coreboot July 2021

coreboot@coreboot.org

21 participants
24 discussions

Question On External Display
by Rao G 30 Jul '21

30 Jul '21

Hi All, Hope you are doing well. Platform Baytrail Issue: Graphics External Display VBIOS/VBT data trying to see the MMIO or VBIOS data when a external display device is plugged/unplugged with DP/HDMI interface, which MMIO register is set or cleared Any inputs are appreciated, some of the registers tried on Port B/Port C are given below. when Display is connected and when Display is not connected, both these instances return the same data. Looking for register/bit that sets/clears when external display is connected/disconnected printk(BIOS_DEBUG, "Intel Gfx BAR GTTMMADR\n"); printk(BIOS_DEBUG, " DP_B %X\n", read32(bar+0x180000+0x64100)); printk(BIOS_DEBUG, " DP_C %X\n", read32(bar+0x180000+0x64200)); printk(BIOS_DEBUG, " HDMIC %X\n", read32(bar+0x180000+0x61160)); printk(BIOS_DEBUG, " HDMIB %X\n", read32(bar+0x180000+0x61140)); printk(BIOS_DEBUG, " Hotplug control %X\n", read32(bar+0x180000+0x61164)); printk(BIOS_DEBUG, " pipeA control %X\n", read32(bar+0x180000+0x61204)); printk(BIOS_DEBUG, " pipeB control %X\n", read32(bar+0x180000+0x61304)); printk(BIOS_DEBUG, " porthot plug stat %X\n", read32(bar+0x180000+0x61114)); *Display SPEC* https://01.org/sites/default/files/documentation/intel_os_gfx_prm_vol10_-_d… Thanks Rao

2 1

[RFT] Please help review and test the coreboot toolchain update to GCC 11.2
by Paul Menzel 28 Jul '21

28 Jul '21

Dear coreboot folks, Patrick prepared the GCC 11.2 for the coreboot toolchain (crossgcc) [1]. It’d be great if everybody gave it a go, and reviewed the change-sets. If somebody has a system (scripts) to compare the build artifacts of the current GCC 8.3.0 builds with GCC 11.2, it’d be awesome if these or the results could be shared. Kind regards, Paul [1]: https://review.coreboot.org/c/coreboot/+/54050 "util/crossgcc: Update gcc to 11.2"

1 0

GDB stub & bootblock dependencies (CONFIG_IDT_IN_EVERY_STAGE=y)
by Samek, Jan 26 Jul '21

26 Jul '21

Hello, I am currently developing on Intel TGLRVP-UP3, but this should be relevant for other TGL-based platforms and possibly all other that set CONFIG_IDT_IN_EVERY_STAGE=y: When I try to use the GDB stub for my debug attempts on TGL (CONFIG_GDB_STUB=y), I get the following 'undefined reference' errors during the bootblock linkage process: src/arch/x86/exception.c:225: undefined reference to `gdb_tx_byte' src/arch/x86/exception.c:225: undefined reference to `gdb_tx_byte' src/arch/x86/exception.c:225: undefined reference to `gdb_tx_byte' src/arch/x86/exception.c:230: undefined reference to `gdb_tx_flush' src/arch/x86/exception.c:230: undefined reference to `gdb_tx_flush' src/arch/x86/exception.c:230: undefined reference to `gdb_tx_flush' src/arch/x86/exception.c:235: undefined reference to `gdb_rx_byte' util/crossgcc/xgcc/bin/i386-elf-ld.bfd: src/arch/x86/exception.c:225: undefined reference to `gdb_tx_byte' util/crossgcc/xgcc/bin/i386-elf-ld.bfd: src/arch/x86/exception.c:225: undefined reference to `gdb_tx_byte' util/crossgcc/xgcc/bin/i386-elf-ld.bfd: src/arch/x86/exception.c:225: undefined reference to `gdb_tx_byte' util/crossgcc/xgcc/bin/i386-elf-ld.bfd: src/arch/x86/exception.c:225: undefined reference to `gdb_tx_byte' util/crossgcc/xgcc/bin/i386-elf-ld.bfd: src/arch/x86/exception.c:235: undefined reference to `gdb_rx_byte' util/crossgcc/xgcc/bin/i386-elf-ld.bfd: src/arch/x86/exception.c:235: undefined reference to `gdb_rx_byte' util/crossgcc/xgcc/bin/i386-elf-ld.bfd: src/arch/x86/exception.c:235: undefined reference to `gdb_rx_byte' util/crossgcc/xgcc/bin/i386-elf-ld.bfd: src/arch/x86/exception.c:235: undefined reference to `gdb_rx_byte' The gdb_*() functions used in exception.c are defined in src/console/console.c. Nevertheless, the problem with the functions in question is that they're defined under '#if CONFIG(GDB_STUB) && (ENV_ROMSTAGE || ENV_RAMSTAGE)' which obviously doesn't allow them to be compiled into the bootblock code while they're unconditionally (there's only the IDT_IN_EVERY_STAGE condition) referenced in exception.c Looking at src/arch/x86/Makefile.inc (filtering out only the lines of interest), it's apparent that exception.c is linked in all stages when the IDT_IN_EVERY_STAGE option is set: 76: bootblock-$(CONFIG_IDT_IN_EVERY_STAGE) += exception.c 111: verstage-$(CONFIG_IDT_IN_EVERY_STAGE) += exception.c 148: romstage-$(CONFIG_IDT_IN_EVERY_STAGE) += exception.c 187: postcar-$(CONFIG_IDT_IN_EVERY_STAGE) += exception.c 229: ramstage-y += exception.c 291: smm-$(CONFIG_IDT_IN_EVERY_STAGE) += exception.c The behavior appears in revision b90aba43c1405d3d2cb7cba05e68906e979dcda3 (master). To reproduce, - run 'make menuconfig', - select 'Mainboard ->Mainboard Vendor': 'Intel', - select 'Mainboard -> Mainboard Model': 'Tiger Lake UP3 RVP', - select 'Debugging -> GDB debugging support': 'y'. - run 'make'. What do you think would be the best approach to make the GDB stub work on these platforms? P.S. My bug tracker registration is currently pending an approval, I could be able to create a ticket afterwards. Regards, Jan

3 4

Re: RFC: On testing and reporting how well coreboot does on real hardware
by Daniel Kulesz 17 Jul '21

17 Jul '21

Hi Piotr, Patrick et al., actually, there is dedicated software to achieve exactly what you are talking about. I initiated the SystemTestPortal project [1] a while ago to provide an open source solution that focuses on simplicity and low entry barriers - you can watch my 2019 talk at FrOsCon [2] to get a first overview. Currently, the project is stalled and, thus, the software is ready for production due to the lack of maintenance. However I plan tp resume the project soon. There are also other open source projects that provide similar solutions in this space. Yet, I must confess that to date I had a really hard time convincing developers to give our tool a serious try. While this might be due to bugs in the tool itself, I think it is mainly because many developers and project leaders don't buy into such a "community testing" approach as they think that the only right way to test software is through test automation. I think that coreboot is a perfect example of a project that could benefit from such a tool (not necessarily our tool, but one from this category). Cheers, Daniel [1] https://www.systemtestportal.org/ [2] https://media.ccc.de/v/froscon2019-2359-testing_software_yes_please

3 3

New Defects reported by Coverity Scan for coreboot
by scan-admin＠coverity.com 16 Jul '21

16 Jul '21

Hi, Please find the latest report on new defect(s) introduced to coreboot found with Coverity Scan. 26 new defect(s) introduced to coreboot found with Coverity Scan. 2 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 20 of 26 defect(s) ** CID 1458462: Resource leaks (RESOURCE_LEAK) /util/kconfig/confdata.c: 1149 in conf_write_autoconf() ________________________________________________________________________________________________________ *** CID 1458462: Resource leaks (RESOURCE_LEAK) /util/kconfig/confdata.c: 1149 in conf_write_autoconf() 1143 return 1; 1144 1145 name = getenv("KCONFIG_AUTOHEADER"); 1146 if (!name) 1147 name = "include/generated/autoconf.h"; 1148 if (make_parent_dir(name)) >>> CID 1458462: Resource leaks (RESOURCE_LEAK) >>> Variable "out" going out of scope leaks the storage it points to. 1149 return 1; 1150 char filename_h[PATH_MAX]; 1151 int fd_h = conf_mktemp(name, filename_h); 1152 if (fd_h == -1) 1153 return 1; 1154 out_h = fdopen(fd_h, "w"); ** CID 1458461: Resource leaks (RESOURCE_LEAK) /util/kconfig/menu.c: 212 in menu_add_symbol() ________________________________________________________________________________________________________ *** CID 1458461: Resource leaks (RESOURCE_LEAK) /util/kconfig/menu.c: 212 in menu_add_symbol() 206 { 207 menu_add_prop(type, expr, dep); 208 } 209 210 void menu_add_symbol(enum prop_type type, struct symbol *sym, struct expr *dep) 211 { >>> CID 1458461: Resource leaks (RESOURCE_LEAK) >>> Ignoring storage allocated by "menu_add_prop(type, expr_alloc_symbol(sym), dep)" leaks it. 212 menu_add_prop(type, expr_alloc_symbol(sym), dep); 213 } 214 215 static int menu_validate_number(struct symbol *sym, struct symbol *sym2) 216 { 217 return sym2->type == S_INT || sym2->type == S_HEX || ** CID 1458460: Security best practices violations (STRING_OVERFLOW) /util/kconfig/confdata.c: 1049 in conf_touch_deps() ________________________________________________________________________________________________________ *** CID 1458460: Security best practices violations (STRING_OVERFLOW) /util/kconfig/confdata.c: 1049 in conf_touch_deps() 1043 static int conf_touch_deps(void) 1044 { 1045 const char *name; 1046 struct symbol *sym; 1047 int res, i; 1048 >>> CID 1458460: Security best practices violations (STRING_OVERFLOW) >>> You might overrun the 4096-character fixed-size string "depfile_path" by copying the return value of "conf_get_autobase_name" without checking the length. 1049 strcpy(depfile_path, conf_get_autobase_name()); 1050 depfile_prefix_len = strlen(depfile_path); 1051 1052 name = conf_get_autoconfig_name(); 1053 conf_read_simple(name, S_DEF_AUTO); 1054 sym_calc_value(modules_sym); ** CID 1458459: Resource leaks (RESOURCE_LEAK) /util/kconfig/menu.c: 207 in menu_add_expr() ________________________________________________________________________________________________________ *** CID 1458459: Resource leaks (RESOURCE_LEAK) /util/kconfig/menu.c: 207 in menu_add_expr() 201 current_entry->visibility = expr_alloc_and(current_entry->visibility, 202 expr); 203 } 204 205 void menu_add_expr(enum prop_type type, struct expr *expr, struct expr *dep) 206 { >>> CID 1458459: Resource leaks (RESOURCE_LEAK) >>> Ignoring storage allocated by "menu_add_prop(type, expr, dep)" leaks it. 207 menu_add_prop(type, expr, dep); 208 } 209 210 void menu_add_symbol(enum prop_type type, struct symbol *sym, struct expr *dep) 211 { 212 menu_add_prop(type, expr_alloc_symbol(sym), dep); ** CID 1458458: Null pointer dereferences (FORWARD_NULL) /util/kconfig/menu.c: 820 in get_symbol_str() ________________________________________________________________________________________________________ *** CID 1458458: Null pointer dereferences (FORWARD_NULL) /util/kconfig/menu.c: 820 in get_symbol_str() 814 str_append(r, "\n"); 815 } 816 } 817 } 818 819 /* Print the definitions with prompts before the ones without */ >>> CID 1458458: Null pointer dereferences (FORWARD_NULL) >>> Dereferencing null pointer "sym". 820 for_all_properties(sym, prop, P_SYMBOL) { 821 if (prop->menu->prompt) { 822 get_def_str(r, prop->menu); 823 get_prompt_str(r, prop->menu->prompt, head); 824 } 825 } ** CID 1458457: Security best practices violations (SECURE_TEMP) /util/kconfig/confdata.c: 890 in conf_mktemp() ________________________________________________________________________________________________________ *** CID 1458457: Security best practices violations (SECURE_TEMP) /util/kconfig/confdata.c: 890 in conf_mktemp() 884 static int conf_mktemp(const char *path, char *tmpfile) 885 { 886 if (snprintf(tmpfile, PATH_MAX, "%s.tmp.XXXXXX", path) >= PATH_MAX) { 887 errno = EOVERFLOW; 888 return -1; 889 } >>> CID 1458457: Security best practices violations (SECURE_TEMP) >>> Calling "mkstemp" without securely setting umask first. 890 return mkstemp(tmpfile); 891 } 892 893 int conf_write(const char *name) 894 { 895 FILE *out; ** CID 1425175: Resource leaks (RESOURCE_LEAK) /util/kconfig/confdata.c: 84 in is_same() ________________________________________________________________________________________________________ *** CID 1425175: Resource leaks (RESOURCE_LEAK) /util/kconfig/confdata.c: 84 in is_same() 78 ret = true; 79 close2: 80 close(fd2); 81 close1: 82 close(fd1); 83 >>> CID 1425175: Resource leaks (RESOURCE_LEAK) >>> Variable "map1" going out of scope leaks the storage it points to. 84 return ret; 85 } 86 87 /* 88 * Create the parent directory of the given path. 89 * ** CID 1425144: Null pointer dereferences (FORWARD_NULL) /util/kconfig/symbol.c: 1078 in sym_check_print_recursive() ________________________________________________________________________________________________________ *** CID 1425144: Null pointer dereferences (FORWARD_NULL) /util/kconfig/symbol.c: 1078 in sym_check_print_recursive() 1072 menu = prop->menu; 1073 if (prop->menu) 1074 break; 1075 } 1076 } 1077 if (stack->sym == last_sym) >>> CID 1425144: Null pointer dereferences (FORWARD_NULL) >>> Dereferencing null pointer "prop". 1078 fprintf(stderr, "%s:%d:error: recursive dependency detected!\n", 1079 prop->file->name, prop->lineno); 1080 1081 if (sym_is_choice(sym)) { 1082 fprintf(stderr, "%s:%d:\tchoice %s contains symbol %s\n", 1083 menu->file->name, menu->lineno, ** CID 1425116: (TAINTED_SCALAR) ________________________________________________________________________________________________________ *** CID 1425116: (TAINTED_SCALAR) /util/kconfig/confdata.c: 1130 in conf_write_autoconf() 1124 if (!overwrite && is_present(autoconf_name)) 1125 return 0; 1126 1127 char autoconfcmd_path[PATH_MAX]; 1128 snprintf(autoconfcmd_path, sizeof(autoconfcmd_path), "%s%s", 1129 conf_get_autobase_name(), "auto.conf.cmd"); >>> CID 1425116: (TAINTED_SCALAR) >>> Passing tainted variable "autoconfcmd_path" to a tainted sink. 1130 conf_write_dep(autoconfcmd_path); 1131 1132 if (conf_touch_deps()) 1133 return 1; 1134 1135 if (make_parent_dir(autoconf_name)) /util/kconfig/confdata.c: 1148 in conf_write_autoconf() 1142 if (!out) 1143 return 1; 1144 1145 name = getenv("KCONFIG_AUTOHEADER"); 1146 if (!name) 1147 name = "include/generated/autoconf.h"; >>> CID 1425116: (TAINTED_SCALAR) >>> Passing tainted variable "name" to a tainted sink. 1148 if (make_parent_dir(name)) 1149 return 1; 1150 char filename_h[PATH_MAX]; 1151 int fd_h = conf_mktemp(name, filename_h); 1152 if (fd_h == -1) 1153 return 1; /util/kconfig/confdata.c: 1135 in conf_write_autoconf() 1129 conf_get_autobase_name(), "auto.conf.cmd"); 1130 conf_write_dep(autoconfcmd_path); 1131 1132 if (conf_touch_deps()) 1133 return 1; 1134 >>> CID 1425116: (TAINTED_SCALAR) >>> Passing tainted variable "autoconf_name" to a tainted sink. 1135 if (make_parent_dir(autoconf_name)) 1136 return 1; 1137 char filename[PATH_MAX]; 1138 int fd = conf_mktemp(autoconf_name, filename); 1139 if (fd == -1) 1140 return 1; ** CID 1425106: Resource leaks (RESOURCE_LEAK) /util/kconfig/confdata.c: 84 in is_same() ________________________________________________________________________________________________________ *** CID 1425106: Resource leaks (RESOURCE_LEAK) /util/kconfig/confdata.c: 84 in is_same() 78 ret = true; 79 close2: 80 close(fd2); 81 close1: 82 close(fd1); 83 >>> CID 1425106: Resource leaks (RESOURCE_LEAK) >>> Variable "map2" going out of scope leaks the storage it points to. 84 return ret; 85 } 86 87 /* 88 * Create the parent directory of the given path. 89 * ** CID 1425096: Insecure data handling (TAINTED_SCALAR) ________________________________________________________________________________________________________ *** CID 1425096: Insecure data handling (TAINTED_SCALAR) /util/kconfig/confdata.c: 917 in conf_write() 911 912 if (is_dir(name)) { 913 fprintf(stderr, "%s: Is a directory\n", name); 914 return -1; 915 } 916 >>> CID 1425096: Insecure data handling (TAINTED_SCALAR) >>> Passing tainted variable "name" to a tainted sink. 917 if (make_parent_dir(name)) 918 return -1; 919 920 env = getenv("KCONFIG_OVERWRITECONFIG"); 921 if (env && *env) { 922 *tmpname = 0; ** CID 1425085: Incorrect expression (COPY_PASTE_ERROR) /util/kconfig/expr.c: 537 in expr_join_and() ________________________________________________________________________________________________________ *** CID 1425085: Incorrect expression (COPY_PASTE_ERROR) /util/kconfig/expr.c: 537 in expr_join_and() 531 // (a) && (a!='n') -> (a) 532 return expr_alloc_symbol(sym1); 533 534 if ((e1->type == E_SYMBOL && e2->type == E_UNEQUAL && e2->right.sym == &symbol_mod) || 535 (e2->type == E_SYMBOL && e1->type == E_UNEQUAL && e1->right.sym == &symbol_mod)) 536 // (a) && (a!='m') -> (a='y') >>> CID 1425085: Incorrect expression (COPY_PASTE_ERROR) >>> "symbol_yes" in "&symbol_yes" looks like a copy-paste error. 537 return expr_alloc_comp(E_EQUAL, sym1, &symbol_yes); 538 539 if (sym1->type == S_TRISTATE) { 540 if (e1->type == E_EQUAL && e2->type == E_UNEQUAL) { 541 // (a='b') && (a!='c') -> 'b'='c' ? 'n' : a='b' 542 sym2 = e1->right.sym; ** CID 1425081: Control flow issues (MISSING_BREAK) /util/kconfig/expr.c: 1112 in expr_compare_type() ________________________________________________________________________________________________________ *** CID 1425081: Control flow issues (MISSING_BREAK) /util/kconfig/expr.c: 1112 in expr_compare_type() 1106 if (t1 == t2) 1107 return 0; 1108 switch (t1) { 1109 case E_LEQ: 1110 case E_LTH: 1111 case E_GEQ: >>> CID 1425081: Control flow issues (MISSING_BREAK) >>> The case for value "E_GTH" is not terminated by a 'break' statement. 1112 case E_GTH: 1113 if (t2 == E_EQUAL || t2 == E_UNEQUAL) 1114 return 1; 1115 case E_EQUAL: 1116 case E_UNEQUAL: 1117 if (t2 == E_NOT) ** CID 1425079: Control flow issues (UNREACHABLE) /util/kconfig/expr.c: 1134 in expr_compare_type() ________________________________________________________________________________________________________ *** CID 1425079: Control flow issues (UNREACHABLE) /util/kconfig/expr.c: 1134 in expr_compare_type() 1128 case E_LIST: 1129 if (t2 == 0) 1130 return 1; 1131 default: 1132 return -1; 1133 } >>> CID 1425079: Control flow issues (UNREACHABLE) >>> This code cannot be reached: "printf("[%dgt%d?]", t1, t2);". 1134 printf("[%dgt%d?]", t1, t2); 1135 return 0; 1136 } 1137 1138 void expr_print(struct expr *e, 1139 void (*fn)(void *, struct symbol *, const char *), ** CID 1425063: Null pointer dereferences (REVERSE_INULL) /util/kconfig/confdata.c: 526 in conf_read_simple() ________________________________________________________________________________________________________ *** CID 1425063: Null pointer dereferences (REVERSE_INULL) /util/kconfig/confdata.c: 526 in conf_read_simple() 520 conf_warning("unexpected data: %.*s", 521 (int)strcspn(line, "\r\n"), line); 522 523 continue; 524 } 525 >>> CID 1425063: Null pointer dereferences (REVERSE_INULL) >>> Null-checking "sym" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 526 if (sym && sym_is_choice_value(sym)) { 527 struct symbol *cs = prop_get_symbol(sym_get_choice_prop(sym)); 528 switch (sym->def[def].tri) { 529 case no: 530 break; 531 case mod: ** CID 1425039: Error handling issues (CHECKED_RETURN) /util/kconfig/confdata.c: 1039 in conf_write_dep() ________________________________________________________________________________________________________ *** CID 1425039: Error handling issues (CHECKED_RETURN) /util/kconfig/confdata.c: 1039 in conf_write_dep() 1033 1034 env_write_dep(out, conf_get_autoconfig_name()); 1035 1036 fprintf(out, "\n$(deps_config): ;\n"); 1037 fclose(out); 1038 >>> CID 1425039: Error handling issues (CHECKED_RETURN) >>> Calling "rename(filename, name)" without checking return value. This library function may fail and return an error code. 1039 rename(filename, name); 1040 return 0; 1041 } 1042 1043 static int conf_touch_deps(void) 1044 { ** CID 1425010: Security best practices violations (DC.WEAK_CRYPTO) /util/kconfig/conf.c: 251 in conf_set_all_new_symbols() ________________________________________________________________________________________________________ *** CID 1425010: Security best practices violations (DC.WEAK_CRYPTO) /util/kconfig/conf.c: 251 in conf_set_all_new_symbols() 245 break; 246 case def_no: 247 sym->def[S_DEF_USER].tri = no; 248 break; 249 case def_random: 250 sym->def[S_DEF_USER].tri = no; >>> CID 1425010: Security best practices violations (DC.WEAK_CRYPTO) >>> "rand" should not be used for security-related applications, because linear congruential algorithms are too easy to break. 251 cnt = rand() % 100; 252 if (sym->type == S_TRISTATE) { 253 if (cnt < pty) 254 sym->def[S_DEF_USER].tri = yes; 255 else if (cnt < pty + ptm) 256 sym->def[S_DEF_USER].tri = mod; ** CID 1425007: (RESOURCE_LEAK) /util/kconfig/expr.c: 949 in expr_trans_compare() /util/kconfig/expr.c: 939 in expr_trans_compare() ________________________________________________________________________________________________________ *** CID 1425007: (RESOURCE_LEAK) /util/kconfig/expr.c: 949 in expr_trans_compare() 943 case E_OR: 944 e1 = expr_trans_compare(e->left.expr, E_EQUAL, sym); 945 e2 = expr_trans_compare(e->right.expr, E_EQUAL, sym); 946 if (sym == &symbol_yes) 947 e = expr_alloc_two(E_OR, e1, e2); 948 if (sym == &symbol_no) >>> CID 1425007: (RESOURCE_LEAK) >>> Overwriting "e" in "e = expr_alloc_two(E_AND, e1, e2)" leaks the storage that "e" points to. 949 e = expr_alloc_two(E_AND, e1, e2); 950 if (type == E_UNEQUAL) 951 e = expr_alloc_one(E_NOT, e); 952 return e; 953 case E_NOT: 954 return expr_trans_compare(e->left.expr, type == E_EQUAL ? E_UNEQUAL : E_EQUAL, sym); /util/kconfig/expr.c: 939 in expr_trans_compare() 933 case E_AND: 934 e1 = expr_trans_compare(e->left.expr, E_EQUAL, sym); 935 e2 = expr_trans_compare(e->right.expr, E_EQUAL, sym); 936 if (sym == &symbol_yes) 937 e = expr_alloc_two(E_AND, e1, e2); 938 if (sym == &symbol_no) >>> CID 1425007: (RESOURCE_LEAK) >>> Overwriting "e" in "e = expr_alloc_two(E_OR, e1, e2)" leaks the storage that "e" points to. 939 e = expr_alloc_two(E_OR, e1, e2); 940 if (type == E_UNEQUAL) 941 e = expr_alloc_one(E_NOT, e); 942 return e; 943 case E_OR: 944 e1 = expr_trans_compare(e->left.expr, E_EQUAL, sym); ** CID 1424942: (REVERSE_INULL) /payloads/coreinfo/build/util/kconfig/lexer.lex.c: 4017 in zconf_fopen() /payloads/coreinfo/libpayload/util/lp_kconfig/lexer.lex.c: 4017 in zconf_fopen() /payloads/libpayload/build/util/lp_kconfig/lexer.lex.c: 4017 in zconf_fopen() /cb-build/coreboot-coverity.0/default/sharedutils/kconfig/lexer.lex.c: 4017 in zconf_fopen() /build/util/kconfig/lexer.lex.c: 4017 in zconf_fopen() /cb-build/coreboot-coverity.0/chromeos/sharedutils/kconfig/lexer.lex.c: 4017 in zconf_fopen() /payloads/nvramcui/libpayload/util/lp_kconfig/lexer.lex.c: 4017 in zconf_fopen() ________________________________________________________________________________________________________ *** CID 1424942: (REVERSE_INULL) /payloads/coreinfo/build/util/kconfig/lexer.lex.c: 4017 in zconf_fopen() 4011 FILE *zconf_fopen(const char *name) 4012 { 4013 char *env, fullname[PATH_MAX+1]; 4014 FILE *f; 4015 4016 f = fopen(name, "r"); >>> CID 1424942: (REVERSE_INULL) >>> Null-checking "name" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 4017 if (!f && name != NULL && name[0] != '/') { 4018 env = getenv(SRCTREE); 4019 if (env) { 4020 snprintf(fullname, sizeof(fullname), 4021 "%s/%s", env, name); 4022 f = fopen(fullname, "r"); /payloads/coreinfo/libpayload/util/lp_kconfig/lexer.lex.c: 4017 in zconf_fopen() 4011 FILE *zconf_fopen(const char *name) 4012 { 4013 char *env, fullname[PATH_MAX+1]; 4014 FILE *f; 4015 4016 f = fopen(name, "r"); >>> CID 1424942: (REVERSE_INULL) >>> Null-checking "name" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 4017 if (!f && name != NULL && name[0] != '/') { 4018 env = getenv(SRCTREE); 4019 if (env) { 4020 snprintf(fullname, sizeof(fullname), 4021 "%s/%s", env, name); 4022 f = fopen(fullname, "r"); /payloads/libpayload/build/util/lp_kconfig/lexer.lex.c: 4017 in zconf_fopen() 4011 FILE *zconf_fopen(const char *name) 4012 { 4013 char *env, fullname[PATH_MAX+1]; 4014 FILE *f; 4015 4016 f = fopen(name, "r"); >>> CID 1424942: (REVERSE_INULL) >>> Null-checking "name" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 4017 if (!f && name != NULL && name[0] != '/') { 4018 env = getenv(SRCTREE); 4019 if (env) { 4020 snprintf(fullname, sizeof(fullname), 4021 "%s/%s", env, name); 4022 f = fopen(fullname, "r"); /cb-build/coreboot-coverity.0/default/sharedutils/kconfig/lexer.lex.c: 4017 in zconf_fopen() 4011 FILE *zconf_fopen(const char *name) 4012 { 4013 char *env, fullname[PATH_MAX+1]; 4014 FILE *f; 4015 4016 f = fopen(name, "r"); >>> CID 1424942: (REVERSE_INULL) >>> Null-checking "name" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 4017 if (!f && name != NULL && name[0] != '/') { 4018 env = getenv(SRCTREE); 4019 if (env) { 4020 snprintf(fullname, sizeof(fullname), 4021 "%s/%s", env, name); 4022 f = fopen(fullname, "r"); /build/util/kconfig/lexer.lex.c: 4017 in zconf_fopen() 4011 FILE *zconf_fopen(const char *name) 4012 { 4013 char *env, fullname[PATH_MAX+1]; 4014 FILE *f; 4015 4016 f = fopen(name, "r"); >>> CID 1424942: (REVERSE_INULL) >>> Null-checking "name" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 4017 if (!f && name != NULL && name[0] != '/') { 4018 env = getenv(SRCTREE); 4019 if (env) { 4020 snprintf(fullname, sizeof(fullname), 4021 "%s/%s", env, name); 4022 f = fopen(fullname, "r"); /cb-build/coreboot-coverity.0/chromeos/sharedutils/kconfig/lexer.lex.c: 4017 in zconf_fopen() 4011 FILE *zconf_fopen(const char *name) 4012 { 4013 char *env, fullname[PATH_MAX+1]; 4014 FILE *f; 4015 4016 f = fopen(name, "r"); >>> CID 1424942: (REVERSE_INULL) >>> Null-checking "name" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 4017 if (!f && name != NULL && name[0] != '/') { 4018 env = getenv(SRCTREE); 4019 if (env) { 4020 snprintf(fullname, sizeof(fullname), 4021 "%s/%s", env, name); 4022 f = fopen(fullname, "r"); /payloads/nvramcui/libpayload/util/lp_kconfig/lexer.lex.c: 4017 in zconf_fopen() 4011 FILE *zconf_fopen(const char *name) 4012 { 4013 char *env, fullname[PATH_MAX+1]; 4014 FILE *f; 4015 4016 f = fopen(name, "r"); >>> CID 1424942: (REVERSE_INULL) >>> Null-checking "name" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 4017 if (!f && name != NULL && name[0] != '/') { 4018 env = getenv(SRCTREE); 4019 if (env) { 4020 snprintf(fullname, sizeof(fullname), 4021 "%s/%s", env, name); 4022 f = fopen(fullname, "r"); ** CID 1424938: Control flow issues (MISSING_BREAK) /util/kconfig/expr.c: 1125 in expr_compare_type() ________________________________________________________________________________________________________ *** CID 1424938: Control flow issues (MISSING_BREAK) /util/kconfig/expr.c: 1125 in expr_compare_type() 1119 case E_NOT: 1120 if (t2 == E_AND) 1121 return 1; 1122 case E_AND: 1123 if (t2 == E_OR) 1124 return 1; >>> CID 1424938: Control flow issues (MISSING_BREAK) >>> The case for value "E_OR" is not terminated by a 'break' statement. 1125 case E_OR: 1126 if (t2 == E_LIST) 1127 return 1; 1128 case E_LIST: 1129 if (t2 == 0) 1130 return 1; ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

RFC: On testing and reporting how well coreboot does on real hardware
by Patrick Georgi 15 Jul '21

15 Jul '21

Hi everybody, There has been some talk recently in a smaller group where coreboot needs to improve the most in public perception, and how to get there. Consensus has been that we're doing a pretty bad job at promoting all the hardware that we support in each coreboot version. There's board-status which I started _years_ ago in the hope that somebody picks up the slack, but everybody has been busy, myself included. By now the collected information of the last 7.5 years is compiled into a 12MB HTML file that takes ages to render on moderate hardware (beware: https://www.coreboot.org/status/board-status.html), and the process to collect that data is mostly manual using pretty poor tooling. (Most of the links on that page don't even work anymore (which I'll fix) due to gitweb/cgit/gitiles changes on review.coreboot.org (and I only noticed by chance now).) Meanwhile, there are several parties that boot test the hardware they care about regularly, with (often internal) information about how well coreboot does there. We can't expect all those existing systems to converge into a single testing framework, but we could make it a single test result reporting framework. To this end, I invite people interested in that topic to chime in on this email thread so that we can discuss what we could do to provide a common place with information about which coreboot versions are bootable on which boards in a way that makes sense for everybody: users who are interested in such data as well as testers that already collect it but have no way to publish it. Thanks, Patrick -- Google Germany GmbH, ABC-Str. 19, 20354 Hamburg Registergericht und -nummer: Hamburg, HRB 86891, Sitz der Gesellschaft: Hamburg Geschäftsführer: Paul Manicle, Halimah DeLaine Prado

4 4

Adding support for asynchronous operations
by Raul Rangel 15 Jul '21

15 Jul '21

Hello coreboot community, One of coreboot's goals (according to the home page) is to be lightning fast! I'm currently working on improving the boot time for the AMD Cezanne platform. One place where we spend a decent amount of time is reading from SPI flash. We have the SPI speed/modes set to the optimal settings for our platforms, but there is still room for improvement. One feature the AMD platforms provide is a SPI DMA controller. It allows performing upto 64 KiB reads from SPI to RAM without the CPU being involved. This opens up the door for parallelizing SPI reads and coreboot execution. This effectively makes SPI read times 0 as far as the BSP is concerned (assuming you can preload early enough). Another difference between the latest AMD SoCs (Picasso, Cezanne), is that RAM is available in bootblock. This means that we can preload compressed stages into RAM before they are required. This will require a larger RAM footprint. The question is, how do we model these asynchronous operations, how is data ownership handled, and how does the BSP know the operation is done? I have proposed a Futures API [here](https://review.coreboot.org/c/coreboot/+/56047) that I think addresses all the questions. I think it is simple to understand, hard for consumers to misuse, and pretty straightforward to implement. The patch train also contains adding a `readat_async` to `rdev`, adding `cbfs_load_async`, APOB (i.e., MRC) preloading, and compressed payload preloading. This so far has saved over 30ms. I still have the goal of preloading the VBIOS, uCode, and ramstage. I want to do all of this while adding minimal complexity to the synchronous path. I'm curious to see what the community thinks, and welcome any feedback. Thanks, Raul

3 5

New Defects reported by Coverity Scan for coreboot
by scan-admin＠coverity.com 13 Jul '21

13 Jul '21

Hi, Please find the latest report on new defect(s) introduced to coreboot found with Coverity Scan. 2 new defect(s) introduced to coreboot found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 2 of 2 defect(s) ** CID 1458232: Null pointer dereferences (REVERSE_INULL) /src/drivers/usb/acpi/usb_acpi.c: 130 in usb_acpi_get_pld() ________________________________________________________________________________________________________ *** CID 1458232: Null pointer dereferences (REVERSE_INULL) /src/drivers/usb/acpi/usb_acpi.c: 130 in usb_acpi_get_pld() 124 }; 125 126 bool usb_acpi_get_pld(const struct device *usb_device, struct acpi_pld *pld) 127 { 128 struct drivers_usb_acpi_config *config = usb_device->chip_info; 129 >>> CID 1458232: Null pointer dereferences (REVERSE_INULL) >>> Null-checking "usb_device" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 130 if (!usb_device || !usb_device->chip_info || 131 usb_device->chip_ops != &drivers_usb_acpi_ops) 132 return false; 133 134 if (config->use_custom_pld) 135 memcpy(pld, &config->custom_pld, sizeof(pld)); ** CID 1458231: Incorrect expression (SIZEOF_MISMATCH) /src/drivers/usb/acpi/usb_acpi.c: 135 in usb_acpi_get_pld() ________________________________________________________________________________________________________ *** CID 1458231: Incorrect expression (SIZEOF_MISMATCH) /src/drivers/usb/acpi/usb_acpi.c: 135 in usb_acpi_get_pld() 129 130 if (!usb_device || !usb_device->chip_info || 131 usb_device->chip_ops != &drivers_usb_acpi_ops) 132 return false; 133 134 if (config->use_custom_pld) >>> CID 1458231: Incorrect expression (SIZEOF_MISMATCH) >>> Passing argument "pld" of type "struct acpi_pld *" and argument "4UL /* sizeof (pld) */" to function "memcpy" is suspicious. 135 memcpy(pld, &config->custom_pld, sizeof(pld)); 136 else 137 acpi_pld_fill_usb(pld, config->type, &config->group); 138 139 return true; ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

Coreboot
by Jonatan Dolot 11 Jul '21

11 Jul '21

When I install coreboot on lenovo thinkpad 11e (3rd gen) it will disable intel ME ? (Intel Management Engine)

2 2

New Defects reported by Coverity Scan for coreboot
by scan-admin＠coverity.com 06 Jul '21

06 Jul '21

Hi, Please find the latest report on new defect(s) introduced to coreboot found with Coverity Scan. 12 new defect(s) introduced to coreboot found with Coverity Scan. 2 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 12 of 12 defect(s) ** CID 1458079: Integer handling issues (CONSTANT_EXPRESSION_RESULT) /src/soc/intel/alderlake/crashlog.c: 68 in pmc_cl_discovery() ________________________________________________________________________________________________________ *** CID 1458079: Integer handling issues (CONSTANT_EXPRESSION_RESULT) /src/soc/intel/alderlake/crashlog.c: 68 in pmc_cl_discovery() 62 tmp_bar_addr = SPI_BASE_ADDRESS; 63 pci_write_config32(PCH_DEV_SRAM, PCI_BASE_ADDRESS_0, tmp_bar_addr); 64 pci_or_config16(PCH_DEV_SRAM, PCI_COMMAND, PCI_COMMAND_MEMORY); 65 66 if (discovery_buf.bits.discov_mechanism == 1) { 67 /* discovery mode */ >>> CID 1458079: Integer handling issues (CONSTANT_EXPRESSION_RESULT) >>> "discovery_buf.bits.base_offset & (2147483648UL /* 1UL << 31 */)" is always 0 regardless of the values of its operands. This occurs as the logical operand of "if". 68 if (discovery_buf.bits.base_offset & BIT(31)) { 69 printk(BIOS_DEBUG, "PCH discovery to be used is disabled.\n"); 70 m_pmc_crashLog_present = false; 71 m_pmc_crashLog_size = 0; 72 return false; 73 } ** CID 1458078: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1458078: Null pointer dereferences (FORWARD_NULL) /src/soc/intel/alderlake/crashlog.c: 45 in pmc_cl_discovery() 39 40 cmd_reg = pmc_make_ipc_cmd(PMC_IPC_CMD_CRASHLOG, 41 PMC_IPC_CMD_ID_CRASHLOG_DISCOVERY, 42 PMC_IPC_CMD_SIZE_SHIFT); 43 printk(BIOS_DEBUG, "cmd_reg from pmc_make_ipc_cmd %d\n", cmd_reg); 44 >>> CID 1458078: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "req" to "pmc_send_ipc_cmd", which dereferences it. 45 r = pmc_send_ipc_cmd(cmd_reg, req, res); 46 47 if (r < 0) { 48 printk(BIOS_ERR, "pmc_send_ipc_cmd failed in %s\n", __func__); 49 return false; 50 } ** CID 1458077: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1458077: Null pointer dereferences (FORWARD_NULL) /src/soc/intel/alderlake/crashlog.c: 45 in pmc_cl_discovery() 39 40 cmd_reg = pmc_make_ipc_cmd(PMC_IPC_CMD_CRASHLOG, 41 PMC_IPC_CMD_ID_CRASHLOG_DISCOVERY, 42 PMC_IPC_CMD_SIZE_SHIFT); 43 printk(BIOS_DEBUG, "cmd_reg from pmc_make_ipc_cmd %d\n", cmd_reg); 44 >>> CID 1458077: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "res" to "pmc_send_ipc_cmd", which dereferences it. 45 r = pmc_send_ipc_cmd(cmd_reg, req, res); 46 47 if (r < 0) { 48 printk(BIOS_ERR, "pmc_send_ipc_cmd failed in %s\n", __func__); 49 return false; 50 } ** CID 1458076: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1458076: Null pointer dereferences (FORWARD_NULL) /src/soc/intel/common/block/crashlog/crashlog.c: 256 in cl_pmc_en_gen_on_all_reboot() 250 int r; 251 252 cmd_reg = pmc_make_ipc_cmd(PMC_IPC_CMD_CRASHLOG, 253 PMC_IPC_CMD_ID_CRASHLOG_ON_RESET, 254 PMC_IPC_CMD_SIZE_SHIFT); 255 >>> CID 1458076: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "req" to "pmc_send_ipc_cmd", which dereferences it. 256 r = pmc_send_ipc_cmd(cmd_reg, req, res); 257 258 if (r < 0) { 259 printk(BIOS_ERR, "pmc_send_ipc_cmd failed in %s\n", __func__); 260 return 0; 261 } ** CID 1458075: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1458075: Null pointer dereferences (FORWARD_NULL) /src/soc/intel/common/block/crashlog/crashlog.c: 206 in cl_pmc_re_arm_after_reset() 200 int r; 201 202 cmd_reg = pmc_make_ipc_cmd(PMC_IPC_CMD_CRASHLOG, 203 PMC_IPC_CMD_ID_CRASHLOG_RE_ARM_ON_RESET, 204 PMC_IPC_CMD_SIZE_SHIFT); 205 >>> CID 1458075: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "req" to "pmc_send_ipc_cmd", which dereferences it. 206 r = pmc_send_ipc_cmd(cmd_reg, req, res); 207 208 if (r < 0) { 209 printk(BIOS_ERR, "pmc_send_ipc_cmd failed in %s\n", __func__); 210 return 0; 211 } ** CID 1458074: Integer handling issues (CONSTANT_EXPRESSION_RESULT) /src/soc/intel/alderlake/crashlog.c: 144 in cpu_cl_get_capability() ________________________________________________________________________________________________________ *** CID 1458074: Integer handling issues (CONSTANT_EXPRESSION_RESULT) /src/soc/intel/alderlake/crashlog.c: 144 in cpu_cl_get_capability() 138 139 /* walk through the entries until crashLog entry */ 140 cl_devsc_cap->devsc_data.data_32[1] = pci_read_config32(SA_DEV_TMT, TEL_DVSEV_ID); 141 int new_offset = 0; 142 while (cl_devsc_cap->devsc_data.fields.devsc_id != CRASHLOG_DVSEC_ID) { 143 if (cl_devsc_cap->cap_data.fields.next_cap_offset == 0 >>> CID 1458074: Integer handling issues (CONSTANT_EXPRESSION_RESULT) >>> "cl_devsc_cap->cap_data.fields.next_cap_offset == 65535" is always false regardless of the values of its operands. This occurs as the logical second operand of "||". 144 || cl_devsc_cap->cap_data.fields.next_cap_offset == 0xFFFF) { 145 printk(BIOS_DEBUG, "Read invalid pcie_cap_id value: 0x%x\n", 146 cl_devsc_cap->cap_data.fields.pcie_cap_id); 147 return false; 148 } 149 new_offset = cl_devsc_cap->cap_data.fields.next_cap_offset; ** CID 1458073: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1458073: Null pointer dereferences (FORWARD_NULL) /src/soc/intel/common/block/crashlog/crashlog.c: 206 in cl_pmc_re_arm_after_reset() 200 int r; 201 202 cmd_reg = pmc_make_ipc_cmd(PMC_IPC_CMD_CRASHLOG, 203 PMC_IPC_CMD_ID_CRASHLOG_RE_ARM_ON_RESET, 204 PMC_IPC_CMD_SIZE_SHIFT); 205 >>> CID 1458073: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "res" to "pmc_send_ipc_cmd", which dereferences it. 206 r = pmc_send_ipc_cmd(cmd_reg, req, res); 207 208 if (r < 0) { 209 printk(BIOS_ERR, "pmc_send_ipc_cmd failed in %s\n", __func__); 210 return 0; 211 } ** CID 1458072: Integer handling issues (CONSTANT_EXPRESSION_RESULT) /src/soc/intel/common/block/crashlog/crashlog.c: 342 in cl_get_pmc_sram_data() ________________________________________________________________________________________________________ *** CID 1458072: Integer handling issues (CONSTANT_EXPRESSION_RESULT) /src/soc/intel/common/block/crashlog/crashlog.c: 342 in cl_get_pmc_sram_data() 336 printk(BIOS_DEBUG, "PCH crashlog feature not supported.\n"); 337 goto pmc_send_re_arm_after_reset; 338 } 339 340 /* Get the size of data to copy */ 341 if (discovery_buf.bits.discov_mechanism == 1) { >>> CID 1458072: Integer handling issues (CONSTANT_EXPRESSION_RESULT) >>> "discovery_buf.bits.base_offset & (2147483648UL /* 1UL << 31 */)" is always 0 regardless of the values of its operands. This occurs as the logical operand of "if". 342 if (discovery_buf.bits.base_offset & BIT(31)) { 343 printk(BIOS_DEBUG, "PCH discovery to be used is disabled.\n"); 344 goto pmc_send_re_arm_after_reset; 345 } 346 printk(BIOS_DEBUG, "PMC crashLog size in discovery mode : 0x%X\n", 347 pmc_crashLog_size); ** CID 1458071: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1458071: Null pointer dereferences (FORWARD_NULL) /src/soc/intel/common/block/crashlog/crashlog.c: 229 in cl_pmc_clear() 223 int r; 224 225 cmd_reg = pmc_make_ipc_cmd(PMC_IPC_CMD_CRASHLOG, 226 PMC_IPC_CMD_ID_CRASHLOG_ERASE, 227 PMC_IPC_CMD_SIZE_SHIFT); 228 >>> CID 1458071: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "res" to "pmc_send_ipc_cmd", which dereferences it. 229 r = pmc_send_ipc_cmd(cmd_reg, req, res); 230 231 if (r < 0) { 232 printk(BIOS_ERR, "pmc_send_ipc_cmd failed in %s\n", __func__); 233 return 0; 234 } ** CID 1458070: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1458070: Null pointer dereferences (FORWARD_NULL) /src/soc/intel/common/block/crashlog/crashlog.c: 256 in cl_pmc_en_gen_on_all_reboot() 250 int r; 251 252 cmd_reg = pmc_make_ipc_cmd(PMC_IPC_CMD_CRASHLOG, 253 PMC_IPC_CMD_ID_CRASHLOG_ON_RESET, 254 PMC_IPC_CMD_SIZE_SHIFT); 255 >>> CID 1458070: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "res" to "pmc_send_ipc_cmd", which dereferences it. 256 r = pmc_send_ipc_cmd(cmd_reg, req, res); 257 258 if (r < 0) { 259 printk(BIOS_ERR, "pmc_send_ipc_cmd failed in %s\n", __func__); 260 return 0; 261 } ** CID 1458069: (OVERRUN) /src/soc/intel/common/block/crashlog/crashlog.c: 168 in pmc_cl_gen_descriptor_table() /src/soc/intel/common/block/crashlog/crashlog.c: 170 in pmc_cl_gen_descriptor_table() /src/soc/intel/common/block/crashlog/crashlog.c: 169 in pmc_cl_gen_descriptor_table() ________________________________________________________________________________________________________ *** CID 1458069: (OVERRUN) /src/soc/intel/common/block/crashlog/crashlog.c: 168 in pmc_cl_gen_descriptor_table() 162 int total_data_size = 0; 163 descriptor_table->numb_regions = read32((u32 *)desc_table_addr); 164 printk(BIOS_DEBUG, "CL PMC desc table: numb of regions is 0x%x at addr 0x%x\n", 165 descriptor_table->numb_regions, desc_table_addr); 166 for (int i = 0; i < descriptor_table->numb_regions; i++) { 167 desc_table_addr += 4; >>> CID 1458069: (OVERRUN) >>> Overrunning array "descriptor_table->regions" of 256 4-byte elements at element index 256 (byte offset 1027) using index "i" (which evaluates to 256). 168 descriptor_table->regions[i].data = read32((u32 *)(desc_table_addr)); 169 total_data_size += descriptor_table->regions[i].bits.size * sizeof(u32); 170 printk(BIOS_DEBUG, "CL PMC desc table: region 0x%x has size 0x%x at offset 0x%x\n", 171 i, descriptor_table->regions[i].bits.size, 172 descriptor_table->regions[i].bits.offset); 173 if (i > 255) { /src/soc/intel/common/block/crashlog/crashlog.c: 170 in pmc_cl_gen_descriptor_table() 164 printk(BIOS_DEBUG, "CL PMC desc table: numb of regions is 0x%x at addr 0x%x\n", 165 descriptor_table->numb_regions, desc_table_addr); 166 for (int i = 0; i < descriptor_table->numb_regions; i++) { 167 desc_table_addr += 4; 168 descriptor_table->regions[i].data = read32((u32 *)(desc_table_addr)); 169 total_data_size += descriptor_table->regions[i].bits.size * sizeof(u32); >>> CID 1458069: (OVERRUN) >>> Overrunning array "descriptor_table->regions" of 256 4-byte elements at element index 256 (byte offset 1027) using index "i" (which evaluates to 256). 170 printk(BIOS_DEBUG, "CL PMC desc table: region 0x%x has size 0x%x at offset 0x%x\n", 171 i, descriptor_table->regions[i].bits.size, 172 descriptor_table->regions[i].bits.offset); 173 if (i > 255) { 174 printk(BIOS_ERR, "More than 255 regions in PMC crashLog descriptor table"); 175 break; /src/soc/intel/common/block/crashlog/crashlog.c: 169 in pmc_cl_gen_descriptor_table() 163 descriptor_table->numb_regions = read32((u32 *)desc_table_addr); 164 printk(BIOS_DEBUG, "CL PMC desc table: numb of regions is 0x%x at addr 0x%x\n", 165 descriptor_table->numb_regions, desc_table_addr); 166 for (int i = 0; i < descriptor_table->numb_regions; i++) { 167 desc_table_addr += 4; 168 descriptor_table->regions[i].data = read32((u32 *)(desc_table_addr)); >>> CID 1458069: (OVERRUN) >>> Overrunning array "descriptor_table->regions" of 256 4-byte elements at element index 256 (byte offset 1027) using index "i" (which evaluates to 256). 169 total_data_size += descriptor_table->regions[i].bits.size * sizeof(u32); 170 printk(BIOS_DEBUG, "CL PMC desc table: region 0x%x has size 0x%x at offset 0x%x\n", 171 i, descriptor_table->regions[i].bits.size, 172 descriptor_table->regions[i].bits.offset); 173 if (i > 255) { 174 printk(BIOS_ERR, "More than 255 regions in PMC crashLog descriptor table"); ** CID 1458068: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1458068: Null pointer dereferences (FORWARD_NULL) /src/soc/intel/common/block/crashlog/crashlog.c: 229 in cl_pmc_clear() 223 int r; 224 225 cmd_reg = pmc_make_ipc_cmd(PMC_IPC_CMD_CRASHLOG, 226 PMC_IPC_CMD_ID_CRASHLOG_ERASE, 227 PMC_IPC_CMD_SIZE_SHIFT); 228 >>> CID 1458068: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "req" to "pmc_send_ipc_cmd", which dereferences it. 229 r = pmc_send_ipc_cmd(cmd_reg, req, res); 230 231 if (r < 0) { 232 printk(BIOS_ERR, "pmc_send_ipc_cmd failed in %s\n", __func__); 233 return 0; 234 } ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

coreboot July 2021