiplex 790 now has preliminary support by coreboot
by Taiidan＠gmx.com Jan. 15, 2020

Jan. 15, 2020

https://review.coreboot.org/21774 In case anyone else didn't notice - It is a sandy/ivy system with IOMMU. This is great and should help get coreboot in to the corporate user world.

2 1

[AMD 16h / ASUS AM1I-A] 1866MHz CL9 RAM runs only as 1333MHz CL9 - how to fix?
by Mike Banon Nov. 17, 2019

Nov. 17, 2019

A pair of 1866MHz CL9 RAM modules* runs only as 1333MHz CL9 on 16h AM1I-A with coreboot is installed, but worked faster when a proprietary UEFI was installed. To fix this "turtle RAM" coreboot problem I tried to play with buildOpts.c - https://review.coreboot.org/c/coreboot/+/33920 , but the things like "#define BLDCFG_MEMORY_CLOCK_SELECT DDR1866_FREQUENCY" sadly did not help. Any ideas how to improve the RAM speeds? How I can force this RAM to run faster? Best regards, Mike Banon [*] Crucial Ballistix Tactical Series DDR3 1866MHz CL9 (PC3-14900 9-9-9-24) UDIMM 240-Pin modules, part number BLT8G3D1869DT1TX0

3 9

Chainloading Windows from a Linux Payload
by Matt B Aug. 27, 2019

Aug. 27, 2019

Greetings, From what I can find, Linux can only chainload another linux kernel. (via kexec) Does this mean that a Linux payload like LinuxBoot cannot be used to boot Windows or another OS, either directly or by chainloading another payload from CBFS? It's nice that a Linux payload can provide superior flexibility and configurability than UEFI with the added benefit of a battle-hardened environment, but the ability to only boot a Linux OS seems like a pretty significant limitation (if this is indeed the case). Sincerely, -Matt

7 12

Abandoning ~250 coreboot patches older than 18 months
by Martin Roth Aug. 6, 2019

Aug. 6, 2019

It's patch cleanup time again. This cleanup was last done almost 2 years ago, so there are a lot of old patches that haven't been touched in a while. Next week I'm going to abandon all of the open patches that haven't been touched in over 18 months. The list of roughly 250 patches to be abandoned is here: https://review.coreboot.org/q/status:open+before:2018-02-1+project:coreboot If anyone wants to take over any of these patches, just mention it in the patch and if the author doesn't respond in a day or two, feel free to let them know that you've adopted the patch. As always, if there's anything that is still useful and shouldn't be abandoned, a comment in the patch is enough to keep it alive in gerrit. Martin

1 1

KGPE-d16 recent microcode (Adds IBPB) produces kernel panics
by Kinky Nekoboi Aug. 1, 2019

Aug. 1, 2019

loading the microcode via Linux Kernel works. including it via coreboot causes General Protection Faults. See included bootlog.

3 3

New on blogs.coreboot.org: [GSoC] Ghidra firmware utilities, week 10
by blogs.coreboot.org Aug. 1, 2019

Aug. 1, 2019

1 0

KGPE-D16: using linux kernel with SLUB MEM_ALLOCATOR -> KERNEL SPINLOCK PANIC
by Kinky Nekoboi July 30, 2019

July 30, 2019

not sure if coreboot or kernel related. vanila kernel 4.19.62 with SLAB allocater build works fine. Debians Busters default kernel 4.19.x with SLUB panics. see: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=930029 see Bootlog: oading Linux 4.19.0-5-amd64 ...Loading Linux 4.19.0-5-amd64 .. . Loading initial ramdisk ...Loading initial ramdisk .. . [ 0.000000] Linux version 4.19.0-5-amd64 (debian-kernel(a)lists.debian.org) (g) [ 0.000000] Command line: BOOT_IMAGE=/boot/vmlinuz-4.19.0-5-amd64 root=UUID=0 [ 0.000000] random: get_random_u32 called from bsp_init_amd+0x20b/0x2b0 with0 [ 0.000000] x86/fpu: Supporting XSAVE feature 0x001: 'x87 floating point reg' [ 0.000000] x86/fpu: Supporting XSAVE feature 0x002: 'SSE registers' [ 0.000000] x86/fpu: Supporting XSAVE feature 0x004: 'AVX registers' [ 0.000000] x86/fpu: xstate_offset[2]: 576, xstate_sizes[2]: 256 [ 0.000000] x86/fpu: Enabled xstate features 0x7, context size is 832 bytes,. [ 0.000000] BIOS-provided physical RAM map: [ 0.000000] BIOS-e820: [mem 0x0000000000000000-0x000000000009fbff] usable [ 0.000000] BIOS-e820: [mem 0x000000000009fc00-0x000000000009ffff] reserved [ 0.000000] BIOS-e820: [mem 0x00000000000f0000-0x00000000000fffff] reserved [ 0.000000] BIOS-e820: [mem 0x0000000000100000-0x00000000b7d97fff] usable [ 0.000000] BIOS-e820: [mem 0x00000000b7d98000-0x00000000b7ffffff] reserved [ 0.000000] BIOS-e820: [mem 0x00000000b8000000-0x00000000bfffafff] usable [ 0.000000] BIOS-e820: [mem 0x00000000bfffb000-0x00000000cfffffff] reserved [ 0.000000] BIOS-e820: [mem 0x00000000fcf00000-0x00000000fcf03fff] reserved [ 0.000000] BIOS-e820: [mem 0x00000000feb00000-0x00000000feb00fff] reserved [ 0.000000] BIOS-e820: [mem 0x00000000fec00000-0x00000000fec00fff] reserved [ 0.000000] BIOS-e820: [mem 0x00000000fed00000-0x00000000fed00fff] reserved [ 0.000000] BIOS-e820: [mem 0x00000000fed40000-0x00000000fed44fff] reserved [ 0.000000] BIOS-e820: [mem 0x0000000100000000-0x0000000437ffffff] usable [ 0.000000] BIOS-e820: [mem 0x0000000438000000-0x000000043fffffff] reserved [ 0.000000] bootconsole [earlyser0] enabled [ 0.000000] NX (Execute Disable) protection: active [ 0.000000] SMBIOS 2.7 present. [ 0.000000] DMI: ASUS KGPE-D16/KGPE-D16, BIOS 4.9-1859-gf3510cbe36 05/31/2019 [ 0.000000] tsc: Fast TSC calibration using PIT [ 0.000000] tsc: Detected 2500.121 MHz processor [ 0.010404] AGP: No AGP bridge found [ 0.013881] last_pfn = 0x438000 max_arch_pfn = 0x400000000 [ 0.021404] x86/PAT: Configuration [0-7]: WB WC UC- UC WB WP UC- WT Memory KASLR using RDTSC... [ 0.030856] last_pfn = 0xbfffb max_arch_pfn = 0x400000000 [ 0.042030] Using GB pages for direct mapping [ 0.046429] RAMDISK: [mem 0x3476f000-0x363aefff] [ 0.050877] ACPI: Early table checksum verification disabled [ 0.056563] ACPI: RSDP 0x00000000000F6250 000024 (v02 COREv4) [ 0.062225] ACPI: XSDT 0x00000000B7D990E0 000074 (v01 COREv4 COREBOOT 000000) [ 0.070720] ACPI: FACP 0x00000000B7D9B9A0 0000F4 (v03 COREv4 COREBOOT 000000) [ 0.079213] ACPI: DSDT 0x00000000B7D99280 00271A (v02 COREv4 COREBOOT 000000) [ 0.087704] ACPI: FACS 0x00000000B7D99240 000040 [ 0.092298] ACPI: FACS 0x00000000B7D99240 000040 [ 0.096890] ACPI: SSDT 0x00000000B7D9BAA0 0020F2 (v02 COREv4 COREBOOT 000000) [ 0.105383] ACPI: MCFG 0x00000000B7D9DBA0 00003C (v01 COREv4 COREBOOT 000000) [ 0.113875] ACPI: APIC 0x00000000B7D9DBE0 0000DE (v02 COREv4 COREBOOT 000000) [ 0.122369] ACPI: SRAT 0x00000000B7D9DCC0 0001A8 (v01 COREv4 COREBOOT 000000) [ 0.130862] ACPI: SLIT 0x00000000B7D9DE68 000030 (v01 COREv4 COREBOOT 000000) [ 0.139355] ACPI: SRAT 0x00000000B7D9DEA0 0001A8 (v01 COREv4 COREBOOT 000000) [ 0.147848] ACPI: SLIT 0x00000000B7D9E048 000030 (v01 COREv4 COREBOOT 000000) [ 0.156341] ACPI: IVRS 0x00000000B7D9E080 0000BC (v01 COREv4 COREBOOT 000000) [ 0.164834] ACPI: HPET 0x00000000B7D9E140 000038 (v01 COREv4 COREBOOT 000000) [ 0.173380] SRAT: PXM 0 -> APIC 0x00 -> Node 0 [ 0.177747] SRAT: PXM 0 -> APIC 0x01 -> Node 0 [ 0.182167] SRAT: PXM 0 -> APIC 0x02 -> Node 0 [ 0.186586] SRAT: PXM 0 -> APIC 0x03 -> Node 0 [ 0.191006] SRAT: PXM 0 -> APIC 0x04 -> Node 0 [ 0.195426] SRAT: PXM 0 -> APIC 0x05 -> Node 0 [ 0.199845] SRAT: PXM 0 -> APIC 0x06 -> Node 0 [ 0.204264] SRAT: PXM 0 -> APIC 0x07 -> Node 0 [ 0.208685] SRAT: PXM 1 -> APIC 0x08 -> Node 1 [ 0.213104] SRAT: PXM 1 -> APIC 0x09 -> Node 1 [ 0.217525] SRAT: PXM 1 -> APIC 0x0a -> Node 1 [ 0.221944] SRAT: PXM 1 -> APIC 0x0b -> Node 1 [ 0.226364] SRAT: PXM 1 -> APIC 0x0c -> Node 1 [ 0.230784] SRAT: PXM 1 -> APIC 0x0d -> Node 1 [ 0.235204] SRAT: PXM 1 -> APIC 0x0e -> Node 1 [ 0.239624] SRAT: PXM 1 -> APIC 0x0f -> Node 1 [ 0.244046] ACPI: SRAT: Node 0 PXM 0 [mem 0x00000000-0x0009ffff] [ 0.250025] ACPI: SRAT: Node 1 PXM 1 [mem 0x00100000-0xbfffffff] [ 0.256004] ACPI: SRAT: Node 1 PXM 1 [mem 0x100000000-0x43fffffff] [ 0.262162] NUMA: Node 1 [mem 0x00100000-0xbfffffff] + [mem 0x100000000-0x43] [ 0.272647] NODE_DATA(1) allocated [mem 0x437ff8000-0x437ffcfff] [ 0.278660] node 0 must be removed before remove section 134 [ 0.284272] Zone ranges: [ 0.286769] DMA [mem 0x0000000000001000-0x0000000000ffffff] [ 0.292922] DMA32 [mem 0x0000000001000000-0x00000000ffffffff] [ 0.299075] Normal [mem 0x0000000100000000-0x0000000437ffffff] [ 0.305228] Device empty [ 0.308088] Movable zone start for each node [ 0.312335] Early memory node ranges [ 0.315888] node 0: [mem 0x0000000000001000-0x000000000009efff] [ 0.322128] node 1: [mem 0x0000000000100000-0x00000000b7d97fff] [ 0.328368] node 1: [mem 0x00000000b8000000-0x00000000bfffafff] [ 0.334607] node 1: [mem 0x0000000100000000-0x0000000437ffffff] [ 0.340850] Reserved but unavailable: 98 pages [ 0.340852] Initmem setup node 1 [mem 0x0000000000100000-0x0000000437ffffff] [ 0.466889] ACPI: PM-Timer IO Port: 0x820 [ 0.470732] ACPI: LAPIC_NMI (acpi_id[0xff] dfl dfl lint[0x1]) [ 0.476453] IOAPIC[0]: apic_id 32, version 33, address 0xfec00000, GSI 0-23 [ 0.483376] IOAPIC[1]: apic_id 33, version 33, address 0xfd000000, GSI 24-55 [ 0.490395] ACPI: INT_SRC_OVR (bus 0 bus_irq 0 global_irq 2 dfl dfl) [ 0.496721] ACPI: INT_SRC_OVR (bus 0 bus_irq 9 global_irq 9 low level) [ 0.503224] Using ACPI (MADT) for SMP configuration information [ 0.509114] ACPI: HPET id: 0x43538301 base: 0xfed00000 [ 0.514232] smpboot: Allowing 16 CPUs, 0 hotplug CPUs [ 0.519255] NODE_DATA(0) allocated [mem 0x00093000-0x00097fff] [ 0.525066] Initmem setup node 0 [mem 0x0000000000001000-0x000000000009efff] [ 0.532110] PM: Registered nosave memory: [mem 0x00000000-0x00000fff] [ 0.538492] PM: Registered nosave memory: [mem 0x0009f000-0x0009ffff] [ 0.544905] PM: Registered nosave memory: [mem 0x000a0000-0x000effff] [ 0.551318] PM: Registered nosave memory: [mem 0x000f0000-0x000fffff] [ 0.557733] PM: Registered nosave memory: [mem 0xb7d98000-0xb7ffffff] [ 0.564146] PM: Registered nosave memory: [mem 0xbfffb000-0xcfffffff] [ 0.570558] PM: Registered nosave memory: [mem 0xd0000000-0xfcefffff] [ 0.576971] PM: Registered nosave memory: [mem 0xfcf00000-0xfcf03fff] [ 0.583384] PM: Registered nosave memory: [mem 0xfcf04000-0xfeafffff] [ 0.589797] PM: Registered nosave memory: [mem 0xfeb00000-0xfeb00fff] [ 0.596209] PM: Registered nosave memory: [mem 0xfeb01000-0xfebfffff] [ 0.602622] PM: Registered nosave memory: [mem 0xfec00000-0xfec00fff] [ 0.609035] PM: Registered nosave memory: [mem 0xfec01000-0xfecfffff] [ 0.615449] PM: Registered nosave memory: [mem 0xfed00000-0xfed00fff] [ 0.621862] PM: Registered nosave memory: [mem 0xfed01000-0xfed3ffff] [ 0.628275] PM: Registered nosave memory: [mem 0xfed40000-0xfed44fff] [ 0.634688] PM: Registered nosave memory: [mem 0xfed45000-0xffffffff] [ 0.641103] [mem 0xd0000000-0xfcefffff] available for PCI devices [ 0.647167] Booting paravirtualized kernel on bare hardware [ 0.652717] clocksource: refined-jiffies: mask: 0xffffffff max_cycles: 0xfffs [ 0.795517] setup_percpu: NR_CPUS:512 nr_cpumask_bits:512 nr_cpu_ids:16 nr_n2 [ 0.804648] percpu: Embedded 44 pages/cpu s143256 r8192 d28776 u262144 [ 0.811044] Built 2 zonelists, mobility grouping on. Total pages: 4095761 [ 0.817843] Policy zone: Normal [ 0.820965] Kernel command line: BOOT_IMAGE=/boot/vmlinuz-4.19.0-5-amd64 roo0 [ 0.854959] AGP: Checking aperture... [ 0.866845] AGP: No AGP bridge found [ 0.870252] AGP: Node 0: aperture [bus addr 0xf8000000-0xfbffffff] (64MB) [ 0.877011] AGP: Node 1: aperture [bus addr 0xf8000000-0xfbffffff] (64MB) [ 0.975916] Memory: 16260640K/16643268K available (10252K kernel code, 1242K) [ 0.989765] BUG: unable to handle kernel NULL pointer dereference at 00000000 [ 0.997523] PGD 0 P4D 0 [ 1.000037] Oops: 0002 [#1] SMP NOPTI [ 1.003678] CPU: 0 PID: 0 Comm: swapper Not tainted 4.19.0-5-amd64 #1 Debian3 [ 1.011562] Hardware name: ASUS KGPE-D16/KGPE-D16, BIOS 4.9-1859-gf3510cbe369 [ 1.019541] RIP: 0010:_raw_spin_lock+0xc/0x20 [ 1.023869] Code: 01 00 00 75 05 48 89 d8 5b c3 e8 1f f7 9a ff eb f4 66 66 2b [ 1.042588] RSP: 0000:ffffffff91803e08 EFLAGS: 00010046 [ 1.047788] RAX: 0000000000000000 RBX: ffff996c80083d80 RCX: 4132840b73c45ab1 [ 1.054893] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 1.061999] RBP: ffffffff91803ec8 R08: ffff996c80080000 R09: ffff996c80083d80 [ 1.069107] R10: 0000000000000000 R11: ffff996c80080000 R12: ffffed5880002000 [ 1.076213] R13: 00000000802a0002 R14: 0000000000000001 R15: ffff996c80083c00 [ 1.083320] FS: 0000000000000000(0000) GS:ffff9970a7c00000(0000) knlGS:00000 [ 1.091380] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1.097098] CR2: 0000000000000000 CR3: 0000000023c0a000 CR4: 00000000000406b0 [ 1.104206] Call Trace: [ 1.106638] deactivate_slab.isra.71+0x2d2/0x630 [ 1.111232] ? bootstrap+0x1f/0x12c [ 1.114693] ? kmem_cache_alloc+0x1b8/0x1c0 [ 1.118854] bootstrap+0x66/0x12c [ 1.122148] kmem_cache_init+0x8c/0x145 [ 1.125962] start_kernel+0x2a6/0x52c [ 1.129602] secondary_startup_64+0xa4/0xb0 [ 1.133759] Modules linked in: [ 1.136791] CR2: 0000000000000000 [ 1.140094] ---[ end trace a6e00f6a2ecfb185 ]--- [ 1.144679] RIP: 0010:_raw_spin_lock+0xc/0x20 [ 1.149011] Code: 01 00 00 75 05 48 89 d8 5b c3 e8 1f f7 9a ff eb f4 66 66 2b [ 1.167730] RSP: 0000:ffffffff91803e08 EFLAGS: 00010046 [ 1.172929] RAX: 0000000000000000 RBX: ffff996c80083d80 RCX: 4132840b73c45ab1 [ 1.180036] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 1.187143] RBP: ffffffff91803ec8 R08: ffff996c80080000 R09: ffff996c80083d80 [ 1.194248] R10: 0000000000000000 R11: ffff996c80080000 R12: ffffed5880002000 [ 1.201355] R13: 00000000802a0002 R14: 0000000000000001 R15: ffff996c80083c00 [ 1.208462] FS: 0000000000000000(0000) GS:ffff9970a7c00000(0000) knlGS:00000 [ 1.216520] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1.222241] CR2: 0000000000000000 CR3: 0000000023c0a000 CR4: 00000000000406b0 [ 1.229350] Kernel panic - not syncing: Attempted to kill the idle task! [ 1.236028] ---[ end Kernel panic - not syncing: Attempted to kill the idle - [ 1.243910] PANIC: double fault, error_code: 0xffffffff9087cc95 [ 1.249801] CPU: 0 PID: 0 Comm: swapper Tainted: G D 4.19.0-53 [ 1.259073] Hardware name: ASUS KGPE-D16/KGPE-D16, BIOS 4.9-1859-gf3510cbe369 [ 1.267048] RIP: 0246:0x10 [ 1.269732] Code: Bad RIP value. [ 1.272939] RSP: 0000:0000000000000000 EFLAGS: ffffffff91803e58 [ 1.278832] RAX: 000000000000004a RBX: ffffffff91813700 RCX: ffffffff9184dda8 [ 1.285938] RDX: 0000000000000000 RSI: 0000000000000096 RDI: 0000000000000046 [ 1.293045] RBP: ffffffff91803ec8 R08: 00000000000000d2 R09: 2d2d2d5d20216b73 [ 1.300151] R10: 74206c6c696b206f R11: 20656c6469206568 R12: 0000000000000000 [ 1.307257] R13: 0000000000000000 R14: 0000000000000009 R15: 0000000000000001 [ 1.314364] FS: 0000000000000000 GS: 0000000000000000 [ 1.319564] Kernel panic - not syncing: Machine halted. [ 1.324770] ---[ end Kernel panic - not syncing: Machine halted. ]---

1 0

New Defects reported by Coverity Scan for coreboot
by scan-admin＠coverity.com July 28, 2019

July 28, 2019

Hi, Please find the latest report on new defect(s) introduced to coreboot found with Coverity Scan. 106 new defect(s) introduced to coreboot found with Coverity Scan. 77 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 20 of 106 defect(s) ** CID 1402138: (OVERRUN) ________________________________________________________________________________________________________ *** CID 1402138: (OVERRUN) /src/vendorcode/amd/cimx/sb900/Sata.c: 601 in sataInitAfterPciEnum() 595 596 sataBar5setting (pConfig, &ddBar5); 597 598 ReadPCI (((SATA_BUS_DEV_FUN << 16) + SB_SATA_REG04), AccWidthUint8, &dbVar); 599 RWPCI (((SATA_BUS_DEV_FUN << 16) + SB_SATA_REG04), AccWidthUint8, 0xFF, 0x03); //memory and io access enable 600 dbEfuse = SATA_FIS_BASE_EFUSE_LOC; >>> CID 1402138: (OVERRUN) >>> Overrunning buffer pointed to by "&dbEfuse" of 1 bytes by passing it to a function which accesses it at byte offset 1. 601 getEfuseStatus (&dbEfuse); 602 603 if ( !cimSataPortMultCap ) { 604 ddAndMask |= BIT12; 605 } 606 if ( cimSataAggrLinkPmCap ) { /src/vendorcode/amd/cimx/sb800/SATA.c: 407 in sataInitAfterPciEnum() 401 402 sataBar5setting (pConfig, &ddBar5); 403 404 ReadPCI (((SATA_BUS_DEV_FUN << 16) + SB_SATA_REG04), AccWidthUint8, &dbVar); 405 RWPCI (((SATA_BUS_DEV_FUN << 16) + SB_SATA_REG04), AccWidthUint8,0xFF, 0x03); //memory and io access enable 406 dbEfuse = SATA_FIS_BASE_EFUSE_LOC; >>> CID 1402138: (OVERRUN) >>> Overrunning buffer pointed to by "&dbEfuse" of 1 bytes by passing it to a function which accesses it at byte offset 1. 407 getEfuseStatus (&dbEfuse); 408 409 if ( !cimSataPortMultCap ) { 410 ddAndMask |= BIT12; 411 } 412 if ( cimSataAggrLinkPmCap ) { ** CID 1402137: Memory - corruptions (OVERRUN) ________________________________________________________________________________________________________ *** CID 1402137: Memory - corruptions (OVERRUN) /src/vendorcode/amd/cimx/sb900/SbPeLib.c: 345 in getEfuseByte() 339 UINT8 340 getEfuseByte ( 341 IN UINT8 Index 342 ) 343 { 344 UINT8 Data; >>> CID 1402137: Memory - corruptions (OVERRUN) >>> Overrunning buffer pointed to by "&Index" of 1 bytes by passing it to a function which accesses it at byte offset 1. 345 WriteMEM (ACPI_MMIO_BASE + PMIO_BASE + SB_PMIOA_REGD8, AccWidthUint8, &Index); 346 ReadMEM (ACPI_MMIO_BASE + PMIO_BASE + SB_PMIOA_REGD8 + 1, AccWidthUint8, &Data); 347 return Data; 348 } 349 350 ** CID 1402136: (ARRAY_VS_SINGLETON) /src/vendorcode/amd/agesa/f16kb/Proc/GNB/Modules/GnbPcieConfig/PcieMapTopology.c: 414 in PcieMapTopologyOnWrapper() /src/vendorcode/amd/agesa/f12/Proc/GNB/Modules/GnbPcieConfig/PcieMapTopology.c: 428 in PcieMapTopologyOnWrapper() /src/vendorcode/amd/agesa/f15tn/Proc/GNB/Modules/GnbPcieConfig/PcieMapTopology.c: 414 in PcieMapTopologyOnWrapper() ________________________________________________________________________________________________________ *** CID 1402136: (ARRAY_VS_SINGLETON) /src/vendorcode/amd/agesa/f16kb/Proc/GNB/Modules/GnbPcieConfig/PcieMapTopology.c: 414 in PcieMapTopologyOnWrapper() 408 Status = AGESA_ERROR; 409 AGESA_STATUS_UPDATE (Status, AgesaStatus); 410 } else { 411 WrapperPhyLaneBitMap |= EnginePhyLaneBitMap; 412 } 413 } >>> CID 1402136: (ARRAY_VS_SINGLETON) >>> Using "EngineList" as an array. This might corrupt or misinterpret adjacent memory locations. 414 EngineList = PcieLibGetNextDescriptor (EngineList); 415 } 416 IDS_HDT_CONSOLE (GNB_TRACE, "PcieMapTopologyOnWrapper Exit [%d]\n", AgesaStatus); 417 return AgesaStatus; 418 } 419 /src/vendorcode/amd/agesa/f12/Proc/GNB/Modules/GnbPcieConfig/PcieMapTopology.c: 428 in PcieMapTopologyOnWrapper() 422 Status = AGESA_ERROR; 423 AGESA_STATUS_UPDATE (Status, AgesaStatus); 424 } else { 425 WrapperPhyLaneBitMap |= EnginePhyLaneBitMap; 426 } 427 } >>> CID 1402136: (ARRAY_VS_SINGLETON) >>> Using "EngineList" as an array. This might corrupt or misinterpret adjacent memory locations. 428 EngineList = PcieLibGetNextDescriptor (EngineList); 429 } 430 return AgesaStatus; 431 } 432 433 /src/vendorcode/amd/agesa/f15tn/Proc/GNB/Modules/GnbPcieConfig/PcieMapTopology.c: 414 in PcieMapTopologyOnWrapper() 408 Status = AGESA_ERROR; 409 AGESA_STATUS_UPDATE (Status, AgesaStatus); 410 } else { 411 WrapperPhyLaneBitMap |= EnginePhyLaneBitMap; 412 } 413 } >>> CID 1402136: (ARRAY_VS_SINGLETON) >>> Using "EngineList" as an array. This might corrupt or misinterpret adjacent memory locations. 414 EngineList = PcieLibGetNextDescriptor (EngineList); 415 } 416 IDS_HDT_CONSOLE (GNB_TRACE, "PcieMapTopologyOnWrapper Exit [%d]\n", AgesaStatus); 417 return AgesaStatus; 418 } 419 ** CID 1402135: Insecure data handling (TAINTED_SCALAR) ________________________________________________________________________________________________________ *** CID 1402135: Insecure data handling (TAINTED_SCALAR) /util/cbfstool/cbfstool.c: 1726 in main() 1720 1721 if (commands[i].function == cbfs_create) { 1722 if (param.fmap) { 1723 struct buffer flashmap; 1724 if (buffer_from_file(&flashmap, param.fmap)) 1725 return 1; >>> CID 1402135: Insecure data handling (TAINTED_SCALAR) >>> Passing tainted variable "flashmap.data" to a tainted sink. 1726 param.image_file = partitioned_file_create( 1727 image_name, &flashmap); 1728 buffer_delete(&flashmap); 1729 } else if (param.size) { 1730 param.image_file = partitioned_file_create_flat( 1731 image_name, param.size); ** CID 1402134: (OVERRUN) ________________________________________________________________________________________________________ *** CID 1402134: (OVERRUN) /src/vendorcode/amd/cimx/sb800/SBCMN.c: 982 in softwareToggleImcStrapping() 976 { 977 UINT8 dbValue; 978 UINT8 dbPortStatus; 979 UINT32 abValue; 980 UINT32 abValue1; 981 >>> CID 1402134: (OVERRUN) >>> Overrunning buffer pointed to by "&dbPortStatus" of 1 bytes by passing it to a function which accesses it at byte offset 1. 982 getChipSysMode (&dbPortStatus); 983 984 ReadPMIO (SB_PMIOA_REGBF, AccWidthUint8, &dbValue); 985 //if ( (dbValue & (BIT6 + BIT7)) != 0xC0 ) { // PwrGoodOut =1, PwrGoodEnB=1 986 //The strapStatus register is not mapped into StrapOveride not in the same bit position. The following is difference. 987 /src/vendorcode/amd/cimx/sb900/SbCmn.c: 1248 in softwareToggleImcStrapping() 1242 { 1243 UINT8 dbValue; 1244 UINT8 dbPortStatus; 1245 UINT32 abValue; 1246 UINT32 abValue1; 1247 >>> CID 1402134: (OVERRUN) >>> Overrunning buffer pointed to by "&dbPortStatus" of 1 bytes by passing it to a function which accesses it at byte offset 1. 1248 getChipSysMode (&dbPortStatus); 1249 1250 ReadPMIO (SB_PMIOA_REGBF, AccWidthUint8, &dbValue); 1251 //if ( (dbValue & (BIT6 + BIT7)) != 0xC0 ) { // PwrGoodOut =1, PwrGoodEnB=1 1252 //The strapStatus register is not mapped into StrapOveride not in the same bit position. The following is difference. 1253 ** CID 1402133: (ARRAY_VS_SINGLETON) /src/vendorcode/amd/agesa/f16kb/Proc/GNB/Modules/GnbPcieInitLibV1/PcieTopologyServices.c: 249 in PcieTopologyApplyLaneMux() /src/vendorcode/amd/agesa/f15tn/Proc/GNB/Modules/GnbPcieInitLibV1/PcieTopologyServices.c: 249 in PcieTopologyApplyLaneMux() /src/vendorcode/amd/agesa/f12/Proc/GNB/Modules/GnbPcieInitLibV1/PcieTopologyServices.c: 226 in PcieTopologyApplyLaneMux() ________________________________________________________________________________________________________ *** CID 1402133: (ARRAY_VS_SINGLETON) /src/vendorcode/amd/agesa/f16kb/Proc/GNB/Modules/GnbPcieInitLibV1/PcieTopologyServices.c: 249 in PcieTopologyApplyLaneMux() 243 if (TxLaneMuxSelectorArray [PhyLaneIndex] != CoreLaneIndex) { 244 TxLaneMuxSelectorArray [PcieTopologyLocateMuxIndex (TxLaneMuxSelectorArray, CoreLaneIndex)] = TxLaneMuxSelectorArray [PhyLaneIndex]; 245 TxLaneMuxSelectorArray [PhyLaneIndex] = CoreLaneIndex; 246 } 247 } 248 } >>> CID 1402133: (ARRAY_VS_SINGLETON) >>> Using "EngineList" as an array. This might corrupt or misinterpret adjacent memory locations. 249 EngineList = PcieLibGetNextDescriptor (EngineList); 250 } 251 RxMaxSelectorValue = 0; 252 TxMaxSelectorValue = 0; 253 for (Index = 0; Index < sizeof (LaneMuxSelectorTable); Index++) { 254 RxMaxSelectorValue |= (RxLaneMuxSelectorArray[Index] << (Index * 4)); /src/vendorcode/amd/agesa/f15tn/Proc/GNB/Modules/GnbPcieInitLibV1/PcieTopologyServices.c: 249 in PcieTopologyApplyLaneMux() 243 if (TxLaneMuxSelectorArray [PhyLaneIndex] != CoreLaneIndex) { 244 TxLaneMuxSelectorArray [PcieTopologyLocateMuxIndex (TxLaneMuxSelectorArray, CoreLaneIndex)] = TxLaneMuxSelectorArray [PhyLaneIndex]; 245 TxLaneMuxSelectorArray [PhyLaneIndex] = CoreLaneIndex; 246 } 247 } 248 } >>> CID 1402133: (ARRAY_VS_SINGLETON) >>> Using "EngineList" as an array. This might corrupt or misinterpret adjacent memory locations. 249 EngineList = PcieLibGetNextDescriptor (EngineList); 250 } 251 RxMaxSelectorValue = 0; 252 TxMaxSelectorValue = 0; 253 for (Index = 0; Index < sizeof (LaneMuxSelectorTable); Index++) { 254 RxMaxSelectorValue |= (RxLaneMuxSelectorArray[Index] << (Index * 4)); /src/vendorcode/amd/agesa/f12/Proc/GNB/Modules/GnbPcieInitLibV1/PcieTopologyServices.c: 226 in PcieTopologyApplyLaneMux() 220 if (TxLaneMuxSelectorArray [PhyLaneIndex] != CoreLaneIndex) { 221 TxLaneMuxSelectorArray [PcieTopologyLocateMuxIndex (TxLaneMuxSelectorArray, CoreLaneIndex)] = TxLaneMuxSelectorArray [PhyLaneIndex]; 222 TxLaneMuxSelectorArray [PhyLaneIndex] = CoreLaneIndex; 223 } 224 } 225 } >>> CID 1402133: (ARRAY_VS_SINGLETON) >>> Using "EngineList" as an array. This might corrupt or misinterpret adjacent memory locations. 226 EngineList = PcieLibGetNextDescriptor (EngineList); 227 } 228 RxMaxSelectorValue = 0; 229 TxMaxSelectorValue = 0; 230 for (Index = 0; Index < sizeof (LaneMuxSelectorTable); Index++) { 231 RxMaxSelectorValue |= (RxLaneMuxSelectorArray[Index] << (Index * 4)); ** CID 1402132: (ARRAY_VS_SINGLETON) /src/vendorcode/amd/agesa/f12/Proc/GNB/Modules/GnbPcieConfig/PcieConfigLib.c: 164 in PcieConfigDisableAllEngines() /src/vendorcode/amd/agesa/f15tn/Proc/GNB/Modules/GnbPcieConfig/PcieConfigLib.c: 167 in PcieConfigDisableAllEngines() /src/vendorcode/amd/agesa/f16kb/Proc/GNB/Modules/GnbPcieConfig/PcieConfigLib.c: 167 in PcieConfigDisableAllEngines() ________________________________________________________________________________________________________ *** CID 1402132: (ARRAY_VS_SINGLETON) /src/vendorcode/amd/agesa/f12/Proc/GNB/Modules/GnbPcieConfig/PcieConfigLib.c: 164 in PcieConfigDisableAllEngines() 158 PCIe_ENGINE_CONFIG *EngineList; 159 EngineList = PcieConfigGetChildEngine (Wrapper); 160 while (EngineList != NULL) { 161 if ((EngineList->EngineData.EngineType & EngineTypeMask) != 0) { 162 PcieConfigDisableEngine (EngineList); 163 } >>> CID 1402132: (ARRAY_VS_SINGLETON) >>> Using "EngineList" as an array. This might corrupt or misinterpret adjacent memory locations. 164 EngineList = PcieLibGetNextDescriptor (EngineList); 165 } 166 } 167 168 169 /*----------------------------------------------------------------------------------------*/ /src/vendorcode/amd/agesa/f15tn/Proc/GNB/Modules/GnbPcieConfig/PcieConfigLib.c: 167 in PcieConfigDisableAllEngines() 161 PCIe_ENGINE_CONFIG *EngineList; 162 EngineList = PcieConfigGetChildEngine (Wrapper); 163 while (EngineList != NULL) { 164 if ((EngineList->EngineData.EngineType & EngineTypeMask) != 0) { 165 PcieConfigDisableEngine (EngineList); 166 } >>> CID 1402132: (ARRAY_VS_SINGLETON) >>> Using "EngineList" as an array. This might corrupt or misinterpret adjacent memory locations. 167 EngineList = PcieLibGetNextDescriptor (EngineList); 168 } 169 } 170 171 172 /*----------------------------------------------------------------------------------------*/ /src/vendorcode/amd/agesa/f16kb/Proc/GNB/Modules/GnbPcieConfig/PcieConfigLib.c: 167 in PcieConfigDisableAllEngines() 161 PCIe_ENGINE_CONFIG *EngineList; 162 EngineList = PcieConfigGetChildEngine (Wrapper); 163 while (EngineList != NULL) { 164 if ((EngineList->EngineData.EngineType & EngineTypeMask) != 0) { 165 PcieConfigDisableEngine (EngineList); 166 } >>> CID 1402132: (ARRAY_VS_SINGLETON) >>> Using "EngineList" as an array. This might corrupt or misinterpret adjacent memory locations. 167 EngineList = PcieLibGetNextDescriptor (EngineList); 168 } 169 } 170 171 172 /*----------------------------------------------------------------------------------------*/ ** CID 1402131: Memory - corruptions (OVERRUN) /src/soc/samsung/exynos5420/fimd.c: 358 in exynos_fimd_lcd_init() ________________________________________________________________________________________________________ *** CID 1402131: Memory - corruptions (OVERRUN) /src/soc/samsung/exynos5420/fimd.c: 358 in exynos_fimd_lcd_init() 352 lwritel(cfg, &FIMD_CTRL->vidcon1 + offset); 353 354 /* set timing */ 355 cfg = EXYNOS_VIDTCON0_VFPD(vid->vl_vfpd - 1); 356 cfg |= EXYNOS_VIDTCON0_VBPD(vid->vl_vbpd - 1); 357 cfg |= EXYNOS_VIDTCON0_VSPW(vid->vl_vspw - 1); >>> CID 1402131: Memory - corruptions (OVERRUN) >>> "&(struct exynos_fb *)0x14400000->vidtcon0 + offset" evaluates to an address that is at byte offset 131072 of an array of 624 bytes. 358 lwritel(cfg, &FIMD_CTRL->vidtcon0 + offset); 359 360 cfg = EXYNOS_VIDTCON1_HFPD(vid->vl_hfpd - 1); 361 cfg |= EXYNOS_VIDTCON1_HBPD(vid->vl_hbpd - 1); 362 cfg |= EXYNOS_VIDTCON1_HSPW(vid->vl_hspw - 1); 363 ** CID 1402130: Memory - corruptions (ARRAY_VS_SINGLETON) /src/vendorcode/amd/agesa/f15tn/Proc/GNB/Modules/GnbInitTN/PcieConfigTN.c: 489 in PcieConfigureDdi2EnginesLaneAllocationTN() ________________________________________________________________________________________________________ *** CID 1402130: Memory - corruptions (ARRAY_VS_SINGLETON) /src/vendorcode/amd/agesa/f15tn/Proc/GNB/Modules/GnbInitTN/PcieConfigTN.c: 489 in PcieConfigureDdi2EnginesLaneAllocationTN() 483 } 484 LaneIndex = 0; 485 while (EnginesList != NULL) { 486 PcieConfigResetDescriptorFlags (EnginesList, DESCRIPTOR_ALLOCATED); 487 EnginesList->EngineData.StartLane = Ddi2LaneConfigurationTable [ConfigurationId][LaneIndex++] + Wrapper->StartPhyLane; 488 EnginesList->EngineData.EndLane = Ddi2LaneConfigurationTable [ConfigurationId][LaneIndex++] + Wrapper->StartPhyLane; >>> CID 1402130: Memory - corruptions (ARRAY_VS_SINGLETON) >>> Using "EnginesList" as an array. This might corrupt or misinterpret adjacent memory locations. 489 EnginesList = PcieLibGetNextDescriptor (EnginesList); 490 } 491 return AGESA_SUCCESS; 492 } 493 494 ** CID 1402129: (OVERRUN) ________________________________________________________________________________________________________ *** CID 1402129: (OVERRUN) /src/vendorcode/amd/cimx/sb800/SBPort.c: 186 in sbPowerOnInit() 180 writeAlink (0x34, readAlink (0x34) | BIT9); 181 182 dbEfuse = FUSE_ID_EFUSE_LOC; 183 getEfuseStatus (&dbEfuse); 184 if ( dbEfuse == M1_D1_FUSE_ID ) { 185 dbEfuse = MINOR_ID_EFUSE_LOC; >>> CID 1402129: (OVERRUN) >>> Overrunning buffer pointed to by "&dbEfuse" of 1 bytes by passing it to a function which accesses it at byte offset 1. 186 getEfuseStatus (&dbEfuse); 187 if ( dbEfuse == M1_MINOR_ID ) { 188 // Limit ALink speed to 2.5G if Hudson-M1 189 cimNbSbGen2 = 0; 190 } 191 } /src/vendorcode/amd/cimx/sb900/SBPort.c: 236 in sbPowerOnInit() 230 getEfuseStatus (&dbEfuse); 231 if ( dbEfuse & BIT0 ) { 232 pConfig->NbSbGen2 = 0; 233 } 234 235 dbEfuse = FCH_Variant_EFUSE_LOCATION; >>> CID 1402129: (OVERRUN) >>> Overrunning buffer pointed to by "&dbEfuse" of 1 bytes by passing it to a function which accesses it at byte offset 1. 236 getEfuseStatus (&dbEfuse); 237 if ((dbEfuse == 0x07) || (dbEfuse == 0x08)) { 238 pConfig->NbSbGen2 = 0; 239 } 240 241 if (pConfig->NbSbGen2) { /src/vendorcode/amd/cimx/sb900/SBPort.c: 284 in sbPowerOnInit() 278 RWMEM (ACPI_MMIO_BASE + PMIO_BASE + SB_PMIOA_REG2E, AccWidthUint8, ~(BIT1 + BIT2), 0); //clear BIT[2:1] 279 smbusBase = (UINT16) (pConfig->BuildParameters.Smbus0BaseAddress); 280 dbValue = 0x00; 281 WriteIO (smbusBase + 0x14, AccWidthUint8, &dbValue); 282 283 dbEfuse = SATA_FIS_BASE_EFUSE_LOC; >>> CID 1402129: (OVERRUN) >>> Overrunning buffer pointed to by "&dbEfuse" of 1 bytes by passing it to a function which accesses it at byte offset 1. 284 getEfuseStatus (&dbEfuse); 285 286 programSbAcpiMmioTbl ((AcpiRegWrite*) FIXUP_PTR (&sbPmioPorInitTable[0])); 287 288 //RPR 3.4 Enabling ClkRun Function 289 RWPCI ((LPC_BUS_DEV_FUN << 16) + SB_LPC_REGBB, AccWidthUint8, ~ BIT2, BIT2); /src/vendorcode/amd/cimx/sb900/SBPort.c: 230 in sbPowerOnInit() 224 //abValue = readAlink (SB_AX_DATAC_REG34 | (UINT32) (AXINDC << 29)); 225 //abValue |= BIT6 + BIT5; 226 //writeAlink (SB_AX_DATAC_REG34 | (UINT32) (AXINDC << 29), abValue); 227 228 // Configure UMI target link speed 229 dbEfuse = PCIE_FORCE_GEN1_EFUSE_LOCATION; >>> CID 1402129: (OVERRUN) >>> Overrunning buffer pointed to by "&dbEfuse" of 1 bytes by passing it to a function which accesses it at byte offset 1. 230 getEfuseStatus (&dbEfuse); 231 if ( dbEfuse & BIT0 ) { 232 pConfig->NbSbGen2 = 0; 233 } 234 235 dbEfuse = FCH_Variant_EFUSE_LOCATION; /src/vendorcode/amd/cimx/sb800/SBPort.c: 228 in sbPowerOnInit() 222 RWMEM (ACPI_MMIO_BASE + PMIO_BASE + SB_PMIOA_REG6A, AccWidthUint16, 00, (pConfig->BuildParameters.SmiCmdPortAddr)); 223 RWMEM (ACPI_MMIO_BASE + PMIO_BASE + SB_PMIOA_REG6C, AccWidthUint16, 00, (pConfig->BuildParameters.AcpiPmaCntBlkAddr)); 224 RWMEM (ACPI_MMIO_BASE + PMIO_BASE + SB_PMIOA_REG6E, AccWidthUint16, 00, (pConfig->BuildParameters.SmiCmdPortAddr) + 8); 225 RWMEM (ACPI_MMIO_BASE + PMIO_BASE + SB_PMIOA_REG48, AccWidthUint32, 00, (pConfig->BuildParameters.WatchDogTimerBase)); 226 227 dbEfuse = SATA_FIS_BASE_EFUSE_LOC; >>> CID 1402129: (OVERRUN) >>> Overrunning buffer pointed to by "&dbEfuse" of 1 bytes by passing it to a function which accesses it at byte offset 1. 228 getEfuseStatus (&dbEfuse); 229 230 programSbAcpiMmioTbl ((AcpiRegWrite*) FIXUP_PTR (&sbPmioPorInitTable[0])); 231 232 233 SataPortNum = 0; /src/vendorcode/amd/cimx/sb800/SBPort.c: 183 in sbPowerOnInit() 177 abValue = abValue | BIT0; 178 writeAlink (SB_ABCFG_REG9C | (UINT32) (ABCFG << 29), abValue); 179 writeAlink (0x30, 0x10); // AXINDC 0x10[9]=1, Enabling Non-Posted memory write for K8 platform. 180 writeAlink (0x34, readAlink (0x34) | BIT9); 181 182 dbEfuse = FUSE_ID_EFUSE_LOC; >>> CID 1402129: (OVERRUN) >>> Overrunning buffer pointed to by "&dbEfuse" of 1 bytes by passing it to a function which accesses it at byte offset 1. 183 getEfuseStatus (&dbEfuse); 184 if ( dbEfuse == M1_D1_FUSE_ID ) { 185 dbEfuse = MINOR_ID_EFUSE_LOC; 186 getEfuseStatus (&dbEfuse); 187 if ( dbEfuse == M1_MINOR_ID ) { 188 // Limit ALink speed to 2.5G if Hudson-M1 ** CID 1402128: API usage errors (PRINTF_ARGS) ________________________________________________________________________________________________________ *** CID 1402128: API usage errors (PRINTF_ARGS) /3rdparty/vboot/cgpt/cgpt_create.c: 18 in AllocAndClear() 12 static void AllocAndClear(uint8_t **buf, uint64_t size) { 13 if (*buf) { 14 memset(*buf, 0, size); 15 } else { 16 *buf = calloc(1, size); 17 if (!*buf) { >>> CID 1402128: API usage errors (PRINTF_ARGS) >>> Argument "size" to format specifier "%u" was expected to have type "unsigned int" but has type "unsigned long". 18 Error("Cannot allocate %u bytes.\n", size); 19 abort(); 20 } 21 } 22 } 23 ** CID 1402126: (ARRAY_VS_SINGLETON) /src/vendorcode/amd/agesa/f16kb/Proc/GNB/Modules/GnbPcieConfig/PcieConfigLib.c: 242 in PcieConfigGetConfigurationSignature() /src/vendorcode/amd/agesa/f15tn/Proc/GNB/Modules/GnbPcieConfig/PcieConfigLib.c: 242 in PcieConfigGetConfigurationSignature() /src/vendorcode/amd/agesa/f12/Proc/GNB/Modules/GnbPcieConfig/PcieConfigLib.c: 239 in PcieConfigGetConfigurationSignature() ________________________________________________________________________________________________________ *** CID 1402126: (ARRAY_VS_SINGLETON) /src/vendorcode/amd/agesa/f16kb/Proc/GNB/Modules/GnbPcieConfig/PcieConfigLib.c: 242 in PcieConfigGetConfigurationSignature() 236 ConfigurationSignature = 0; 237 EngineList = PcieConfigGetChildEngine (Wrapper); 238 while (EngineList != NULL) { 239 if (PcieConfigIsPcieEngine (EngineList) && EngineList->Type.Port.CoreId == CoreId) { 240 ConfigurationSignature = (ConfigurationSignature << 8) | PcieConfigGetNumberOfCoreLane (EngineList); 241 } >>> CID 1402126: (ARRAY_VS_SINGLETON) >>> Using "EngineList" as an array. This might corrupt or misinterpret adjacent memory locations. 242 EngineList = PcieLibGetNextDescriptor (EngineList); 243 } 244 return ConfigurationSignature; 245 } 246 247 /*----------------------------------------------------------------------------------------*/ /src/vendorcode/amd/agesa/f15tn/Proc/GNB/Modules/GnbPcieConfig/PcieConfigLib.c: 242 in PcieConfigGetConfigurationSignature() 236 ConfigurationSignature = 0; 237 EngineList = PcieConfigGetChildEngine (Wrapper); 238 while (EngineList != NULL) { 239 if (PcieConfigIsPcieEngine (EngineList) && EngineList->Type.Port.CoreId == CoreId) { 240 ConfigurationSignature = (ConfigurationSignature << 8) | PcieConfigGetNumberOfCoreLane (EngineList); 241 } >>> CID 1402126: (ARRAY_VS_SINGLETON) >>> Using "EngineList" as an array. This might corrupt or misinterpret adjacent memory locations. 242 EngineList = PcieLibGetNextDescriptor (EngineList); 243 } 244 return ConfigurationSignature; 245 } 246 247 /*----------------------------------------------------------------------------------------*/ /src/vendorcode/amd/agesa/f12/Proc/GNB/Modules/GnbPcieConfig/PcieConfigLib.c: 239 in PcieConfigGetConfigurationSignature() 233 ConfigurationSignature = 0; 234 EngineList = PcieConfigGetChildEngine (Wrapper); 235 while (EngineList != NULL) { 236 if (EngineList->Type.Port.CoreId == CoreId) { 237 ConfigurationSignature = (ConfigurationSignature << 8) | PcieConfigGetNumberOfCoreLane (EngineList); 238 } >>> CID 1402126: (ARRAY_VS_SINGLETON) >>> Using "EngineList" as an array. This might corrupt or misinterpret adjacent memory locations. 239 EngineList = PcieLibGetNextDescriptor (EngineList); 240 } 241 return ConfigurationSignature; 242 } 243 244 /*----------------------------------------------------------------------------------------*/ ** CID 1402125: (ARRAY_VS_SINGLETON) /src/vendorcode/amd/agesa/f15tn/Proc/GNB/Modules/GnbPcieInitLibV1/PcieTopologyServices.c: 474 in PcieTopologySetLinkReversal() /src/vendorcode/amd/agesa/f12/Proc/GNB/Modules/GnbPcieInitLibV1/PcieTopologyServices.c: 441 in PcieTopologySetLinkReversal() /src/vendorcode/amd/agesa/f16kb/Proc/GNB/Modules/GnbPcieInitLibV1/PcieTopologyServices.c: 474 in PcieTopologySetLinkReversal() ________________________________________________________________________________________________________ *** CID 1402125: (ARRAY_VS_SINGLETON) /src/vendorcode/amd/agesa/f15tn/Proc/GNB/Modules/GnbPcieInitLibV1/PcieTopologyServices.c: 474 in PcieTopologySetLinkReversal() 468 FALSE, 469 Pcie 470 ); 471 } 472 } 473 } >>> CID 1402125: (ARRAY_VS_SINGLETON) >>> Using "EngineList" as an array. This might corrupt or misinterpret adjacent memory locations. 474 EngineList = PcieLibGetNextDescriptor (EngineList); 475 } 476 IDS_HDT_CONSOLE (GNB_TRACE, "PcieTopologySetLinkReversal Exit\n"); 477 } 478 479 /src/vendorcode/amd/agesa/f12/Proc/GNB/Modules/GnbPcieInitLibV1/PcieTopologyServices.c: 441 in PcieTopologySetLinkReversal() 435 FALSE, 436 Pcie 437 ); 438 } 439 } 440 } >>> CID 1402125: (ARRAY_VS_SINGLETON) >>> Using "EngineList" as an array. This might corrupt or misinterpret adjacent memory locations. 441 EngineList = PcieLibGetNextDescriptor (EngineList); 442 } 443 IDS_HDT_CONSOLE (GNB_TRACE, "PcieTopologySetLinkReversal Exit\n"); 444 } 445 446 /src/vendorcode/amd/agesa/f16kb/Proc/GNB/Modules/GnbPcieInitLibV1/PcieTopologyServices.c: 474 in PcieTopologySetLinkReversal() 468 FALSE, 469 Pcie 470 ); 471 } 472 } 473 } >>> CID 1402125: (ARRAY_VS_SINGLETON) >>> Using "EngineList" as an array. This might corrupt or misinterpret adjacent memory locations. 474 EngineList = PcieLibGetNextDescriptor (EngineList); 475 } 476 IDS_HDT_CONSOLE (GNB_TRACE, "PcieTopologySetLinkReversal Exit\n"); 477 } 478 479 ** CID 1402124: Memory - corruptions (OVERRUN) /src/soc/samsung/exynos5420/fimd.c: 364 in exynos_fimd_lcd_init() ________________________________________________________________________________________________________ *** CID 1402124: Memory - corruptions (OVERRUN) /src/soc/samsung/exynos5420/fimd.c: 364 in exynos_fimd_lcd_init() 358 lwritel(cfg, &FIMD_CTRL->vidtcon0 + offset); 359 360 cfg = EXYNOS_VIDTCON1_HFPD(vid->vl_hfpd - 1); 361 cfg |= EXYNOS_VIDTCON1_HBPD(vid->vl_hbpd - 1); 362 cfg |= EXYNOS_VIDTCON1_HSPW(vid->vl_hspw - 1); 363 >>> CID 1402124: Memory - corruptions (OVERRUN) >>> "&(struct exynos_fb *)0x14400000->vidtcon1 + offset" evaluates to an address that is at byte offset 131072 of an array of 620 bytes. 364 lwritel(cfg, &FIMD_CTRL->vidtcon1 + offset); 365 366 /* set lcd size */ 367 cfg = EXYNOS_VIDTCON2_HOZVAL(vid->vl_col - 1) | 368 EXYNOS_VIDTCON2_LINEVAL(vid->vl_row - 1) | 369 EXYNOS_VIDTCON2_HOZVAL_E(vid->vl_col - 1) | ** CID 1402123: Memory - illegal accesses (OVERRUN) /3rdparty/arm-trusted-firmware/lib/pmf/pmf_main.c: 100 in pmf_setup() ________________________________________________________________________________________________________ *** CID 1402123: Memory - illegal accesses (OVERRUN) /3rdparty/arm-trusted-firmware/lib/pmf/pmf_main.c: 100 in pmf_setup() 94 /* 95 * Sort the successfully registered PMF services 96 * according to service ID 97 */ 98 for (ii = 1; ii < pmf_num_services; ii++) { 99 for (jj = 0; jj < (pmf_num_services - ii); jj++) { >>> CID 1402123: Memory - illegal accesses (OVERRUN) >>> Overrunning array of 8 bytes at byte offset 40 by dereferencing pointer "pmf_svc_descs + (jj + 1)". 100 if ((pmf_svc_descs[jj].svc_config & PMF_SVC_ID_MASK) > 101 (pmf_svc_descs[jj + 1].svc_config & 102 PMF_SVC_ID_MASK)) { 103 temp_val = pmf_svc_descs_indices[jj]; 104 pmf_svc_descs_indices[jj] = 105 pmf_svc_descs_indices[jj+1]; ** CID 1402122: Insecure data handling (TAINTED_SCALAR) /util/cbfstool/cbfs_image.c: 1325 in cbfs_export_entry() ________________________________________________________________________________________________________ *** CID 1402122: Insecure data handling (TAINTED_SCALAR) /util/cbfstool/cbfs_image.c: 1325 in cbfs_export_entry() 1319 LOG("Found file %.30s at 0x%x, type %.12s, compressed %d, size %d\n", 1320 entry_name, cbfs_get_entry_addr(image, entry), 1321 get_cbfs_entry_type_name(ntohl(entry->type)), compressed_size, 1322 decompressed_size); 1323 1324 buffer_init(&buffer, strdup("(cbfs_export_entry)"), NULL, 0); >>> CID 1402122: Insecure data handling (TAINTED_SCALAR) >>> Passing tainted variable "buffer_len" to a tainted sink. [Note: The source code implementation of the function has been overridden by a builtin model.] 1325 buffer.data = malloc(buffer_len); 1326 buffer.size = buffer_len; 1327 1328 if (decompress(CBFS_SUBHEADER(entry), compressed_size, 1329 buffer.data, buffer.size, NULL)) { 1330 ERROR("decompression failed for %s\n", entry_name); ** CID 1402121: Memory - corruptions (OVERRUN) ________________________________________________________________________________________________________ *** CID 1402121: Memory - corruptions (OVERRUN) /src/vendorcode/amd/cimx/sb800/SBPort.c: 285 in sbPowerOnInit() 279 WriteIO (SB_IOMAP_REG71, AccWidthUint8, &dbValue); 280 281 // Change the CG PLL multiplier to x1.1 282 if ( pConfig->UsbRxMode !=0 ) { 283 dbCg2WR = 0x00; 284 dbCg1Pll = 0x3A; >>> CID 1402121: Memory - corruptions (OVERRUN) >>> Overrunning buffer pointed to by "&dbCg2WR" of 1 bytes by passing it to a function which accesses it at byte offset 1. 285 ReadMEM (ACPI_MMIO_BASE + PMIO_BASE + SB_PMIOA_REGC8, AccWidthUint8, &dbCg2WR); 286 RWMEM (ACPI_MMIO_BASE + PMIO_BASE + SB_PMIOA_REGD8, AccWidthUint8, 0, 0x3A); 287 ReadMEM (ACPI_MMIO_BASE + PMIO_BASE + SB_PMIOA_REGD9, AccWidthUint8, &dbCg1Pll); 288 dbCg2WR &= BIT4; 289 if (( dbCg2WR == 0x00 ) && ( dbCg1Pll !=0x10 )) 290 { ** CID 1402120: (ARRAY_VS_SINGLETON) /src/vendorcode/amd/agesa/f12/Proc/GNB/Modules/GnbPcieInitLibV1/PcieSiliconServices.c: 232 in PcieSiliconHidePorts() /src/vendorcode/amd/agesa/f15tn/Proc/GNB/Modules/GnbPcieInitLibV1/PcieSiliconServices.c: 233 in PcieSiliconHidePorts() ________________________________________________________________________________________________________ *** CID 1402120: (ARRAY_VS_SINGLETON) /src/vendorcode/amd/agesa/f12/Proc/GNB/Modules/GnbPcieInitLibV1/PcieSiliconServices.c: 232 in PcieSiliconHidePorts() 226 if (!PcieConfigCheckPortStatus (EngineList, INIT_STATUS_PCIE_TRAINING_SUCCESS) && 227 ((EngineList->Type.Port.PortData.LinkHotplug == HotplugDisabled) || (EngineList->Type.Port.PortData.LinkHotplug == HotplugInboard)) && 228 !PcieConfigIsSbPcieEngine (EngineList)) { 229 D0F0x64_x0C.Value |= 1 << EngineList->Type.Port.NativeDevNumber; 230 } 231 } >>> CID 1402120: (ARRAY_VS_SINGLETON) >>> Using "EngineList" as an array. This might corrupt or misinterpret adjacent memory locations. 232 EngineList = PcieLibGetNextDescriptor (EngineList); 233 } 234 WrapperList = PcieLibGetNextDescriptor (WrapperList); 235 } 236 237 GnbLibPciIndirectRMW ( /src/vendorcode/amd/agesa/f15tn/Proc/GNB/Modules/GnbPcieInitLibV1/PcieSiliconServices.c: 233 in PcieSiliconHidePorts() 227 while (EngineList != NULL) { 228 if (PcieConfigIsPcieEngine (EngineList)) { 229 if (PcieConfigIsActivePcieEngine (EngineList) && !PcieConfigIsSbPcieEngine (EngineList)) { 230 D0F0x64_x0C.Value &= ~(1 << EngineList->Type.Port.Address.Address.Device); 231 } 232 } >>> CID 1402120: (ARRAY_VS_SINGLETON) >>> Using "EngineList" as an array. This might corrupt or misinterpret adjacent memory locations. 233 EngineList = PcieLibGetNextDescriptor (EngineList); 234 } 235 WrapperList = PcieLibGetNextDescriptor (WrapperList); 236 } 237 238 GnbLibPciIndirectRMW ( ** CID 1402119: Memory - corruptions (ARRAY_VS_SINGLETON) /src/vendorcode/amd/agesa/f16kb/Proc/GNB/Modules/GnbInitKB/PcieLibKB.c: 416 in PcieTopologySelectMasterPllKB() ________________________________________________________________________________________________________ *** CID 1402119: Memory - corruptions (ARRAY_VS_SINGLETON) /src/vendorcode/amd/agesa/f16kb/Proc/GNB/Modules/GnbInitKB/PcieLibKB.c: 416 in PcieTopologySelectMasterPllKB() 410 MasterLane = (EngineMasterLane < MasterLane) ? EngineMasterLane : MasterLane; 411 if (PcieConfigIsSbPcieEngine (EngineList)) { 412 break; 413 } 414 } 415 } >>> CID 1402119: Memory - corruptions (ARRAY_VS_SINGLETON) >>> Using "EngineList" as an array. This might corrupt or misinterpret adjacent memory locations. 416 EngineList = PcieLibGetNextDescriptor (EngineList); 417 } 418 419 if (MasterLane == 0xffff) { 420 if (MasterHotplugLane != 0xffff) { 421 MasterLane = MasterHotplugLane; ** CID 1402118: (OVERRUN) ________________________________________________________________________________________________________ *** CID 1402118: (OVERRUN) /src/vendorcode/amd/cimx/sb900/SbCmn.c: 1219 in validateImcFirmware() 1213 ReadMEM ((ImcAddr + 0x2000), AccWidthUint32, &ImcBinSig0); 1214 ReadMEM ((ImcAddr + 0x2004), AccWidthUint32, &ImcBinSig1); 1215 ReadMEM ((ImcAddr + 0x2008), AccWidthUint16, &ImcBinSig2); 1216 if ((ImcBinSig0 == 0x444D415F) && (ImcBinSig1 == 0x434D495F) && (ImcBinSig2 == 0x435F) ) { 1217 dbIMCChecksume = 0; 1218 for ( CurAddr = ImcAddr; CurAddr < ImcAddr + 0x10000; CurAddr++ ) { >>> CID 1402118: (OVERRUN) >>> Overrunning buffer pointed to by "&dbIMC" of 1 bytes by passing it to a function which accesses it at byte offset 1. 1219 ReadMEM (CurAddr, AccWidthUint8, &dbIMC); 1220 dbIMCChecksume = dbIMCChecksume + dbIMC; 1221 } 1222 } 1223 } 1224 if ( dbIMCChecksume ) { /src/vendorcode/amd/cimx/sb800/SBCMN.c: 953 in validateImcFirmware() 947 ReadMEM ((ImcAddr + 0x2000), AccWidthUint32, &ImcBinSig0); 948 ReadMEM ((ImcAddr + 0x2004), AccWidthUint32, &ImcBinSig1); 949 ReadMEM ((ImcAddr + 0x2008), AccWidthUint16, &ImcBinSig2); 950 if ((ImcBinSig0 == 0x444D415F) && (ImcBinSig1 == 0x434D495F) && (ImcBinSig2 == 0x435F) ) { 951 dbIMCChecksume = 0; 952 for ( CurAddr = ImcAddr; CurAddr < ImcAddr + 0x10000; CurAddr++ ) { >>> CID 1402118: (OVERRUN) >>> Overrunning buffer pointed to by "&dbIMC" of 1 bytes by passing it to a function which accesses it at byte offset 1. 953 ReadMEM (CurAddr, AccWidthUint8, &dbIMC); 954 dbIMCChecksume = dbIMCChecksume + dbIMC; 955 } 956 } 957 } 958 if ( dbIMCChecksume ) { ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V0…

1 0

Unresolved comments on Gerrit
by Patrick Georgi July 25, 2019

July 25, 2019

Hi everybody, you might notice a new column in the Gerrit UI: ACR for All-Comments-Resolved. For a while, Gerrit allows to "resolve" comments made to changes, and this field automatically determines if all comments are marked that way. Another change to our Gerrit install is that changes can only be submitted when there are no more open comments. For this reason, please ensure to close comments you consider done. Thanks, Patrick -- Google Germany GmbH, ABC-Str. 19, 20354 Hamburg Registergericht und -nummer: Hamburg, HRB 86891, Sitz der Gesellschaft: Hamburg Geschäftsführer: Paul Manicle, Halimah DeLaine Prado

2 1