Chainloading Windows from a Linux Payload
by Matt B
Greetings,
From what I can find, Linux can only chainload another linux kernel. (via
kexec) Does this mean that a Linux payload like LinuxBoot cannot be used to
boot Windows or another OS, either directly or by chainloading another
payload from CBFS?
It's nice that a Linux payload can provide superior flexibility and
configurability than UEFI with the added benefit of a battle-hardened
environment, but the ability to only boot a Linux OS seems like a pretty
significant limitation (if this is indeed the case).
Sincerely,
-Matt
1 month, 3 weeks
- 7
- 12
Abandoning ~250 coreboot patches older than 18 months
by Martin Roth
It's patch cleanup time again. This cleanup was last done almost 2
years ago, so there are a lot of old patches that haven't been touched
in a while.
Next week I'm going to abandon all of the open patches that haven't
been touched in over 18 months.
The list of roughly 250 patches to be abandoned is here:
https://review.coreboot.org/q/status:open+before:2018-02-1+project:coreboot
If anyone wants to take over any of these patches, just mention it in
the patch and if the author doesn't respond in a day or two, feel free
to let them know that you've adopted the patch.
As always, if there's anything that is still useful and shouldn't be
abandoned, a comment in the patch is enough to keep it alive in
gerrit.
Martin
2 months, 1 week
- 1
- 1
KGPE-d16 recent microcode (Adds IBPB) produces kernel panics
by Kinky Nekoboi
loading the microcode via Linux Kernel works.
including it via coreboot causes General Protection Faults.
See included bootlog.
2 months, 2 weeks
- 3
- 3
2 months, 2 weeks
- 1
- 0
KGPE-D16: using linux kernel with SLUB MEM_ALLOCATOR -> KERNEL SPINLOCK PANIC
by Kinky Nekoboi
not sure if coreboot or kernel related.
vanila kernel 4.19.62 with SLAB allocater build works fine.
Debians Busters default kernel 4.19.x with SLUB panics.
see:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=930029
see Bootlog:
oading Linux 4.19.0-5-amd64 ...Loading Linux 4.19.0-5-amd64 ..
.
Loading initial ramdisk ...Loading initial ramdisk ..
.
[ 0.000000] Linux version 4.19.0-5-amd64
(debian-kernel(a)lists.debian.org) (g)
[ 0.000000] Command line: BOOT_IMAGE=/boot/vmlinuz-4.19.0-5-amd64
root=UUID=0
[ 0.000000] random: get_random_u32 called from
bsp_init_amd+0x20b/0x2b0 with0
[ 0.000000] x86/fpu: Supporting XSAVE feature 0x001: 'x87 floating
point reg'
[ 0.000000] x86/fpu: Supporting XSAVE feature 0x002: 'SSE registers'
[ 0.000000] x86/fpu: Supporting XSAVE feature 0x004: 'AVX registers'
[ 0.000000] x86/fpu: xstate_offset[2]: 576, xstate_sizes[2]: 256
[ 0.000000] x86/fpu: Enabled xstate features 0x7, context size is 832
bytes,.
[ 0.000000] BIOS-provided physical RAM map:
[ 0.000000] BIOS-e820: [mem 0x0000000000000000-0x000000000009fbff] usable
[ 0.000000] BIOS-e820: [mem 0x000000000009fc00-0x000000000009ffff]
reserved
[ 0.000000] BIOS-e820: [mem 0x00000000000f0000-0x00000000000fffff]
reserved
[ 0.000000] BIOS-e820: [mem 0x0000000000100000-0x00000000b7d97fff] usable
[ 0.000000] BIOS-e820: [mem 0x00000000b7d98000-0x00000000b7ffffff]
reserved
[ 0.000000] BIOS-e820: [mem 0x00000000b8000000-0x00000000bfffafff] usable
[ 0.000000] BIOS-e820: [mem 0x00000000bfffb000-0x00000000cfffffff]
reserved
[ 0.000000] BIOS-e820: [mem 0x00000000fcf00000-0x00000000fcf03fff]
reserved
[ 0.000000] BIOS-e820: [mem 0x00000000feb00000-0x00000000feb00fff]
reserved
[ 0.000000] BIOS-e820: [mem 0x00000000fec00000-0x00000000fec00fff]
reserved
[ 0.000000] BIOS-e820: [mem 0x00000000fed00000-0x00000000fed00fff]
reserved
[ 0.000000] BIOS-e820: [mem 0x00000000fed40000-0x00000000fed44fff]
reserved
[ 0.000000] BIOS-e820: [mem 0x0000000100000000-0x0000000437ffffff] usable
[ 0.000000] BIOS-e820: [mem 0x0000000438000000-0x000000043fffffff]
reserved
[ 0.000000] bootconsole [earlyser0] enabled
[ 0.000000] NX (Execute Disable) protection: active
[ 0.000000] SMBIOS 2.7 present.
[ 0.000000] DMI: ASUS KGPE-D16/KGPE-D16, BIOS 4.9-1859-gf3510cbe36
05/31/2019
[ 0.000000] tsc: Fast TSC calibration using PIT
[ 0.000000] tsc: Detected 2500.121 MHz processor
[ 0.010404] AGP: No AGP bridge found
[ 0.013881] last_pfn = 0x438000 max_arch_pfn = 0x400000000
[ 0.021404] x86/PAT: Configuration [0-7]: WB WC UC- UC WB WP UC-
WT
Memory KASLR using RDTSC...
[ 0.030856] last_pfn = 0xbfffb max_arch_pfn = 0x400000000
[ 0.042030] Using GB pages for direct mapping
[ 0.046429] RAMDISK: [mem 0x3476f000-0x363aefff]
[ 0.050877] ACPI: Early table checksum verification disabled
[ 0.056563] ACPI: RSDP 0x00000000000F6250 000024 (v02 COREv4)
[ 0.062225] ACPI: XSDT 0x00000000B7D990E0 000074 (v01 COREv4 COREBOOT
000000)
[ 0.070720] ACPI: FACP 0x00000000B7D9B9A0 0000F4 (v03 COREv4 COREBOOT
000000)
[ 0.079213] ACPI: DSDT 0x00000000B7D99280 00271A (v02 COREv4 COREBOOT
000000)
[ 0.087704] ACPI: FACS 0x00000000B7D99240 000040
[ 0.092298] ACPI: FACS 0x00000000B7D99240 000040
[ 0.096890] ACPI: SSDT 0x00000000B7D9BAA0 0020F2 (v02 COREv4 COREBOOT
000000)
[ 0.105383] ACPI: MCFG 0x00000000B7D9DBA0 00003C (v01 COREv4 COREBOOT
000000)
[ 0.113875] ACPI: APIC 0x00000000B7D9DBE0 0000DE (v02 COREv4 COREBOOT
000000)
[ 0.122369] ACPI: SRAT 0x00000000B7D9DCC0 0001A8 (v01 COREv4 COREBOOT
000000)
[ 0.130862] ACPI: SLIT 0x00000000B7D9DE68 000030 (v01 COREv4 COREBOOT
000000)
[ 0.139355] ACPI: SRAT 0x00000000B7D9DEA0 0001A8 (v01 COREv4 COREBOOT
000000)
[ 0.147848] ACPI: SLIT 0x00000000B7D9E048 000030 (v01 COREv4 COREBOOT
000000)
[ 0.156341] ACPI: IVRS 0x00000000B7D9E080 0000BC (v01 COREv4 COREBOOT
000000)
[ 0.164834] ACPI: HPET 0x00000000B7D9E140 000038 (v01 COREv4 COREBOOT
000000)
[ 0.173380] SRAT: PXM 0 -> APIC 0x00 -> Node 0
[ 0.177747] SRAT: PXM 0 -> APIC 0x01 -> Node 0
[ 0.182167] SRAT: PXM 0 -> APIC 0x02 -> Node 0
[ 0.186586] SRAT: PXM 0 -> APIC 0x03 -> Node 0
[ 0.191006] SRAT: PXM 0 -> APIC 0x04 -> Node 0
[ 0.195426] SRAT: PXM 0 -> APIC 0x05 -> Node 0
[ 0.199845] SRAT: PXM 0 -> APIC 0x06 -> Node 0
[ 0.204264] SRAT: PXM 0 -> APIC 0x07 -> Node 0
[ 0.208685] SRAT: PXM 1 -> APIC 0x08 -> Node 1
[ 0.213104] SRAT: PXM 1 -> APIC 0x09 -> Node 1
[ 0.217525] SRAT: PXM 1 -> APIC 0x0a -> Node 1
[ 0.221944] SRAT: PXM 1 -> APIC 0x0b -> Node 1
[ 0.226364] SRAT: PXM 1 -> APIC 0x0c -> Node 1
[ 0.230784] SRAT: PXM 1 -> APIC 0x0d -> Node 1
[ 0.235204] SRAT: PXM 1 -> APIC 0x0e -> Node 1
[ 0.239624] SRAT: PXM 1 -> APIC 0x0f -> Node 1
[ 0.244046] ACPI: SRAT: Node 0 PXM 0 [mem 0x00000000-0x0009ffff]
[ 0.250025] ACPI: SRAT: Node 1 PXM 1 [mem 0x00100000-0xbfffffff]
[ 0.256004] ACPI: SRAT: Node 1 PXM 1 [mem 0x100000000-0x43fffffff]
[ 0.262162] NUMA: Node 1 [mem 0x00100000-0xbfffffff] + [mem
0x100000000-0x43]
[ 0.272647] NODE_DATA(1) allocated [mem 0x437ff8000-0x437ffcfff]
[ 0.278660] node 0 must be removed before remove section 134
[ 0.284272] Zone ranges:
[ 0.286769] DMA [mem 0x0000000000001000-0x0000000000ffffff]
[ 0.292922] DMA32 [mem 0x0000000001000000-0x00000000ffffffff]
[ 0.299075] Normal [mem 0x0000000100000000-0x0000000437ffffff]
[ 0.305228] Device empty
[ 0.308088] Movable zone start for each node
[ 0.312335] Early memory node ranges
[ 0.315888] node 0: [mem 0x0000000000001000-0x000000000009efff]
[ 0.322128] node 1: [mem 0x0000000000100000-0x00000000b7d97fff]
[ 0.328368] node 1: [mem 0x00000000b8000000-0x00000000bfffafff]
[ 0.334607] node 1: [mem 0x0000000100000000-0x0000000437ffffff]
[ 0.340850] Reserved but unavailable: 98 pages
[ 0.340852] Initmem setup node 1 [mem
0x0000000000100000-0x0000000437ffffff]
[ 0.466889] ACPI: PM-Timer IO Port: 0x820
[ 0.470732] ACPI: LAPIC_NMI (acpi_id[0xff] dfl dfl lint[0x1])
[ 0.476453] IOAPIC[0]: apic_id 32, version 33, address 0xfec00000,
GSI 0-23
[ 0.483376] IOAPIC[1]: apic_id 33, version 33, address 0xfd000000,
GSI 24-55
[ 0.490395] ACPI: INT_SRC_OVR (bus 0 bus_irq 0 global_irq 2 dfl dfl)
[ 0.496721] ACPI: INT_SRC_OVR (bus 0 bus_irq 9 global_irq 9 low level)
[ 0.503224] Using ACPI (MADT) for SMP configuration information
[ 0.509114] ACPI: HPET id: 0x43538301 base: 0xfed00000
[ 0.514232] smpboot: Allowing 16 CPUs, 0 hotplug CPUs
[ 0.519255] NODE_DATA(0) allocated [mem 0x00093000-0x00097fff]
[ 0.525066] Initmem setup node 0 [mem
0x0000000000001000-0x000000000009efff]
[ 0.532110] PM: Registered nosave memory: [mem 0x00000000-0x00000fff]
[ 0.538492] PM: Registered nosave memory: [mem 0x0009f000-0x0009ffff]
[ 0.544905] PM: Registered nosave memory: [mem 0x000a0000-0x000effff]
[ 0.551318] PM: Registered nosave memory: [mem 0x000f0000-0x000fffff]
[ 0.557733] PM: Registered nosave memory: [mem 0xb7d98000-0xb7ffffff]
[ 0.564146] PM: Registered nosave memory: [mem 0xbfffb000-0xcfffffff]
[ 0.570558] PM: Registered nosave memory: [mem 0xd0000000-0xfcefffff]
[ 0.576971] PM: Registered nosave memory: [mem 0xfcf00000-0xfcf03fff]
[ 0.583384] PM: Registered nosave memory: [mem 0xfcf04000-0xfeafffff]
[ 0.589797] PM: Registered nosave memory: [mem 0xfeb00000-0xfeb00fff]
[ 0.596209] PM: Registered nosave memory: [mem 0xfeb01000-0xfebfffff]
[ 0.602622] PM: Registered nosave memory: [mem 0xfec00000-0xfec00fff]
[ 0.609035] PM: Registered nosave memory: [mem 0xfec01000-0xfecfffff]
[ 0.615449] PM: Registered nosave memory: [mem 0xfed00000-0xfed00fff]
[ 0.621862] PM: Registered nosave memory: [mem 0xfed01000-0xfed3ffff]
[ 0.628275] PM: Registered nosave memory: [mem 0xfed40000-0xfed44fff]
[ 0.634688] PM: Registered nosave memory: [mem 0xfed45000-0xffffffff]
[ 0.641103] [mem 0xd0000000-0xfcefffff] available for PCI devices
[ 0.647167] Booting paravirtualized kernel on bare hardware
[ 0.652717] clocksource: refined-jiffies: mask: 0xffffffff
max_cycles: 0xfffs
[ 0.795517] setup_percpu: NR_CPUS:512 nr_cpumask_bits:512
nr_cpu_ids:16 nr_n2
[ 0.804648] percpu: Embedded 44 pages/cpu s143256 r8192 d28776 u262144
[ 0.811044] Built 2 zonelists, mobility grouping on. Total pages:
4095761
[ 0.817843] Policy zone: Normal
[ 0.820965] Kernel command line:
BOOT_IMAGE=/boot/vmlinuz-4.19.0-5-amd64 roo0
[ 0.854959] AGP: Checking aperture...
[ 0.866845] AGP: No AGP bridge found
[ 0.870252] AGP: Node 0: aperture [bus addr 0xf8000000-0xfbffffff] (64MB)
[ 0.877011] AGP: Node 1: aperture [bus addr 0xf8000000-0xfbffffff] (64MB)
[ 0.975916] Memory: 16260640K/16643268K available (10252K kernel
code, 1242K)
[ 0.989765] BUG: unable to handle kernel NULL pointer dereference at
00000000
[ 0.997523] PGD 0 P4D 0
[ 1.000037] Oops: 0002 [#1] SMP NOPTI
[ 1.003678] CPU: 0 PID: 0 Comm: swapper Not tainted 4.19.0-5-amd64 #1
Debian3
[ 1.011562] Hardware name: ASUS KGPE-D16/KGPE-D16, BIOS
4.9-1859-gf3510cbe369
[ 1.019541] RIP: 0010:_raw_spin_lock+0xc/0x20
[ 1.023869] Code: 01 00 00 75 05 48 89 d8 5b c3 e8 1f f7 9a ff eb f4
66 66 2b
[ 1.042588] RSP: 0000:ffffffff91803e08 EFLAGS: 00010046
[ 1.047788] RAX: 0000000000000000 RBX: ffff996c80083d80 RCX:
4132840b73c45ab1
[ 1.054893] RDX: 0000000000000001 RSI: 0000000000000000 RDI:
0000000000000000
[ 1.061999] RBP: ffffffff91803ec8 R08: ffff996c80080000 R09:
ffff996c80083d80
[ 1.069107] R10: 0000000000000000 R11: ffff996c80080000 R12:
ffffed5880002000
[ 1.076213] R13: 00000000802a0002 R14: 0000000000000001 R15:
ffff996c80083c00
[ 1.083320] FS: 0000000000000000(0000) GS:ffff9970a7c00000(0000)
knlGS:00000
[ 1.091380] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1.097098] CR2: 0000000000000000 CR3: 0000000023c0a000 CR4:
00000000000406b0
[ 1.104206] Call Trace:
[ 1.106638] deactivate_slab.isra.71+0x2d2/0x630
[ 1.111232] ? bootstrap+0x1f/0x12c
[ 1.114693] ? kmem_cache_alloc+0x1b8/0x1c0
[ 1.118854] bootstrap+0x66/0x12c
[ 1.122148] kmem_cache_init+0x8c/0x145
[ 1.125962] start_kernel+0x2a6/0x52c
[ 1.129602] secondary_startup_64+0xa4/0xb0
[ 1.133759] Modules linked in:
[ 1.136791] CR2: 0000000000000000
[ 1.140094] ---[ end trace a6e00f6a2ecfb185 ]---
[ 1.144679] RIP: 0010:_raw_spin_lock+0xc/0x20
[ 1.149011] Code: 01 00 00 75 05 48 89 d8 5b c3 e8 1f f7 9a ff eb f4
66 66 2b
[ 1.167730] RSP: 0000:ffffffff91803e08 EFLAGS: 00010046
[ 1.172929] RAX: 0000000000000000 RBX: ffff996c80083d80 RCX:
4132840b73c45ab1
[ 1.180036] RDX: 0000000000000001 RSI: 0000000000000000 RDI:
0000000000000000
[ 1.187143] RBP: ffffffff91803ec8 R08: ffff996c80080000 R09:
ffff996c80083d80
[ 1.194248] R10: 0000000000000000 R11: ffff996c80080000 R12:
ffffed5880002000
[ 1.201355] R13: 00000000802a0002 R14: 0000000000000001 R15:
ffff996c80083c00
[ 1.208462] FS: 0000000000000000(0000) GS:ffff9970a7c00000(0000)
knlGS:00000
[ 1.216520] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1.222241] CR2: 0000000000000000 CR3: 0000000023c0a000 CR4:
00000000000406b0
[ 1.229350] Kernel panic - not syncing: Attempted to kill the idle task!
[ 1.236028] ---[ end Kernel panic - not syncing: Attempted to kill
the idle -
[ 1.243910] PANIC: double fault, error_code: 0xffffffff9087cc95
[ 1.249801] CPU: 0 PID: 0 Comm: swapper Tainted: G D
4.19.0-53
[ 1.259073] Hardware name: ASUS KGPE-D16/KGPE-D16, BIOS
4.9-1859-gf3510cbe369
[ 1.267048] RIP: 0246:0x10
[ 1.269732] Code: Bad RIP value.
[ 1.272939] RSP: 0000:0000000000000000 EFLAGS: ffffffff91803e58
[ 1.278832] RAX: 000000000000004a RBX: ffffffff91813700 RCX:
ffffffff9184dda8
[ 1.285938] RDX: 0000000000000000 RSI: 0000000000000096 RDI:
0000000000000046
[ 1.293045] RBP: ffffffff91803ec8 R08: 00000000000000d2 R09:
2d2d2d5d20216b73
[ 1.300151] R10: 74206c6c696b206f R11: 20656c6469206568 R12:
0000000000000000
[ 1.307257] R13: 0000000000000000 R14: 0000000000000009 R15:
0000000000000001
[ 1.314364] FS: 0000000000000000 GS: 0000000000000000
[ 1.319564] Kernel panic - not syncing: Machine halted.
[ 1.324770] ---[ end Kernel panic - not syncing: Machine halted. ]---
2 months, 2 weeks
- 1
- 0
New Defects reported by Coverity Scan for coreboot
by scan-admin＠coverity.com
Hi,
Please find the latest report on new defect(s) introduced to coreboot found with Coverity Scan.
106 new defect(s) introduced to coreboot found with Coverity Scan.
77 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan.
New defect(s) Reported-by: Coverity Scan
Showing 20 of 106 defect(s)
** CID 1402138: (OVERRUN)
________________________________________________________________________________________________________
*** CID 1402138: (OVERRUN)
/src/vendorcode/amd/cimx/sb900/Sata.c: 601 in sataInitAfterPciEnum()
595
596 sataBar5setting (pConfig, &ddBar5);
597
598 ReadPCI (((SATA_BUS_DEV_FUN << 16) + SB_SATA_REG04), AccWidthUint8, &dbVar);
599 RWPCI (((SATA_BUS_DEV_FUN << 16) + SB_SATA_REG04), AccWidthUint8, 0xFF, 0x03); //memory and io access enable
600 dbEfuse = SATA_FIS_BASE_EFUSE_LOC;
>>> CID 1402138: (OVERRUN)
>>> Overrunning buffer pointed to by "&dbEfuse" of 1 bytes by passing it to a function which accesses it at byte offset 1.
601 getEfuseStatus (&dbEfuse);
602
603 if ( !cimSataPortMultCap ) {
604 ddAndMask |= BIT12;
605 }
606 if ( cimSataAggrLinkPmCap ) {
/src/vendorcode/amd/cimx/sb800/SATA.c: 407 in sataInitAfterPciEnum()
401
402 sataBar5setting (pConfig, &ddBar5);
403
404 ReadPCI (((SATA_BUS_DEV_FUN << 16) + SB_SATA_REG04), AccWidthUint8, &dbVar);
405 RWPCI (((SATA_BUS_DEV_FUN << 16) + SB_SATA_REG04), AccWidthUint8,0xFF, 0x03); //memory and io access enable
406 dbEfuse = SATA_FIS_BASE_EFUSE_LOC;
>>> CID 1402138: (OVERRUN)
>>> Overrunning buffer pointed to by "&dbEfuse" of 1 bytes by passing it to a function which accesses it at byte offset 1.
407 getEfuseStatus (&dbEfuse);
408
409 if ( !cimSataPortMultCap ) {
410 ddAndMask |= BIT12;
411 }
412 if ( cimSataAggrLinkPmCap ) {
** CID 1402137: Memory - corruptions (OVERRUN)
________________________________________________________________________________________________________
*** CID 1402137: Memory - corruptions (OVERRUN)
/src/vendorcode/amd/cimx/sb900/SbPeLib.c: 345 in getEfuseByte()
339 UINT8
340 getEfuseByte (
341 IN UINT8 Index
342 )
343 {
344 UINT8 Data;
>>> CID 1402137: Memory - corruptions (OVERRUN)
>>> Overrunning buffer pointed to by "&Index" of 1 bytes by passing it to a function which accesses it at byte offset 1.
345 WriteMEM (ACPI_MMIO_BASE + PMIO_BASE + SB_PMIOA_REGD8, AccWidthUint8, &Index);
346 ReadMEM (ACPI_MMIO_BASE + PMIO_BASE + SB_PMIOA_REGD8 + 1, AccWidthUint8, &Data);
347 return Data;
348 }
349
350
** CID 1402136: (ARRAY_VS_SINGLETON)
/src/vendorcode/amd/agesa/f16kb/Proc/GNB/Modules/GnbPcieConfig/PcieMapTopology.c: 414 in PcieMapTopologyOnWrapper()
/src/vendorcode/amd/agesa/f12/Proc/GNB/Modules/GnbPcieConfig/PcieMapTopology.c: 428 in PcieMapTopologyOnWrapper()
/src/vendorcode/amd/agesa/f15tn/Proc/GNB/Modules/GnbPcieConfig/PcieMapTopology.c: 414 in PcieMapTopologyOnWrapper()
________________________________________________________________________________________________________
*** CID 1402136: (ARRAY_VS_SINGLETON)
/src/vendorcode/amd/agesa/f16kb/Proc/GNB/Modules/GnbPcieConfig/PcieMapTopology.c: 414 in PcieMapTopologyOnWrapper()
408 Status = AGESA_ERROR;
409 AGESA_STATUS_UPDATE (Status, AgesaStatus);
410 } else {
411 WrapperPhyLaneBitMap |= EnginePhyLaneBitMap;
412 }
413 }
>>> CID 1402136: (ARRAY_VS_SINGLETON)
>>> Using "EngineList" as an array. This might corrupt or misinterpret adjacent memory locations.
414 EngineList = PcieLibGetNextDescriptor (EngineList);
415 }
416 IDS_HDT_CONSOLE (GNB_TRACE, "PcieMapTopologyOnWrapper Exit [%d]\n", AgesaStatus);
417 return AgesaStatus;
418 }
419
/src/vendorcode/amd/agesa/f12/Proc/GNB/Modules/GnbPcieConfig/PcieMapTopology.c: 428 in PcieMapTopologyOnWrapper()
422 Status = AGESA_ERROR;
423 AGESA_STATUS_UPDATE (Status, AgesaStatus);
424 } else {
425 WrapperPhyLaneBitMap |= EnginePhyLaneBitMap;
426 }
427 }
>>> CID 1402136: (ARRAY_VS_SINGLETON)
>>> Using "EngineList" as an array. This might corrupt or misinterpret adjacent memory locations.
428 EngineList = PcieLibGetNextDescriptor (EngineList);
429 }
430 return AgesaStatus;
431 }
432
433
/src/vendorcode/amd/agesa/f15tn/Proc/GNB/Modules/GnbPcieConfig/PcieMapTopology.c: 414 in PcieMapTopologyOnWrapper()
408 Status = AGESA_ERROR;
409 AGESA_STATUS_UPDATE (Status, AgesaStatus);
410 } else {
411 WrapperPhyLaneBitMap |= EnginePhyLaneBitMap;
412 }
413 }
>>> CID 1402136: (ARRAY_VS_SINGLETON)
>>> Using "EngineList" as an array. This might corrupt or misinterpret adjacent memory locations.
414 EngineList = PcieLibGetNextDescriptor (EngineList);
415 }
416 IDS_HDT_CONSOLE (GNB_TRACE, "PcieMapTopologyOnWrapper Exit [%d]\n", AgesaStatus);
417 return AgesaStatus;
418 }
419
** CID 1402135: Insecure data handling (TAINTED_SCALAR)
________________________________________________________________________________________________________
*** CID 1402135: Insecure data handling (TAINTED_SCALAR)
/util/cbfstool/cbfstool.c: 1726 in main()
1720
1721 if (commands[i].function == cbfs_create) {
1722 if (param.fmap) {
1723 struct buffer flashmap;
1724 if (buffer_from_file(&flashmap, param.fmap))
1725 return 1;
>>> CID 1402135: Insecure data handling (TAINTED_SCALAR)
>>> Passing tainted variable "flashmap.data" to a tainted sink.
1726 param.image_file = partitioned_file_create(
1727 image_name, &flashmap);
1728 buffer_delete(&flashmap);
1729 } else if (param.size) {
1730 param.image_file = partitioned_file_create_flat(
1731 image_name, param.size);
** CID 1402134: (OVERRUN)
________________________________________________________________________________________________________
*** CID 1402134: (OVERRUN)
/src/vendorcode/amd/cimx/sb800/SBCMN.c: 982 in softwareToggleImcStrapping()
976 {
977 UINT8 dbValue;
978 UINT8 dbPortStatus;
979 UINT32 abValue;
980 UINT32 abValue1;
981
>>> CID 1402134: (OVERRUN)
>>> Overrunning buffer pointed to by "&dbPortStatus" of 1 bytes by passing it to a function which accesses it at byte offset 1.
982 getChipSysMode (&dbPortStatus);
983
984 ReadPMIO (SB_PMIOA_REGBF, AccWidthUint8, &dbValue);
985 //if ( (dbValue & (BIT6 + BIT7)) != 0xC0 ) { // PwrGoodOut =1, PwrGoodEnB=1
986 //The strapStatus register is not mapped into StrapOveride not in the same bit position. The following is difference.
987
/src/vendorcode/amd/cimx/sb900/SbCmn.c: 1248 in softwareToggleImcStrapping()
1242 {
1243 UINT8 dbValue;
1244 UINT8 dbPortStatus;
1245 UINT32 abValue;
1246 UINT32 abValue1;
1247
>>> CID 1402134: (OVERRUN)
>>> Overrunning buffer pointed to by "&dbPortStatus" of 1 bytes by passing it to a function which accesses it at byte offset 1.
1248 getChipSysMode (&dbPortStatus);
1249
1250 ReadPMIO (SB_PMIOA_REGBF, AccWidthUint8, &dbValue);
1251 //if ( (dbValue & (BIT6 + BIT7)) != 0xC0 ) { // PwrGoodOut =1, PwrGoodEnB=1
1252 //The strapStatus register is not mapped into StrapOveride not in the same bit position. The following is difference.
1253
** CID 1402133: (ARRAY_VS_SINGLETON)
/src/vendorcode/amd/agesa/f16kb/Proc/GNB/Modules/GnbPcieInitLibV1/PcieTopologyServices.c: 249 in PcieTopologyApplyLaneMux()
/src/vendorcode/amd/agesa/f15tn/Proc/GNB/Modules/GnbPcieInitLibV1/PcieTopologyServices.c: 249 in PcieTopologyApplyLaneMux()
/src/vendorcode/amd/agesa/f12/Proc/GNB/Modules/GnbPcieInitLibV1/PcieTopologyServices.c: 226 in PcieTopologyApplyLaneMux()
________________________________________________________________________________________________________
*** CID 1402133: (ARRAY_VS_SINGLETON)
/src/vendorcode/amd/agesa/f16kb/Proc/GNB/Modules/GnbPcieInitLibV1/PcieTopologyServices.c: 249 in PcieTopologyApplyLaneMux()
243 if (TxLaneMuxSelectorArray [PhyLaneIndex] != CoreLaneIndex) {
244 TxLaneMuxSelectorArray [PcieTopologyLocateMuxIndex (TxLaneMuxSelectorArray, CoreLaneIndex)] = TxLaneMuxSelectorArray [PhyLaneIndex];
245 TxLaneMuxSelectorArray [PhyLaneIndex] = CoreLaneIndex;
246 }
247 }
248 }
>>> CID 1402133: (ARRAY_VS_SINGLETON)
>>> Using "EngineList" as an array. This might corrupt or misinterpret adjacent memory locations.
249 EngineList = PcieLibGetNextDescriptor (EngineList);
250 }
251 RxMaxSelectorValue = 0;
252 TxMaxSelectorValue = 0;
253 for (Index = 0; Index < sizeof (LaneMuxSelectorTable); Index++) {
254 RxMaxSelectorValue |= (RxLaneMuxSelectorArray[Index] << (Index * 4));
/src/vendorcode/amd/agesa/f15tn/Proc/GNB/Modules/GnbPcieInitLibV1/PcieTopologyServices.c: 249 in PcieTopologyApplyLaneMux()
243 if (TxLaneMuxSelectorArray [PhyLaneIndex] != CoreLaneIndex) {
244 TxLaneMuxSelectorArray [PcieTopologyLocateMuxIndex (TxLaneMuxSelectorArray, CoreLaneIndex)] = TxLaneMuxSelectorArray [PhyLaneIndex];
245 TxLaneMuxSelectorArray [PhyLaneIndex] = CoreLaneIndex;
246 }
247 }
248 }
>>> CID 1402133: (ARRAY_VS_SINGLETON)
>>> Using "EngineList" as an array. This might corrupt or misinterpret adjacent memory locations.
249 EngineList = PcieLibGetNextDescriptor (EngineList);
250 }
251 RxMaxSelectorValue = 0;
252 TxMaxSelectorValue = 0;
253 for (Index = 0; Index < sizeof (LaneMuxSelectorTable); Index++) {
254 RxMaxSelectorValue |= (RxLaneMuxSelectorArray[Index] << (Index * 4));
/src/vendorcode/amd/agesa/f12/Proc/GNB/Modules/GnbPcieInitLibV1/PcieTopologyServices.c: 226 in PcieTopologyApplyLaneMux()
220 if (TxLaneMuxSelectorArray [PhyLaneIndex] != CoreLaneIndex) {
221 TxLaneMuxSelectorArray [PcieTopologyLocateMuxIndex (TxLaneMuxSelectorArray, CoreLaneIndex)] = TxLaneMuxSelectorArray [PhyLaneIndex];
222 TxLaneMuxSelectorArray [PhyLaneIndex] = CoreLaneIndex;
223 }
224 }
225 }
>>> CID 1402133: (ARRAY_VS_SINGLETON)
>>> Using "EngineList" as an array. This might corrupt or misinterpret adjacent memory locations.
226 EngineList = PcieLibGetNextDescriptor (EngineList);
227 }
228 RxMaxSelectorValue = 0;
229 TxMaxSelectorValue = 0;
230 for (Index = 0; Index < sizeof (LaneMuxSelectorTable); Index++) {
231 RxMaxSelectorValue |= (RxLaneMuxSelectorArray[Index] << (Index * 4));
** CID 1402132: (ARRAY_VS_SINGLETON)
/src/vendorcode/amd/agesa/f12/Proc/GNB/Modules/GnbPcieConfig/PcieConfigLib.c: 164 in PcieConfigDisableAllEngines()
/src/vendorcode/amd/agesa/f15tn/Proc/GNB/Modules/GnbPcieConfig/PcieConfigLib.c: 167 in PcieConfigDisableAllEngines()
/src/vendorcode/amd/agesa/f16kb/Proc/GNB/Modules/GnbPcieConfig/PcieConfigLib.c: 167 in PcieConfigDisableAllEngines()
________________________________________________________________________________________________________
*** CID 1402132: (ARRAY_VS_SINGLETON)
/src/vendorcode/amd/agesa/f12/Proc/GNB/Modules/GnbPcieConfig/PcieConfigLib.c: 164 in PcieConfigDisableAllEngines()
158 PCIe_ENGINE_CONFIG *EngineList;
159 EngineList = PcieConfigGetChildEngine (Wrapper);
160 while (EngineList != NULL) {
161 if ((EngineList->EngineData.EngineType & EngineTypeMask) != 0) {
162 PcieConfigDisableEngine (EngineList);
163 }
>>> CID 1402132: (ARRAY_VS_SINGLETON)
>>> Using "EngineList" as an array. This might corrupt or misinterpret adjacent memory locations.
164 EngineList = PcieLibGetNextDescriptor (EngineList);
165 }
166 }
167
168
169 /*----------------------------------------------------------------------------------------*/
/src/vendorcode/amd/agesa/f15tn/Proc/GNB/Modules/GnbPcieConfig/PcieConfigLib.c: 167 in PcieConfigDisableAllEngines()
161 PCIe_ENGINE_CONFIG *EngineList;
162 EngineList = PcieConfigGetChildEngine (Wrapper);
163 while (EngineList != NULL) {
164 if ((EngineList->EngineData.EngineType & EngineTypeMask) != 0) {
165 PcieConfigDisableEngine (EngineList);
166 }
>>> CID 1402132: (ARRAY_VS_SINGLETON)
>>> Using "EngineList" as an array. This might corrupt or misinterpret adjacent memory locations.
167 EngineList = PcieLibGetNextDescriptor (EngineList);
168 }
169 }
170
171
172 /*----------------------------------------------------------------------------------------*/
/src/vendorcode/amd/agesa/f16kb/Proc/GNB/Modules/GnbPcieConfig/PcieConfigLib.c: 167 in PcieConfigDisableAllEngines()
161 PCIe_ENGINE_CONFIG *EngineList;
162 EngineList = PcieConfigGetChildEngine (Wrapper);
163 while (EngineList != NULL) {
164 if ((EngineList->EngineData.EngineType & EngineTypeMask) != 0) {
165 PcieConfigDisableEngine (EngineList);
166 }
>>> CID 1402132: (ARRAY_VS_SINGLETON)
>>> Using "EngineList" as an array. This might corrupt or misinterpret adjacent memory locations.
167 EngineList = PcieLibGetNextDescriptor (EngineList);
168 }
169 }
170
171
172 /*----------------------------------------------------------------------------------------*/
** CID 1402131: Memory - corruptions (OVERRUN)
/src/soc/samsung/exynos5420/fimd.c: 358 in exynos_fimd_lcd_init()
________________________________________________________________________________________________________
*** CID 1402131: Memory - corruptions (OVERRUN)
/src/soc/samsung/exynos5420/fimd.c: 358 in exynos_fimd_lcd_init()
352 lwritel(cfg, &FIMD_CTRL->vidcon1 + offset);
353
354 /* set timing */
355 cfg = EXYNOS_VIDTCON0_VFPD(vid->vl_vfpd - 1);
356 cfg |= EXYNOS_VIDTCON0_VBPD(vid->vl_vbpd - 1);
357 cfg |= EXYNOS_VIDTCON0_VSPW(vid->vl_vspw - 1);
>>> CID 1402131: Memory - corruptions (OVERRUN)
>>> "&(struct exynos_fb *)0x14400000->vidtcon0 + offset" evaluates to an address that is at byte offset 131072 of an array of 624 bytes.
358 lwritel(cfg, &FIMD_CTRL->vidtcon0 + offset);
359
360 cfg = EXYNOS_VIDTCON1_HFPD(vid->vl_hfpd - 1);
361 cfg |= EXYNOS_VIDTCON1_HBPD(vid->vl_hbpd - 1);
362 cfg |= EXYNOS_VIDTCON1_HSPW(vid->vl_hspw - 1);
363
** CID 1402130: Memory - corruptions (ARRAY_VS_SINGLETON)
/src/vendorcode/amd/agesa/f15tn/Proc/GNB/Modules/GnbInitTN/PcieConfigTN.c: 489 in PcieConfigureDdi2EnginesLaneAllocationTN()
________________________________________________________________________________________________________
*** CID 1402130: Memory - corruptions (ARRAY_VS_SINGLETON)
/src/vendorcode/amd/agesa/f15tn/Proc/GNB/Modules/GnbInitTN/PcieConfigTN.c: 489 in PcieConfigureDdi2EnginesLaneAllocationTN()
483 }
484 LaneIndex = 0;
485 while (EnginesList != NULL) {
486 PcieConfigResetDescriptorFlags (EnginesList, DESCRIPTOR_ALLOCATED);
487 EnginesList->EngineData.StartLane = Ddi2LaneConfigurationTable [ConfigurationId][LaneIndex++] + Wrapper->StartPhyLane;
488 EnginesList->EngineData.EndLane = Ddi2LaneConfigurationTable [ConfigurationId][LaneIndex++] + Wrapper->StartPhyLane;
>>> CID 1402130: Memory - corruptions (ARRAY_VS_SINGLETON)
>>> Using "EnginesList" as an array. This might corrupt or misinterpret adjacent memory locations.
489 EnginesList = PcieLibGetNextDescriptor (EnginesList);
490 }
491 return AGESA_SUCCESS;
492 }
493
494
** CID 1402129: (OVERRUN)
________________________________________________________________________________________________________
*** CID 1402129: (OVERRUN)
/src/vendorcode/amd/cimx/sb800/SBPort.c: 186 in sbPowerOnInit()
180 writeAlink (0x34, readAlink (0x34) | BIT9);
181
182 dbEfuse = FUSE_ID_EFUSE_LOC;
183 getEfuseStatus (&dbEfuse);
184 if ( dbEfuse == M1_D1_FUSE_ID ) {
185 dbEfuse = MINOR_ID_EFUSE_LOC;
>>> CID 1402129: (OVERRUN)
>>> Overrunning buffer pointed to by "&dbEfuse" of 1 bytes by passing it to a function which accesses it at byte offset 1.
186 getEfuseStatus (&dbEfuse);
187 if ( dbEfuse == M1_MINOR_ID ) {
188 // Limit ALink speed to 2.5G if Hudson-M1
189 cimNbSbGen2 = 0;
190 }
191 }
/src/vendorcode/amd/cimx/sb900/SBPort.c: 236 in sbPowerOnInit()
230 getEfuseStatus (&dbEfuse);
231 if ( dbEfuse & BIT0 ) {
232 pConfig->NbSbGen2 = 0;
233 }
234
235 dbEfuse = FCH_Variant_EFUSE_LOCATION;
>>> CID 1402129: (OVERRUN)
>>> Overrunning buffer pointed to by "&dbEfuse" of 1 bytes by passing it to a function which accesses it at byte offset 1.
236 getEfuseStatus (&dbEfuse);
237 if ((dbEfuse == 0x07) || (dbEfuse == 0x08)) {
238 pConfig->NbSbGen2 = 0;
239 }
240
241 if (pConfig->NbSbGen2) {
/src/vendorcode/amd/cimx/sb900/SBPort.c: 284 in sbPowerOnInit()
278 RWMEM (ACPI_MMIO_BASE + PMIO_BASE + SB_PMIOA_REG2E, AccWidthUint8, ~(BIT1 + BIT2), 0); //clear BIT[2:1]
279 smbusBase = (UINT16) (pConfig->BuildParameters.Smbus0BaseAddress);
280 dbValue = 0x00;
281 WriteIO (smbusBase + 0x14, AccWidthUint8, &dbValue);
282
283 dbEfuse = SATA_FIS_BASE_EFUSE_LOC;
>>> CID 1402129: (OVERRUN)
>>> Overrunning buffer pointed to by "&dbEfuse" of 1 bytes by passing it to a function which accesses it at byte offset 1.
284 getEfuseStatus (&dbEfuse);
285
286 programSbAcpiMmioTbl ((AcpiRegWrite*) FIXUP_PTR (&sbPmioPorInitTable[0]));
287
288 //RPR 3.4 Enabling ClkRun Function
289 RWPCI ((LPC_BUS_DEV_FUN << 16) + SB_LPC_REGBB, AccWidthUint8, ~ BIT2, BIT2);
/src/vendorcode/amd/cimx/sb900/SBPort.c: 230 in sbPowerOnInit()
224 //abValue = readAlink (SB_AX_DATAC_REG34 | (UINT32) (AXINDC << 29));
225 //abValue |= BIT6 + BIT5;
226 //writeAlink (SB_AX_DATAC_REG34 | (UINT32) (AXINDC << 29), abValue);
227
228 // Configure UMI target link speed
229 dbEfuse = PCIE_FORCE_GEN1_EFUSE_LOCATION;
>>> CID 1402129: (OVERRUN)
>>> Overrunning buffer pointed to by "&dbEfuse" of 1 bytes by passing it to a function which accesses it at byte offset 1.
230 getEfuseStatus (&dbEfuse);
231 if ( dbEfuse & BIT0 ) {
232 pConfig->NbSbGen2 = 0;
233 }
234
235 dbEfuse = FCH_Variant_EFUSE_LOCATION;
/src/vendorcode/amd/cimx/sb800/SBPort.c: 228 in sbPowerOnInit()
222 RWMEM (ACPI_MMIO_BASE + PMIO_BASE + SB_PMIOA_REG6A, AccWidthUint16, 00, (pConfig->BuildParameters.SmiCmdPortAddr));
223 RWMEM (ACPI_MMIO_BASE + PMIO_BASE + SB_PMIOA_REG6C, AccWidthUint16, 00, (pConfig->BuildParameters.AcpiPmaCntBlkAddr));
224 RWMEM (ACPI_MMIO_BASE + PMIO_BASE + SB_PMIOA_REG6E, AccWidthUint16, 00, (pConfig->BuildParameters.SmiCmdPortAddr) + 8);
225 RWMEM (ACPI_MMIO_BASE + PMIO_BASE + SB_PMIOA_REG48, AccWidthUint32, 00, (pConfig->BuildParameters.WatchDogTimerBase));
226
227 dbEfuse = SATA_FIS_BASE_EFUSE_LOC;
>>> CID 1402129: (OVERRUN)
>>> Overrunning buffer pointed to by "&dbEfuse" of 1 bytes by passing it to a function which accesses it at byte offset 1.
228 getEfuseStatus (&dbEfuse);
229
230 programSbAcpiMmioTbl ((AcpiRegWrite*) FIXUP_PTR (&sbPmioPorInitTable[0]));
231
232
233 SataPortNum = 0;
/src/vendorcode/amd/cimx/sb800/SBPort.c: 183 in sbPowerOnInit()
177 abValue = abValue | BIT0;
178 writeAlink (SB_ABCFG_REG9C | (UINT32) (ABCFG << 29), abValue);
179 writeAlink (0x30, 0x10); // AXINDC 0x10[9]=1, Enabling Non-Posted memory write for K8 platform.
180 writeAlink (0x34, readAlink (0x34) | BIT9);
181
182 dbEfuse = FUSE_ID_EFUSE_LOC;
>>> CID 1402129: (OVERRUN)
>>> Overrunning buffer pointed to by "&dbEfuse" of 1 bytes by passing it to a function which accesses it at byte offset 1.
183 getEfuseStatus (&dbEfuse);
184 if ( dbEfuse == M1_D1_FUSE_ID ) {
185 dbEfuse = MINOR_ID_EFUSE_LOC;
186 getEfuseStatus (&dbEfuse);
187 if ( dbEfuse == M1_MINOR_ID ) {
188 // Limit ALink speed to 2.5G if Hudson-M1
** CID 1402128: API usage errors (PRINTF_ARGS)
________________________________________________________________________________________________________
*** CID 1402128: API usage errors (PRINTF_ARGS)
/3rdparty/vboot/cgpt/cgpt_create.c: 18 in AllocAndClear()
12 static void AllocAndClear(uint8_t **buf, uint64_t size) {
13 if (*buf) {
14 memset(*buf, 0, size);
15 } else {
16 *buf = calloc(1, size);
17 if (!*buf) {
>>> CID 1402128: API usage errors (PRINTF_ARGS)
>>> Argument "size" to format specifier "%u" was expected to have type "unsigned int" but has type "unsigned long".
18 Error("Cannot allocate %u bytes.\n", size);
19 abort();
20 }
21 }
22 }
23
** CID 1402126: (ARRAY_VS_SINGLETON)
/src/vendorcode/amd/agesa/f16kb/Proc/GNB/Modules/GnbPcieConfig/PcieConfigLib.c: 242 in PcieConfigGetConfigurationSignature()
/src/vendorcode/amd/agesa/f15tn/Proc/GNB/Modules/GnbPcieConfig/PcieConfigLib.c: 242 in PcieConfigGetConfigurationSignature()
/src/vendorcode/amd/agesa/f12/Proc/GNB/Modules/GnbPcieConfig/PcieConfigLib.c: 239 in PcieConfigGetConfigurationSignature()
________________________________________________________________________________________________________
*** CID 1402126: (ARRAY_VS_SINGLETON)
/src/vendorcode/amd/agesa/f16kb/Proc/GNB/Modules/GnbPcieConfig/PcieConfigLib.c: 242 in PcieConfigGetConfigurationSignature()
236 ConfigurationSignature = 0;
237 EngineList = PcieConfigGetChildEngine (Wrapper);
238 while (EngineList != NULL) {
239 if (PcieConfigIsPcieEngine (EngineList) && EngineList->Type.Port.CoreId == CoreId) {
240 ConfigurationSignature = (ConfigurationSignature << 8) | PcieConfigGetNumberOfCoreLane (EngineList);
241 }
>>> CID 1402126: (ARRAY_VS_SINGLETON)
>>> Using "EngineList" as an array. This might corrupt or misinterpret adjacent memory locations.
242 EngineList = PcieLibGetNextDescriptor (EngineList);
243 }
244 return ConfigurationSignature;
245 }
246
247 /*----------------------------------------------------------------------------------------*/
/src/vendorcode/amd/agesa/f15tn/Proc/GNB/Modules/GnbPcieConfig/PcieConfigLib.c: 242 in PcieConfigGetConfigurationSignature()
236 ConfigurationSignature = 0;
237 EngineList = PcieConfigGetChildEngine (Wrapper);
238 while (EngineList != NULL) {
239 if (PcieConfigIsPcieEngine (EngineList) && EngineList->Type.Port.CoreId == CoreId) {
240 ConfigurationSignature = (ConfigurationSignature << 8) | PcieConfigGetNumberOfCoreLane (EngineList);
241 }
>>> CID 1402126: (ARRAY_VS_SINGLETON)
>>> Using "EngineList" as an array. This might corrupt or misinterpret adjacent memory locations.
242 EngineList = PcieLibGetNextDescriptor (EngineList);
243 }
244 return ConfigurationSignature;
245 }
246
247 /*----------------------------------------------------------------------------------------*/
/src/vendorcode/amd/agesa/f12/Proc/GNB/Modules/GnbPcieConfig/PcieConfigLib.c: 239 in PcieConfigGetConfigurationSignature()
233 ConfigurationSignature = 0;
234 EngineList = PcieConfigGetChildEngine (Wrapper);
235 while (EngineList != NULL) {
236 if (EngineList->Type.Port.CoreId == CoreId) {
237 ConfigurationSignature = (ConfigurationSignature << 8) | PcieConfigGetNumberOfCoreLane (EngineList);
238 }
>>> CID 1402126: (ARRAY_VS_SINGLETON)
>>> Using "EngineList" as an array. This might corrupt or misinterpret adjacent memory locations.
239 EngineList = PcieLibGetNextDescriptor (EngineList);
240 }
241 return ConfigurationSignature;
242 }
243
244 /*----------------------------------------------------------------------------------------*/
** CID 1402125: (ARRAY_VS_SINGLETON)
/src/vendorcode/amd/agesa/f15tn/Proc/GNB/Modules/GnbPcieInitLibV1/PcieTopologyServices.c: 474 in PcieTopologySetLinkReversal()
/src/vendorcode/amd/agesa/f12/Proc/GNB/Modules/GnbPcieInitLibV1/PcieTopologyServices.c: 441 in PcieTopologySetLinkReversal()
/src/vendorcode/amd/agesa/f16kb/Proc/GNB/Modules/GnbPcieInitLibV1/PcieTopologyServices.c: 474 in PcieTopologySetLinkReversal()
________________________________________________________________________________________________________
*** CID 1402125: (ARRAY_VS_SINGLETON)
/src/vendorcode/amd/agesa/f15tn/Proc/GNB/Modules/GnbPcieInitLibV1/PcieTopologyServices.c: 474 in PcieTopologySetLinkReversal()
468 FALSE,
469 Pcie
470 );
471 }
472 }
473 }
>>> CID 1402125: (ARRAY_VS_SINGLETON)
>>> Using "EngineList" as an array. This might corrupt or misinterpret adjacent memory locations.
474 EngineList = PcieLibGetNextDescriptor (EngineList);
475 }
476 IDS_HDT_CONSOLE (GNB_TRACE, "PcieTopologySetLinkReversal Exit\n");
477 }
478
479
/src/vendorcode/amd/agesa/f12/Proc/GNB/Modules/GnbPcieInitLibV1/PcieTopologyServices.c: 441 in PcieTopologySetLinkReversal()
435 FALSE,
436 Pcie
437 );
438 }
439 }
440 }
>>> CID 1402125: (ARRAY_VS_SINGLETON)
>>> Using "EngineList" as an array. This might corrupt or misinterpret adjacent memory locations.
441 EngineList = PcieLibGetNextDescriptor (EngineList);
442 }
443 IDS_HDT_CONSOLE (GNB_TRACE, "PcieTopologySetLinkReversal Exit\n");
444 }
445
446
/src/vendorcode/amd/agesa/f16kb/Proc/GNB/Modules/GnbPcieInitLibV1/PcieTopologyServices.c: 474 in PcieTopologySetLinkReversal()
468 FALSE,
469 Pcie
470 );
471 }
472 }
473 }
>>> CID 1402125: (ARRAY_VS_SINGLETON)
>>> Using "EngineList" as an array. This might corrupt or misinterpret adjacent memory locations.
474 EngineList = PcieLibGetNextDescriptor (EngineList);
475 }
476 IDS_HDT_CONSOLE (GNB_TRACE, "PcieTopologySetLinkReversal Exit\n");
477 }
478
479
** CID 1402124: Memory - corruptions (OVERRUN)
/src/soc/samsung/exynos5420/fimd.c: 364 in exynos_fimd_lcd_init()
________________________________________________________________________________________________________
*** CID 1402124: Memory - corruptions (OVERRUN)
/src/soc/samsung/exynos5420/fimd.c: 364 in exynos_fimd_lcd_init()
358 lwritel(cfg, &FIMD_CTRL->vidtcon0 + offset);
359
360 cfg = EXYNOS_VIDTCON1_HFPD(vid->vl_hfpd - 1);
361 cfg |= EXYNOS_VIDTCON1_HBPD(vid->vl_hbpd - 1);
362 cfg |= EXYNOS_VIDTCON1_HSPW(vid->vl_hspw - 1);
363
>>> CID 1402124: Memory - corruptions (OVERRUN)
>>> "&(struct exynos_fb *)0x14400000->vidtcon1 + offset" evaluates to an address that is at byte offset 131072 of an array of 620 bytes.
364 lwritel(cfg, &FIMD_CTRL->vidtcon1 + offset);
365
366 /* set lcd size */
367 cfg = EXYNOS_VIDTCON2_HOZVAL(vid->vl_col - 1) |
368 EXYNOS_VIDTCON2_LINEVAL(vid->vl_row - 1) |
369 EXYNOS_VIDTCON2_HOZVAL_E(vid->vl_col - 1) |
** CID 1402123: Memory - illegal accesses (OVERRUN)
/3rdparty/arm-trusted-firmware/lib/pmf/pmf_main.c: 100 in pmf_setup()
________________________________________________________________________________________________________
*** CID 1402123: Memory - illegal accesses (OVERRUN)
/3rdparty/arm-trusted-firmware/lib/pmf/pmf_main.c: 100 in pmf_setup()
94 /*
95 * Sort the successfully registered PMF services
96 * according to service ID
97 */
98 for (ii = 1; ii < pmf_num_services; ii++) {
99 for (jj = 0; jj < (pmf_num_services - ii); jj++) {
>>> CID 1402123: Memory - illegal accesses (OVERRUN)
>>> Overrunning array of 8 bytes at byte offset 40 by dereferencing pointer "pmf_svc_descs + (jj + 1)".
100 if ((pmf_svc_descs[jj].svc_config & PMF_SVC_ID_MASK) >
101 (pmf_svc_descs[jj + 1].svc_config &
102 PMF_SVC_ID_MASK)) {
103 temp_val = pmf_svc_descs_indices[jj];
104 pmf_svc_descs_indices[jj] =
105 pmf_svc_descs_indices[jj+1];
** CID 1402122: Insecure data handling (TAINTED_SCALAR)
/util/cbfstool/cbfs_image.c: 1325 in cbfs_export_entry()
________________________________________________________________________________________________________
*** CID 1402122: Insecure data handling (TAINTED_SCALAR)
/util/cbfstool/cbfs_image.c: 1325 in cbfs_export_entry()
1319 LOG("Found file %.30s at 0x%x, type %.12s, compressed %d, size %d\n",
1320 entry_name, cbfs_get_entry_addr(image, entry),
1321 get_cbfs_entry_type_name(ntohl(entry->type)), compressed_size,
1322 decompressed_size);
1323
1324 buffer_init(&buffer, strdup("(cbfs_export_entry)"), NULL, 0);
>>> CID 1402122: Insecure data handling (TAINTED_SCALAR)
>>> Passing tainted variable "buffer_len" to a tainted sink. [Note: The source code implementation of the function has been overridden by a builtin model.]
1325 buffer.data = malloc(buffer_len);
1326 buffer.size = buffer_len;
1327
1328 if (decompress(CBFS_SUBHEADER(entry), compressed_size,
1329 buffer.data, buffer.size, NULL)) {
1330 ERROR("decompression failed for %s\n", entry_name);
** CID 1402121: Memory - corruptions (OVERRUN)
________________________________________________________________________________________________________
*** CID 1402121: Memory - corruptions (OVERRUN)
/src/vendorcode/amd/cimx/sb800/SBPort.c: 285 in sbPowerOnInit()
279 WriteIO (SB_IOMAP_REG71, AccWidthUint8, &dbValue);
280
281 // Change the CG PLL multiplier to x1.1
282 if ( pConfig->UsbRxMode !=0 ) {
283 dbCg2WR = 0x00;
284 dbCg1Pll = 0x3A;
>>> CID 1402121: Memory - corruptions (OVERRUN)
>>> Overrunning buffer pointed to by "&dbCg2WR" of 1 bytes by passing it to a function which accesses it at byte offset 1.
285 ReadMEM (ACPI_MMIO_BASE + PMIO_BASE + SB_PMIOA_REGC8, AccWidthUint8, &dbCg2WR);
286 RWMEM (ACPI_MMIO_BASE + PMIO_BASE + SB_PMIOA_REGD8, AccWidthUint8, 0, 0x3A);
287 ReadMEM (ACPI_MMIO_BASE + PMIO_BASE + SB_PMIOA_REGD9, AccWidthUint8, &dbCg1Pll);
288 dbCg2WR &= BIT4;
289 if (( dbCg2WR == 0x00 ) && ( dbCg1Pll !=0x10 ))
290 {
** CID 1402120: (ARRAY_VS_SINGLETON)
/src/vendorcode/amd/agesa/f12/Proc/GNB/Modules/GnbPcieInitLibV1/PcieSiliconServices.c: 232 in PcieSiliconHidePorts()
/src/vendorcode/amd/agesa/f15tn/Proc/GNB/Modules/GnbPcieInitLibV1/PcieSiliconServices.c: 233 in PcieSiliconHidePorts()
________________________________________________________________________________________________________
*** CID 1402120: (ARRAY_VS_SINGLETON)
/src/vendorcode/amd/agesa/f12/Proc/GNB/Modules/GnbPcieInitLibV1/PcieSiliconServices.c: 232 in PcieSiliconHidePorts()
226 if (!PcieConfigCheckPortStatus (EngineList, INIT_STATUS_PCIE_TRAINING_SUCCESS) &&
227 ((EngineList->Type.Port.PortData.LinkHotplug == HotplugDisabled) || (EngineList->Type.Port.PortData.LinkHotplug == HotplugInboard)) &&
228 !PcieConfigIsSbPcieEngine (EngineList)) {
229 D0F0x64_x0C.Value |= 1 << EngineList->Type.Port.NativeDevNumber;
230 }
231 }
>>> CID 1402120: (ARRAY_VS_SINGLETON)
>>> Using "EngineList" as an array. This might corrupt or misinterpret adjacent memory locations.
232 EngineList = PcieLibGetNextDescriptor (EngineList);
233 }
234 WrapperList = PcieLibGetNextDescriptor (WrapperList);
235 }
236
237 GnbLibPciIndirectRMW (
/src/vendorcode/amd/agesa/f15tn/Proc/GNB/Modules/GnbPcieInitLibV1/PcieSiliconServices.c: 233 in PcieSiliconHidePorts()
227 while (EngineList != NULL) {
228 if (PcieConfigIsPcieEngine (EngineList)) {
229 if (PcieConfigIsActivePcieEngine (EngineList) && !PcieConfigIsSbPcieEngine (EngineList)) {
230 D0F0x64_x0C.Value &= ~(1 << EngineList->Type.Port.Address.Address.Device);
231 }
232 }
>>> CID 1402120: (ARRAY_VS_SINGLETON)
>>> Using "EngineList" as an array. This might corrupt or misinterpret adjacent memory locations.
233 EngineList = PcieLibGetNextDescriptor (EngineList);
234 }
235 WrapperList = PcieLibGetNextDescriptor (WrapperList);
236 }
237
238 GnbLibPciIndirectRMW (
** CID 1402119: Memory - corruptions (ARRAY_VS_SINGLETON)
/src/vendorcode/amd/agesa/f16kb/Proc/GNB/Modules/GnbInitKB/PcieLibKB.c: 416 in PcieTopologySelectMasterPllKB()
________________________________________________________________________________________________________
*** CID 1402119: Memory - corruptions (ARRAY_VS_SINGLETON)
/src/vendorcode/amd/agesa/f16kb/Proc/GNB/Modules/GnbInitKB/PcieLibKB.c: 416 in PcieTopologySelectMasterPllKB()
410 MasterLane = (EngineMasterLane < MasterLane) ? EngineMasterLane : MasterLane;
411 if (PcieConfigIsSbPcieEngine (EngineList)) {
412 break;
413 }
414 }
415 }
>>> CID 1402119: Memory - corruptions (ARRAY_VS_SINGLETON)
>>> Using "EngineList" as an array. This might corrupt or misinterpret adjacent memory locations.
416 EngineList = PcieLibGetNextDescriptor (EngineList);
417 }
418
419 if (MasterLane == 0xffff) {
420 if (MasterHotplugLane != 0xffff) {
421 MasterLane = MasterHotplugLane;
** CID 1402118: (OVERRUN)
________________________________________________________________________________________________________
*** CID 1402118: (OVERRUN)
/src/vendorcode/amd/cimx/sb900/SbCmn.c: 1219 in validateImcFirmware()
1213 ReadMEM ((ImcAddr + 0x2000), AccWidthUint32, &ImcBinSig0);
1214 ReadMEM ((ImcAddr + 0x2004), AccWidthUint32, &ImcBinSig1);
1215 ReadMEM ((ImcAddr + 0x2008), AccWidthUint16, &ImcBinSig2);
1216 if ((ImcBinSig0 == 0x444D415F) && (ImcBinSig1 == 0x434D495F) && (ImcBinSig2 == 0x435F) ) {
1217 dbIMCChecksume = 0;
1218 for ( CurAddr = ImcAddr; CurAddr < ImcAddr + 0x10000; CurAddr++ ) {
>>> CID 1402118: (OVERRUN)
>>> Overrunning buffer pointed to by "&dbIMC" of 1 bytes by passing it to a function which accesses it at byte offset 1.
1219 ReadMEM (CurAddr, AccWidthUint8, &dbIMC);
1220 dbIMCChecksume = dbIMCChecksume + dbIMC;
1221 }
1222 }
1223 }
1224 if ( dbIMCChecksume ) {
/src/vendorcode/amd/cimx/sb800/SBCMN.c: 953 in validateImcFirmware()
947 ReadMEM ((ImcAddr + 0x2000), AccWidthUint32, &ImcBinSig0);
948 ReadMEM ((ImcAddr + 0x2004), AccWidthUint32, &ImcBinSig1);
949 ReadMEM ((ImcAddr + 0x2008), AccWidthUint16, &ImcBinSig2);
950 if ((ImcBinSig0 == 0x444D415F) && (ImcBinSig1 == 0x434D495F) && (ImcBinSig2 == 0x435F) ) {
951 dbIMCChecksume = 0;
952 for ( CurAddr = ImcAddr; CurAddr < ImcAddr + 0x10000; CurAddr++ ) {
>>> CID 1402118: (OVERRUN)
>>> Overrunning buffer pointed to by "&dbIMC" of 1 bytes by passing it to a function which accesses it at byte offset 1.
953 ReadMEM (CurAddr, AccWidthUint8, &dbIMC);
954 dbIMCChecksume = dbIMCChecksume + dbIMC;
955 }
956 }
957 }
958 if ( dbIMCChecksume ) {
________________________________________________________________________________________________________
To view the defects in Coverity Scan visit, https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0...
2 months, 3 weeks
- 1
- 0
Unresolved comments on Gerrit
by Patrick Georgi
Hi everybody,
you might notice a new column in the Gerrit UI: ACR for All-Comments-Resolved.
For a while, Gerrit allows to "resolve" comments made to changes, and this
field automatically determines if all comments are marked that way.
Another change to our Gerrit install is that changes can only be submitted
when there are no more open comments.
For this reason, please ensure to close comments you consider done.
Thanks,
Patrick
--
Google Germany GmbH, ABC-Str. 19, 20354 Hamburg
Registergericht und -nummer: Hamburg, HRB 86891, Sitz der Gesellschaft: Hamburg
Geschäftsführer: Paul Manicle, Halimah DeLaine Prado
2 months, 3 weeks
- 2
- 1
New Defects reported by Coverity Scan for coreboot
by scan-admin＠coverity.com
Hi,
Please find the latest report on new defect(s) introduced to coreboot found with Coverity Scan.
49 new defect(s) introduced to coreboot found with Coverity Scan.
124 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan.
New defect(s) Reported-by: Coverity Scan
Showing 20 of 49 defect(s)
** CID 1403651: Control flow issues (DEADCODE)
/src/mainboard/purism/librem_skl/hda_verb.c: 51 in mb_hda_codec_init()
________________________________________________________________________________________________________
*** CID 1403651: Control flow issues (DEADCODE)
/src/mainboard/purism/librem_skl/hda_verb.c: 51 in mb_hda_codec_init()
45 struct resource *res;
46 u32 codec_mask;
47 struct device *dev;
48
49 dev = SA_DEV_ROOT;
50 /* Check if HDA is enabled, else return */
>>> CID 1403651: Control flow issues (DEADCODE)
>>> Execution cannot reach the expression "dev->chip_info == NULL" inside this statement: "if (dev == NULL || dev->chi...".
51 if (dev == NULL || dev->chip_info == NULL)
52 return;
53
54 config = dev->chip_info;
55
56 /*
** CID 1403002: (UNINIT)
/src/soc/mediatek/mt8183/dramc_pi_calibration_api.c: 548 in dramc_find_gating_window()
/src/soc/mediatek/mt8183/dramc_pi_calibration_api.c: 542 in dramc_find_gating_window()
________________________________________________________________________________________________________
*** CID 1403002: (UNINIT)
/src/soc/mediatek/mt8183/dramc_pi_calibration_api.c: 548 in dramc_find_gating_window()
542 pass_count_1[dqs]++;
543
544 if (pass_begin[dqs] == 1 &&
545 pass_count_1[dqs] * DQS_GW_FINE_STEP > DQS_GW_FINE_END)
546 dqs_high[dqs] = 0;
547
>>> CID 1403002: (UNINIT)
>>> Using uninitialized value "pass_count_1[0]".
548 if (pass_count_1[0] * DQS_GW_FINE_STEP > DQS_GW_FINE_END &&
549 pass_count_1[1] * DQS_GW_FINE_STEP > DQS_GW_FINE_END) {
550 dramc_dbg("All bytes gating window > 1 coarse_tune,"
551 " Early break\n");
552 *dly_fine_xt = DQS_GW_FINE_END;
553 *coarse_tune = GATING_END;
/src/soc/mediatek/mt8183/dramc_pi_calibration_api.c: 542 in dramc_find_gating_window()
536 dramc_dbg("[Byte %d]First pass (%d, %d, %d)\n",
537 dqs, dly_coarse_large,
538 dly_coarse_0p5t, *dly_fine_xt);
539 }
540
541 if (pass_begin[dqs] == 1)
>>> CID 1403002: (UNINIT)
>>> Using uninitialized value "pass_count_1[dqs]".
542 pass_count_1[dqs]++;
543
544 if (pass_begin[dqs] == 1 &&
545 pass_count_1[dqs] * DQS_GW_FINE_STEP > DQS_GW_FINE_END)
546 dqs_high[dqs] = 0;
547
** CID 1403001: Null pointer dereferences (FORWARD_NULL)
________________________________________________________________________________________________________
*** CID 1403001: Null pointer dereferences (FORWARD_NULL)
/src/soc/mediatek/mt8183/gpio.c: 184 in gpio_set_spi_driving()
178 case 5:
179 reg = (void *)(IOCFG_LM_BASE + GPIO_DRV0_OFFSET);
180 offset = 8;
181 break;
182 }
183
>>> CID 1403001: Null pointer dereferences (FORWARD_NULL)
>>> Passing null pointer "reg" to "read32", which dereferences it.
184 clrsetbits_le32(reg, 0xf << offset, reg_val << offset);
** CID 1401793: Insecure data handling (INTEGER_OVERFLOW)
/3rdparty/vboot/futility/updater.c: 240 in host_get_platform_version()
________________________________________________________________________________________________________
*** CID 1401793: Insecure data handling (INTEGER_OVERFLOW)
/3rdparty/vboot/futility/updater.c: 240 in host_get_platform_version()
234 /* Result should be 'revN' */
235 if (strncmp(result, STR_REV, strlen(STR_REV)) == 0)
236 rev = strtol(result + strlen(STR_REV), NULL, 0);
237 DEBUG("Raw data = [%s], parsed version is %d", result, rev);
238
239 free(result);
>>> CID 1401793: Insecure data handling (INTEGER_OVERFLOW)
>>> Overflowed or truncated value (or a value computed from an overflowed or truncated value) "rev" used as return value.
240 return rev;
241 }
242
243 /*
244 * A helper function to invoke flashrom(8) command.
245 * Returns 0 if success, non-zero if error.
** CID 1401086: Null pointer dereferences (FORWARD_NULL)
________________________________________________________________________________________________________
*** CID 1401086: Null pointer dereferences (FORWARD_NULL)
/src/soc/qualcomm/qcs405/clock.c: 245 in clock_configure_spi()
239 } else if (blsp == 2)
240 spi_clk = (struct qcs405_clock *)&gcc->blsp2_qup0_spi_clk;
241
242 else
243 printk(BIOS_ERR, "BLSP%d not supported\n", blsp);
244
>>> CID 1401086: Null pointer dereferences (FORWARD_NULL)
>>> Passing null pointer "spi_clk" to "clock_configure", which dereferences it.
245 clock_configure(spi_clk, spi_cfg, hz, ARRAY_SIZE(spi_cfg));
246 }
247
248 void clock_configure_i2c(uint32_t hz)
249 {
250 struct qcs405_clock *i2c_clk =
** CID 1398603: (CONSTANT_EXPRESSION_RESULT)
/src/soc/mediatek/mt8183/dramc_pi_basic_api.c: 125 in transfer_pll_to_spm_control()
/src/soc/mediatek/mt8183/dramc_pi_basic_api.c: 124 in transfer_pll_to_spm_control()
________________________________________________________________________________________________________
*** CID 1398603: (CONSTANT_EXPRESSION_RESULT)
/src/soc/mediatek/mt8183/dramc_pi_basic_api.c: 125 in transfer_pll_to_spm_control()
119 (0xffff << 16) | (0x1 << 0),
120 (0xb16 << 16) | (0x1 << 0));
121
122 /* Set SPM pinmux */
123 clrbits_le32(&mtk_spm->pcm_pwr_io_en, (0xff << 0) | (0xff << 16));
124 setbits_le32(&mtk_spm->dramc_dpy_clk_sw_con_sel, 0xffffffff);
>>> CID 1398603: (CONSTANT_EXPRESSION_RESULT)
>>> "((uint32_t)read32(&mtk_spm->dramc_dpy_clk_sw_con_sel2) & 4294967295U /* ~((uint32_t)0) */) | 0xffffffffU" is always 0xffffffff regardless of the values of its operands. This occurs as an argument to a function call.
125 setbits_le32(&mtk_spm->dramc_dpy_clk_sw_con_sel2, 0xffffffff);
126
127 setbits_le32(&mtk_spm->spm_power_on_val0, (0x1 << 8) | (0xf << 12));
128 setbits_le32(&mtk_spm->spm_s1_mode_ch, 0x3 << 0);
129
130 shu_lev = (shu_lev == 1) ? 2 : 1;
/src/soc/mediatek/mt8183/dramc_pi_basic_api.c: 124 in transfer_pll_to_spm_control()
118 clrsetbits_le32(&mtk_spm->poweron_config_set,
119 (0xffff << 16) | (0x1 << 0),
120 (0xb16 << 16) | (0x1 << 0));
121
122 /* Set SPM pinmux */
123 clrbits_le32(&mtk_spm->pcm_pwr_io_en, (0xff << 0) | (0xff << 16));
>>> CID 1398603: (CONSTANT_EXPRESSION_RESULT)
>>> "((uint32_t)read32(&mtk_spm->dramc_dpy_clk_sw_con_sel) & 4294967295U /* ~((uint32_t)0) */) | 0xffffffffU" is always 0xffffffff regardless of the values of its operands. This occurs as an argument to a function call.
124 setbits_le32(&mtk_spm->dramc_dpy_clk_sw_con_sel, 0xffffffff);
125 setbits_le32(&mtk_spm->dramc_dpy_clk_sw_con_sel2, 0xffffffff);
126
127 setbits_le32(&mtk_spm->spm_power_on_val0, (0x1 << 8) | (0xf << 12));
128 setbits_le32(&mtk_spm->spm_s1_mode_ch, 0x3 << 0);
129
** CID 1394268: Possible Control flow issues (DEADCODE)
/src/vendorcode/cavium/bdk/libdram/libdram.c: 187 in bdk_libdram_tune_node()
________________________________________________________________________________________________________
*** CID 1394268: Possible Control flow issues (DEADCODE)
/src/vendorcode/cavium/bdk/libdram/libdram.c: 187 in bdk_libdram_tune_node()
181 }
182
183 // disabled by default for now, does not seem to be needed much?
184 // Automatically tune the ECC byte DLL read offsets
185 // FIXME? allow override of the filtering
186 // FIXME? allow programmatic override, not via envvar?
>>> CID 1394268: Possible Control flow issues (DEADCODE)
>>> Execution cannot reach the expression "lmc_config.s.mode32b == 0" inside this statement: "if (do_eccdll && !do_dllro_...".
187 if (do_eccdll && !do_dllro_hw && (lmc_config.s.mode32b == 0)) { // do not do HW-assist twice for ECC
188 BDK_TRACE(DRAM, "N%d: Starting ECC DLL Read Offset Tuning for LMCs\n", node);
189 errs = perform_HW_dll_offset_tuning(node, 2, 8/* ECC bytelane */);
190 BDK_TRACE(DRAM, "N%d: Finished ECC DLL Read Offset Tuning for LMCs, %d errors\n",
191 node, errs);
192 tot_errs += errs;
** CID 1393983: (INTEGER_OVERFLOW)
/src/vendorcode/cavium/bdk/libdram/lib_octeon_shared.c: 1146 in initialize_ddr_clock()
/src/vendorcode/cavium/bdk/libdram/lib_octeon_shared.c: 1150 in initialize_ddr_clock()
________________________________________________________________________________________________________
*** CID 1393983: (INTEGER_OVERFLOW)
/src/vendorcode/cavium/bdk/libdram/lib_octeon_shared.c: 1146 in initialize_ddr_clock()
1140 best_en_idx = strtoul(s, NULL, 0);
1141 override_pll_settings = 1;
1142 }
1143
1144 if (override_pll_settings) {
1145 best_pll_MHz = ddr_ref_hertz * (best_clkf+1) / (best_clkr+1) / 1000000;
>>> CID 1393983: (INTEGER_OVERFLOW)
>>> Overflowed or truncated value (or a value computed from an overflowed or truncated value) "best_en_idx" used as array index.
1146 best_calculated_ddr_hertz = ddr_ref_hertz * (best_clkf + 1) / ((best_clkr + 1) * (_en[best_en_idx]));
1147 best_error = ddr_hertz - best_calculated_ddr_hertz;
1148 }
1149
1150 ddr_print("clkr: %2llu, en[%d]: %2d, clkf: %4llu, pll_MHz: %4llu, ddr_hertz: %8llu, error: %8lld <==\n",
1151 best_clkr, best_en_idx, _en[best_en_idx], best_clkf, best_pll_MHz,
/src/vendorcode/cavium/bdk/libdram/lib_octeon_shared.c: 1150 in initialize_ddr_clock()
1144 if (override_pll_settings) {
1145 best_pll_MHz = ddr_ref_hertz * (best_clkf+1) / (best_clkr+1) / 1000000;
1146 best_calculated_ddr_hertz = ddr_ref_hertz * (best_clkf + 1) / ((best_clkr + 1) * (_en[best_en_idx]));
1147 best_error = ddr_hertz - best_calculated_ddr_hertz;
1148 }
1149
>>> CID 1393983: (INTEGER_OVERFLOW)
>>> Overflowed or truncated value (or a value computed from an overflowed or truncated value) "best_en_idx" used as array index.
1150 ddr_print("clkr: %2llu, en[%d]: %2d, clkf: %4llu, pll_MHz: %4llu, ddr_hertz: %8llu, error: %8lld <==\n",
1151 best_clkr, best_en_idx, _en[best_en_idx], best_clkf, best_pll_MHz,
1152 best_calculated_ddr_hertz, best_error);
1153
1154 /* Try lowering the frequency if we can't get a working configuration */
1155 if (best_error == ddr_hertz) {
** CID 1393982: Memory - illegal accesses (UNINIT)
________________________________________________________________________________________________________
*** CID 1393982: Memory - illegal accesses (UNINIT)
/src/vendorcode/cavium/bdk/libdram/dram-spd.c: 437 in report_ddr3_dimm()
431 volt_str = "1.5V";
432 if (spd_voltage & 2)
433 volt_str = "1.35V";
434 if (spd_voltage & 4)
435 volt_str = "1.2xV";
436
>>> CID 1393982: Memory - illegal accesses (UNINIT)
>>> Using uninitialized value "volt_str" when calling "report_common_dimm".
437 report_common_dimm(node, dimm_config, dimm, ddr3_dimm_types,
438 DDR3_DRAM, volt_str, ddr_interface_num,
439 num_ranks, dram_width, dimm_size_mb);
440 }
441
442 const char *ddr4_dimm_types[16] = {
** CID 1393981: Insecure data handling (TAINTED_SCALAR)
/src/vendorcode/cavium/bdk/libdram/dram-init-ddr3.c: 745 in Perform_Read_Deskew_Training()
________________________________________________________________________________________________________
*** CID 1393981: Insecure data handling (TAINTED_SCALAR)
/src/vendorcode/cavium/bdk/libdram/dram-init-ddr3.c: 745 in Perform_Read_Deskew_Training()
739 perform_octeon3_ddr3_sequence(node, rank_mask, ddr_interface_num, 0x0A); /* LMC Deskew Training */
740
741 lock_retries = 0;
742
743 perform_read_deskew_training:
744 // maybe perform the NORMAL deskew training sequence multiple times before looking at lock status
>>> CID 1393981: Insecure data handling (TAINTED_SCALAR)
>>> Using tainted variable "normal_loops" as a loop boundary.
745 for (loops = 0; loops < normal_loops; loops++) {
746 DRAM_CSR_MODIFY(phy_ctl, node, BDK_LMCX_PHY_CTL(ddr_interface_num),
747 phy_ctl.s.phy_dsk_reset = 0); /* Normal Deskew sequence */
748 perform_octeon3_ddr3_sequence(node, rank_mask, ddr_interface_num, 0x0A); /* LMC Deskew Training */
749 }
750 // Moved this from Validate_Read_Deskew_Training
** CID 1393980: Incorrect expression (NO_EFFECT)
/src/vendorcode/cavium/bdk/libdram/libdram.c: 89 in bdk_dram_clear_mem()
________________________________________________________________________________________________________
*** CID 1393980: Incorrect expression (NO_EFFECT)
/src/vendorcode/cavium/bdk/libdram/libdram.c: 89 in bdk_dram_clear_mem()
83 /* The above pointer got address 8 to avoid NULL pointer checking
84 in bdk_phys_to_ptr(). Correct it here */
85 ptr--;
86 uint64_t *end = bdk_phys_to_ptr(bdk_numa_get_address(node, skip));
87 while (ptr < end)
88 {
>>> CID 1393980: Incorrect expression (NO_EFFECT)
>>> Assigning "*ptr" to itself has no effect.
89 *ptr = *ptr;
90 ptr++;
91 }
92 }
93 ddr_print("N%d: Clearing DRAM: start 0x%llx length 0x%llx\n", node, skip, len);
94 bdk_zero_memory(bdk_phys_to_ptr(bdk_numa_get_address(node, skip)), len);
** CID 1393973: (DEADCODE)
/src/vendorcode/cavium/bdk/libdram/dram-spd.c: 101 in read_entire_spd()
/src/vendorcode/cavium/bdk/libdram/dram-spd.c: 112 in read_entire_spd()
/src/vendorcode/cavium/bdk/libdram/dram-spd.c: 120 in read_entire_spd()
________________________________________________________________________________________________________
*** CID 1393973: (DEADCODE)
/src/vendorcode/cavium/bdk/libdram/dram-spd.c: 101 in read_entire_spd()
95 uint32_t *ptr = (uint32_t *)spd_buf;
96
97 for (int bank = 0; bank < (spd_size >> 8); bank++)
98 {
99 /* this should only happen for DDR4, which has a second bank of 256 bytes */
100 if (bank)
>>> CID 1393973: (DEADCODE)
>>> Execution cannot reach this statement: "bdk_twsix_write_ia(node, bu...".
101 bdk_twsix_write_ia(node, bus, 0x36 | bank, 0, 2, 1, 0);
102 int bank_size = 256;
103 for (int i = 0; i < bank_size; i += 4)
104 {
105 int64_t data = bdk_twsix_read_ia(node, bus, address, i, 4, 1);
106 if (data < 0)
/src/vendorcode/cavium/bdk/libdram/dram-spd.c: 112 in read_entire_spd()
106 if (data < 0)
107 {
108 free(spd_buf);
109 bdk_error("Failed to read SPD data at 0x%x\n", i + (bank << 8));
110 /* Restore the bank to zero */
111 if (bank)
>>> CID 1393973: (DEADCODE)
>>> Execution cannot reach this statement: "bdk_twsix_write_ia(node, bu...".
112 bdk_twsix_write_ia(node, bus, 0x36 | 0, 0, 2, 1, 0);
113 return -1;
114 }
115 else
116 *ptr++ = bdk_be32_to_cpu(data);
117 }
/src/vendorcode/cavium/bdk/libdram/dram-spd.c: 120 in read_entire_spd()
114 }
115 else
116 *ptr++ = bdk_be32_to_cpu(data);
117 }
118 /* Restore the bank to zero */
119 if (bank)
>>> CID 1393973: (DEADCODE)
>>> Execution cannot reach this statement: "bdk_twsix_write_ia(node, bu...".
120 bdk_twsix_write_ia(node, bus, 0x36 | 0, 0, 2, 1, 0);
121 }
122
123 /* Store the SPD in the device tree */
124 /* FIXME(dhendrix): No need for this? cfg gets updated, so the caller
125 * (libdram_config()) has what it needs. */
** CID 1393972: Insecure data handling (TAINTED_SCALAR)
/src/vendorcode/cavium/bdk/libdram/dram-tune-ddr3.c: 1011 in perform_dll_offset_tuning()
________________________________________________________________________________________________________
*** CID 1393972: Insecure data handling (TAINTED_SCALAR)
/src/vendorcode/cavium/bdk/libdram/dram-tune-ddr3.c: 1011 in perform_dll_offset_tuning()
1005 /* Disable l2 sets for DRAM testing */
1006 limit_l2_ways(node, 0, ways_print);
1007 #endif
1008
1009 // testing is done on all LMCs simultaneously
1010 // FIXME: for now, loop here to show what happens multiple times
>>> CID 1393972: Insecure data handling (TAINTED_SCALAR)
>>> Using tainted variable "loops" as a loop boundary.
1011 for (loop = 0; loop < loops; loop++) {
1012 /* Perform DLL offset tuning */
1013 errs = auto_set_dll_offset(node, dll_offset_mode, num_lmcs, ddr_interface_64b, do_tune);
1014 }
1015
1016 #if USE_L2_WAYS_LIMIT
** CID 1393971: Insecure data handling (TAINTED_SCALAR)
/src/vendorcode/cavium/bdk/libdram/lib_octeon_shared.c: 1146 in initialize_ddr_clock()
________________________________________________________________________________________________________
*** CID 1393971: Insecure data handling (TAINTED_SCALAR)
/src/vendorcode/cavium/bdk/libdram/lib_octeon_shared.c: 1146 in initialize_ddr_clock()
1140 best_en_idx = strtoul(s, NULL, 0);
1141 override_pll_settings = 1;
1142 }
1143
1144 if (override_pll_settings) {
1145 best_pll_MHz = ddr_ref_hertz * (best_clkf+1) / (best_clkr+1) / 1000000;
>>> CID 1393971: Insecure data handling (TAINTED_SCALAR)
>>> Using tainted variable "best_en_idx" as an index into an array "_en".
1146 best_calculated_ddr_hertz = ddr_ref_hertz * (best_clkf + 1) / ((best_clkr + 1) * (_en[best_en_idx]));
1147 best_error = ddr_hertz - best_calculated_ddr_hertz;
1148 }
1149
1150 ddr_print("clkr: %2llu, en[%d]: %2d, clkf: %4llu, pll_MHz: %4llu, ddr_hertz: %8llu, error: %8lld <==\n",
1151 best_clkr, best_en_idx, _en[best_en_idx], best_clkf, best_pll_MHz,
** CID 1393969: Possible Control flow issues (DEADCODE)
/src/vendorcode/cavium/bdk/libbdk-hal/bdk-qlm.c: 421 in bdk_qlm_eye_display()
________________________________________________________________________________________________________
*** CID 1393969: Possible Control flow issues (DEADCODE)
/src/vendorcode/cavium/bdk/libbdk-hal/bdk-qlm.c: 421 in bdk_qlm_eye_display()
415 result = 0;
416 }
417 else
418 result = -1;
419
420 if (need_free)
>>> CID 1393969: Possible Control flow issues (DEADCODE)
>>> Execution cannot reach this statement: "free((void *)eye);".
421 free((void*)eye);
422 return result;
** CID 1393967: Code maintainability issues (UNUSED_VALUE)
/src/vendorcode/cavium/bdk/libdram/dram-tune-ddr3.c: 658 in auto_set_dll_offset()
________________________________________________________________________________________________________
*** CID 1393967: Code maintainability issues (UNUSED_VALUE)
/src/vendorcode/cavium/bdk/libdram/dram-tune-ddr3.c: 658 in auto_set_dll_offset()
652 } /* for (lmc = 0; lmc < num_lmcs; lmc++) */
653
654 bdk_watchdog_poke();
655
656 // run the test(s)
657 // only 1 call should be enough, let the bursts, etc, control the load...
>>> CID 1393967: Code maintainability issues (UNUSED_VALUE)
>>> Assigning value from "run_dram_tuning_threads(node, num_lmcs, bytemask)" to "tot_errors" here, but that stored value is overwritten before it can be used.
658 tot_errors = run_dram_tuning_threads(node, num_lmcs, bytemask);
659
660 for (lmc = 0; lmc < num_lmcs; lmc++) {
661 // record stop cycle CSRs here for utilization measure
662 stop_dram_dclk[lmc] = BDK_CSR_READ(node, BDK_LMCX_DCLK_CNT(lmc));
663 stop_dram_ops[lmc] = BDK_CSR_READ(node, BDK_LMCX_OPS_CNT(lmc));
** CID 1393966: Control flow issues (DEADCODE)
/src/soc/cavium/cn81xx/uart.c: 104 in uart_platform_refclk()
________________________________________________________________________________________________________
*** CID 1393966: Control flow issues (DEADCODE)
/src/soc/cavium/cn81xx/uart.c: 104 in uart_platform_refclk()
98 unsigned int uart_platform_refclk(void)
99 {
100 struct cn81xx_uart *uart =
101 (struct cn81xx_uart *)CONFIG_CONSOLE_SERIAL_UART_ADDRESS;
102
103 if (!uart)
>>> CID 1393966: Control flow issues (DEADCODE)
>>> Execution cannot reach this statement: "return 0U;".
104 return 0;
105
106 return uart_hclk(uart);
107 }
108
109 uintptr_t uart_platform_base(int idx)
** CID 1393965: Control flow issues (DEADCODE)
/src/vendorcode/cavium/bdk/libdram/lib_octeon_shared.c: 1880 in dbi_switchover_interface()
________________________________________________________________________________________________________
*** CID 1393965: Control flow issues (DEADCODE)
/src/vendorcode/cavium/bdk/libdram/lib_octeon_shared.c: 1880 in dbi_switchover_interface()
1874 for (byte = 0; byte < (8+ecc_ena); byte++) {
1875 unlocked += (dbi_settings[byte] & 1) ^ 1;
1876 }
1877
1878 // FIXME: print out the DBI settings array after each rank?
1879 if (rank_max > 1) // only when doing more than 1 rank
>>> CID 1393965: Control flow issues (DEADCODE)
>>> Execution cannot reach this statement: "display_DAC_DBI_settings(no...".
1880 display_DAC_DBI_settings(node, lmc, /* DBI */0, ecc_ena, dbi_settings, " RANK");
1881
1882 if (unlocked > 0) {
1883 ddr_print("N%d.LMC%d: DBI switchover: LOCK: %d still unlocked.\n",
1884 node, lmc, unlocked);
1885
** CID 1393964: (TAINTED_SCALAR)
________________________________________________________________________________________________________
*** CID 1393964: (TAINTED_SCALAR)
/src/vendorcode/cavium/bdk/libdram/lib_octeon_shared.c: 682 in perform_ddr_init_sequence()
676
677 bdk_wait_usec(1000); /* Wait a while. */
678
679 if ((s = lookup_env_parameter("ddr_sequence1")) != NULL) {
680 int sequence1;
681 sequence1 = strtoul(s, NULL, 0);
>>> CID 1393964: (TAINTED_SCALAR)
>>> Passing tainted variable "sequence1" to a tainted sink.
682 perform_octeon3_ddr3_sequence(node, (1 << rankx),
683 ddr_interface_num, sequence1);
684 }
685
686 if ((s = lookup_env_parameter("ddr_sequence2")) != NULL) {
687 int sequence2;
/src/vendorcode/cavium/bdk/libdram/lib_octeon_shared.c: 689 in perform_ddr_init_sequence()
683 ddr_interface_num, sequence1);
684 }
685
686 if ((s = lookup_env_parameter("ddr_sequence2")) != NULL) {
687 int sequence2;
688 sequence2 = strtoul(s, NULL, 0);
>>> CID 1393964: (TAINTED_SCALAR)
>>> Passing tainted variable "sequence2" to a tainted sink.
689 perform_octeon3_ddr3_sequence(node, (1 << rankx),
690 ddr_interface_num, sequence2);
691 }
692 }
693 }
694 }
** CID 1393962: Null pointer dereferences (FORWARD_NULL)
________________________________________________________________________________________________________
*** CID 1393962: Null pointer dereferences (FORWARD_NULL)
/src/vendorcode/cavium/bdk/libbdk-dram/bdk-dram-test-addrbus.c: 64 in __bdk_dram_test_mem_address_bus()
58 {
59 int failures = 0;
60
61 /* Clear our work area. Checking for aliases later could get false
62 positives if it matched stale data */
63 void *ptr = (area) ? bdk_phys_to_ptr(area) : NULL;
>>> CID 1393962: Null pointer dereferences (FORWARD_NULL)
>>> Passing null pointer "ptr" to "bdk_zero_memory", which dereferences it.
64 bdk_zero_memory(ptr, max_address - area);
65 __bdk_dram_flush_to_mem_range(area, max_address);
66
67 /* Each time we write, we'll write this pattern xored the address it is
68 written too */
69 uint64_t pattern = 0x0fedcba987654321;
________________________________________________________________________________________________________
To view the defects in Coverity Scan visit, https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0...
2 months, 3 weeks
- 1
- 0
Announcing coreboot 4.10
by Patrick Georgi
The 4.10 release covers commit a2faaa9a2 to commit ae317695e3
There is a pgp signed 4.10 tag in the git repository, and a branch will
be created as needed.
In nearly 8 months since 4.9 we had 198 authors commit 2538 changes
to master. Of these, 85 authors made their first commit to coreboot:
Welcome!
Between the releases the tree grew by about 11000 lines of code plus
5000 lines of comments.
Again, a big Thank You to all contributors who helped shape the coreboot
project, community and code with their effort, no matter if through
development, review, testing, documentation or by helping people asking
questions on our venues like IRC or our mailing list.
What's New
----------
Most of the changes were to mainboards, and on the chipset side, lots
of activity concentrated on x86. However compared to previous releases
activity (and therefore interest, probably) increased in vboot and in
non-x86 architectures. However it's harder this time to give this release
a single topic like the last: This release accumulates some of everything.
Clean Up
--------
As usual, there was a lot of cleaning up going on, and there notably,
a good chunk of this year's Google Summer of Code project to clean out
the issues reported by Coverity Scan is already in.
The only larger scale change that was registered in the pre-release
notes was also about cleaning up the tree:
### `device_t` is no more
coreboot used to have a data type, `device_t` that changed shape depending on
whether it is compiled for romstage (with limited memory) or ramstage (with
unlimited memory as far as coreboot is concerned). It's an old relic from the
time when romstage wasn't operated in Cache-As-RAM mode, but compiled with
our romcc compiler.
That data type is now gone.
Release Notes maintenance
-------------------------
Speaking of pre-release notes: After 4.10 we'll start a document for
4.11 in the git repository. Feel free to add notable achievements there
so we remember to give them a shout out in the next release's notes.
Known Issues
------------
Sadly, Google Cyan is broken in this release. It doesn't work with the
"C environment" bootblock (as compared to the old romcc type bootblock)
which is now the default. Sadly it doesn't help to simply revert that
change because doing so breaks other boards.
If you want to use Google Cyan with the release (or if
you're tracking the master branch), please keep an eye on
https://review.coreboot.org/c/coreboot/+/34304 where a solution for this
issue is sought.
Deprecations
------------
As announced in the 4.9 release notes, there are no deprecations after 4.10.
While 4.10 is also released late and we target a 4.11 release in October we
nonetheless want to announce deprecations this time: These are under
discussion since January, people are working on mitigations for about as long
and so it should be possible to resolve the outstanding issues by the end of
October.
Specifically, we want to require code to work with the following Kconfig
options so we can remove the options and the code they disable:
* C\_ENVIRONMENT\_BOOTBLOCK
* NO\_CAR\_GLOBAL\_MIGRATION
* RELOCATABLE\_RAMSTAGE
These only affect x86. If your platform only works without them, please
look into fixing that.
Added 28 mainboards:
--------------------
* ASROCK H110M-DVS
* ASUS H61M-CS
* ASUS P5G41T-M-LX
* ASUS P5QPL-AM
* ASUS P8Z77-M-PRO
* FACEBOOK FBG1701
* FOXCONN G41M
* GIGABYTE GA-H61MA-D3V
* GOOGLE BLOOG
* GOOGLE FLAPJACK
* GOOGLE GARG
* GOOGLE HATCH-WHL
* GOOGLE HELIOS
* GOOGLE KINDRED
* GOOGLE KODAMA
* GOOGLE KOHAKU
* GOOGLE KRANE
* GOOGLE MISTRAL
* HP COMPAQ-8200-ELITE-SFF-PC
* INTEL COMETLAKE-RVP
* INTEL KBLRVP11
* LENOVO R500
* LENOVO X1
* MSI MS7707
* PORTWELL M107
* PURISM LIBREM13-V4
* PURISM LIBREM15-V4
* SUPERMICRO X10SLM-PLUS-F
* UP SQUARED
Removed 7 mainboards:
---------------------
* GOOGLE BIP
* GOOGLE DELAN
* GOOGLE ROWAN
* PCENGINES ALIX1C
* PCENGINES ALIX2C
* PCENGINES ALIX2D
* PCENGINES ALIX6
Removed 3 processors:
---------------------
* src/cpu/amd/geode\_lx
* src/cpu/intel/model\_69x
* src/cpu/intel/model\_6dx
Added 2 socs:
-------------
* src/soc/amd/picasso
* src/soc/qualcomm/qcs405
Toolchain
---------
* Update to gcc 8.3.0, binutils 2.32, IASL 20190509, clang 8
--
Google Germany GmbH, ABC-Str. 19, 20354 Hamburg
Registergericht und -nummer: Hamburg, HRB 86891, Sitz der Gesellschaft: Hamburg
Geschäftsführer: Paul Manicle, Halimah DeLaine Prado
2 months, 4 weeks
- 1
- 0