January 2024 - coreboot - mail.coreboot.org

New Defects reported by Coverity Scan for coreboot
by scan-admin＠coverity.com Jan. 17, 2024

Jan. 17, 2024

Hi, Please find the latest report on new defect(s) introduced to coreboot found with Coverity Scan. 3 new defect(s) introduced to coreboot found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 3 of 3 defect(s) ** CID 1533252: Memory - corruptions (OVERRUN) ________________________________________________________________________________________________________ *** CID 1533252: Memory - corruptions (OVERRUN) /src/soc/intel/xeon_sp/chip_common.c: 124 in attach_iio_stacks() 118 continue; 119 } 120 121 struct device_path path; 122 path.type = DEVICE_PATH_DOMAIN; 123 path.domain.domain = s * MAX_LOGIC_IIO_STACK + x; >>> CID 1533252: Memory - corruptions (OVERRUN) >>> Overrunning struct type device_path of 32 bytes by passing it to a function which accesses it at byte offset 39. 124 struct device *iio_domain = alloc_dev(dev->bus, &path); 125 if (iio_domain == NULL) 126 die("%s: out of memory.\n", __func__); 127 iio_domain->ops = &iio_pcie_domain_ops; 128 } 129 } ** CID 1533251: Memory - corruptions (OVERRUN) ________________________________________________________________________________________________________ *** CID 1533251: Memory - corruptions (OVERRUN) /src/soc/intel/xeon_sp/spr/ioat.c: 37 in create_ioat_domain() 31 struct device_path path = { 32 .type = DEVICE_PATH_DOMAIN, 33 .domain = { 34 .domain = domain_base + bus_base, 35 }, 36 }; >>> CID 1533251: Memory - corruptions (OVERRUN) >>> Overrunning struct type device_path of 32 bytes by passing it to a function which accesses it at byte offset 39. 37 struct device *const domain = alloc_dev(upstream, &path); 38 if (!domain) 39 die("%s: out of memory.\n", __func__); 40 41 domain->ops = &ioat_domain_ops; 42 ** CID 1533250: Insecure data handling (TAINTED_SCALAR) /src/soc/intel/xeon_sp/chip_common.c: 106 in attach_iio_stacks() ________________________________________________________________________________________________________ *** CID 1533250: Insecure data handling (TAINTED_SCALAR) /src/soc/intel/xeon_sp/chip_common.c: 106 in attach_iio_stacks() 100 void attach_iio_stacks(struct device *dev) 101 { 102 const IIO_UDS *hob = get_iio_uds(); 103 if (!hob) 104 return; 105 >>> CID 1533250: Insecure data handling (TAINTED_SCALAR) >>> Using tainted variable "hob->PlatformData.numofIIO" as a loop boundary. 106 for (int s = 0; s < hob->PlatformData.numofIIO; ++s) { 107 for (int x = 0; x < MAX_LOGIC_IIO_STACK; ++x) { 108 if (s == 0 && x == 0) 109 continue; 110 111 const STACK_RES *ri = &hob->PlatformData.IIO_resource[s].StackRes[x]; ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

Cannot verify review.coreboot.org's certificate, issued by ‘/C=US/O=Let's Encrypt/CN=R3’
by Mike Banon Jan. 16, 2024

Jan. 16, 2024

Good day! I just found out that my wgets at http://dangerousprototypes.com/docs/Lenovo_G505S_hacking scripts (for restoring & configuring the AMD opensource AGESA boards at modern coreboot) - are failing because of this certificate error. To reproduce this easily you do not have to run the whole csb_patcher.sh or restore_agesa.sh - doing just a simple wget is more than enough, i.e.: wget "https://review.coreboot.org/changes/79838/revisions/2/patch?zip" --2024-01-16 **:**:**-- https://review.coreboot.org/changes/79838/revisions/2/patch?zip Resolving review.coreboot.org (review.coreboot.org) **.**.***.*** Connecting to review.coreboot.org (review.coreboot.org)|**.**.***.***|:443... connected. ERROR: cannot verify review.coreboot.org's certificate, issued by ‘/C=US/O=Let's Encrypt/CN=R3’: Issued certificate has expired. To connect to review.coreboot.org insecurely, use `--no-check-certificate'. Please resolve this error -- Best regards, Mike Banon Open Source Community Manager of 3mdeb - https://3mdeb.com/

3 3

[coreboot - Bug #121] T520: Hangs in OS
by Alex Gravitos Jan. 16, 2024

Jan. 16, 2024

Issue #121 has been updated by Alex Gravitos. seems my assumptions about it being the first return were not entirely correct, the laptop just froze on me during a system update (its arch, so no harm was actually done), i would like to see more details on the `PDM_APD_PPD` stuff ---------------------------------------- Bug #121: T520: Hangs in OS https://ticket.coreboot.org/issues/121#change-1741 * Author: Firstname Lastname * Status: In Progress * Priority: Normal * Category: chipset configuration * Start date: 2017-06-09 * Affected hardware: SNB, IVY * Affected OS: - ---------------------------------------- I have been running coreboot since 2017.04.15 and have experienced hangs ever since then. It was suggested by folk on the IRC that I run memtest to check for incorrect raminit causing errors, however I have run memtest for 12 hours straight with no errors. Due to the ambiguous nature of the hangs (immediate freeze with no warning signs, audio gets stuck repeating the last 50ms or so of noise, not sure what this effect is called) I don't have much useful information other than the .config and dmesg. However one thing I can say with high confidence is that the hangs occur significantly more frequently in Linux (*buntu distros) than Windows 10. Within an hour of launching Linux a hang is likely, whereas Windows typically runs for many hours before a hang occurs. I considered this an insignificant anecdotal anomaly at first but over the course of the nearly 2 months I have been running coreboot it seems to be a solid trend. The hangs occur anywhere, typically during mere desktop usage or basic web browsing. Additionally there is another form of hang I experience where the screen goes black except for some sort of graphical corruption down the left side (http://i.imgur.com/4zWrlpX.jpg) whether this is related to the more common total freeze hangs I don't know but I figured I should include it nonetheless. These hangs only occur about 1:20 compared to the regular hangs. ---Files-------------------------------- config (20.7 KB) dmesg.txt (57.3 KB) cbmem-raminit.txt (62 KB) lspci.txt (29.6 KB) cpuinfo.txt (3.94 KB) defconfig (1023 Bytes) defconfig (699 Bytes) -- You have received this notification because you have either subscribed to it, or are involved in it. To change your notification preferences, please click here: https://ticket.coreboot.org/my/account

1 0

Added "checks" integration to Gerrit
by Felix Singer Jan. 16, 2024

Jan. 16, 2024

Hi coreboot fellows, You will find some new things in the Gerrit UI when you have a patch open. I've just added checks integration, which shows the executed CI jobs and tests in a much more convenient way rather than in the comment section. Ideally, it also gives a bit information on which tests failed, how many or why they failed. So more or less a summary about the build results you also get when you open the overview of a CI job. And also.. failed jobs shouldn't be listed as "warning". An example how it could look like: https://gerrit-review.googlesource.com/Documentation/pg-plugin-checks-api.h… However, it's still work in progress and I'm trying to figure out how to make it showing more information. Just wanted to make a little announcement in case of you are wondering or seeing some errors :) Felix

2 1

Support for ASUS F15
by �� Jan. 15, 2024

Jan. 15, 2024

Dear Coreboot project team, I am a user of the Asus F15 TUF Gaming laptop. I have a laptop with an Intel 11th gen i5-11400H CPU (Broadwell) on a motherboard specific to the laptop (FX506HC). Could you please help me create a way to install Coreboot on my computer or consider supporting it in the future? Best Wishes, Audial Moon

1 0

[coreboot - Bug #121] T520: Hangs in OS
by Alex Gravitos Jan. 15, 2024

Jan. 15, 2024

Issue #121 has been updated by Alex Gravitos. Patrick Rudolph wrote in #note-82: > It looks like returning `PDM_APD_PPD` in get_power_down_mode() also fixes the issue. took me a while to figure out which return was supposed to be changed (its the first one). **however**, for some reason doing that also kills ethernet - both on-board and in the dock. like, to the point of them not being seen by the system. an android phone connected as usb modem is detected fine, so i'd say changing these returns somehow impacts the gigabit ethernet blob. sorry if i give not enough info, i am using coreboot for less than a week on my T520i, tell me if you need anything like logs or whatever ---------------------------------------- Bug #121: T520: Hangs in OS https://ticket.coreboot.org/issues/121#change-1740 * Author: Firstname Lastname * Status: In Progress * Priority: Normal * Category: chipset configuration * Start date: 2017-06-09 * Affected hardware: SNB, IVY * Affected OS: - ---------------------------------------- I have been running coreboot since 2017.04.15 and have experienced hangs ever since then. It was suggested by folk on the IRC that I run memtest to check for incorrect raminit causing errors, however I have run memtest for 12 hours straight with no errors. Due to the ambiguous nature of the hangs (immediate freeze with no warning signs, audio gets stuck repeating the last 50ms or so of noise, not sure what this effect is called) I don't have much useful information other than the .config and dmesg. However one thing I can say with high confidence is that the hangs occur significantly more frequently in Linux (*buntu distros) than Windows 10. Within an hour of launching Linux a hang is likely, whereas Windows typically runs for many hours before a hang occurs. I considered this an insignificant anecdotal anomaly at first but over the course of the nearly 2 months I have been running coreboot it seems to be a solid trend. The hangs occur anywhere, typically during mere desktop usage or basic web browsing. Additionally there is another form of hang I experience where the screen goes black except for some sort of graphical corruption down the left side (http://i.imgur.com/4zWrlpX.jpg) whether this is related to the more common total freeze hangs I don't know but I figured I should include it nonetheless. These hangs only occur about 1:20 compared to the regular hangs. ---Files-------------------------------- config (20.7 KB) dmesg.txt (57.3 KB) cbmem-raminit.txt (62 KB) lspci.txt (29.6 KB) cpuinfo.txt (3.94 KB) defconfig (1023 Bytes) defconfig (699 Bytes) -- You have received this notification because you have either subscribed to it, or are involved in it. To change your notification preferences, please click here: https://ticket.coreboot.org/my/account

1 0

Is there a way to enable a PCI-PCI bridge on bus 3 early?
by Keith Hui Jan. 11, 2024

Jan. 11, 2024

In my quest to get POST codes to show on my Asus P8Z77-M, and fixing sb/bd82x6x [1] along the way, I'm still not quite getting them. I have a ISA/PCI POST card, but it isn't giving me anything. I bought a little "Debug Card Expert" off Amazon that looks like a mini-PCI/mini-PCIe cross, but in today's testing I found out that it isn't wired properly (i.e. isn't going to work) for PCIe at all, but I did get it to show POST codes over LPC via the TPM header. I have another of this same little PoS that broke in half on arrival. Now that I know it only really works over LPC and only 9 signals, I'll attempt to repair the broken traces and glue it together. My board has a PCI-PCI bridge on bus:device.func 3:0.0 (so bus 3, this will be important) that services the PCI slot. After applying [1] to have the PCH send port 80 data to PCI as I specified in Kconfig, I still don't get any POST code... and not over LPC either, so I know my patch works. Now I think I may need to enable CONFIG_EARLY_PCI_BRIDGE. Problem is the bridge has to be a device on bus 0. How can I enable this PCI bridge on bus 3 early so a POST card sitting on it can get codes? Thanks Keith [1] https://review.coreboot.org/c/coreboot/+/79725

2 7

2024-01-10 - coreboot Leadership Meeting Minutes
by mina＠coreboot.org Jan. 11, 2024

Jan. 11, 2024

# 2024-01-10 - coreboot Leadership Meeting Minutes ## Attendees Martin Roth, Mina Asante, David Hendricks, Werner Zeh, Felix Singer, Max Brune, Felix Held, Matt DeVillier, Ahmed Elgogary, Nico Huber, Nicholas Chin, Patrick Georgi, Jonathon Hall, Daniel Maslowski, Simon Glass, Jay Talbott. ## Open Action Items * 2024-01-10 * [Open] Werner: Push patch based on https://ticket.coreboot.org/issues/522 * [Open] Daniel: Look at how we want to localize (non console) strings for coreboot. Long term project. * 2023-12-13 * [Open] coreboot admins: Look at moving services off of stefan’s server. * [Moving coreboot services off of Stefan’s server] (https://docs.google.com/document/d/12aHuukgIRiS-9XlrqLFwVj1KqtYG_qih1yGX1E-…) * 2023-11-01 * [Open] Martin: Shallow submodules - document & test, then update submodules if testing goes well. Additionally look at whether the .branch option helps. * No progress yet * 2023-10-18 * [Started] (https://mail.coreboot.org/hyperkitty/list/coreboot@coreboot.org/thread/MMV2… JEE/)MattD and WernerZ: Work on compiling a list of website requirements from the mailing list. * No feedback yet - Matt will continue to gather feedback. * Probably have all of the community input - Need to capture the requirements as a starting point. * Move to next year. * [On hold] [pending requirements] MartinR & FelixS: Build a POC front page. * [Open] Arthur: Ask Philip about how to use company logos. * 2023-10-04 * [Started] (https://docs.google.com/document/d/1Z8igNdgBG5_Qlr4kKRtlbpKaZo9RUghRqZjHUNU…) Martin: Write a tutorial for gerrit - Feel free to help. * [Open] OSFF: Look into making a video about using gerrit. * Discussed with Christian who felt this was a good plan. * Look at next year. * [Open] Martin: Write a document about vendorcode submodules. * Not started ## Minutes: ### [Martin/others] Look at writing a doc stating what coreboot is * It’s been argued that this shouldn’t be called a “spec”, but Daniel Maslowski pointed out that coreboot is being defined by others as something that we aren’t, because we don’t have a good definition of what we are. Whatever we want to call it, it seems like a good plan to have *something* discussing what coreboot is. - Max: Is the target audience managers? - Daniel: The main idea is to give a definition, explain what coreboot is and does. Look at --- https://en.wikipedia.org/wiki/Coreboot (Not up to date) - It covers DRAM init in a larger paragraph - Which is what coreboot mainly means - plus e.g. some MSRs on x86 - We leave everything else up to the payload. - The way we look at the hardware ecosystem is different from others. We’re more platform (mainboard) oriented, whereas e.g. U-Boot is more SOC oriented. We should provide an entry point to understanding. - See also https://github.com/platform-system-interface/psi-spec - Felix Held: coreboot is now more SOC oriented. - David: U-Boot has a lot more mainboard specific code in the SOCs than coreboot does. - David: Having this document can be an advantage for coreboot. - Admins: Daniel, David - Martin will create a doc - [coreboot definition] (https://docs.google.com/document/d/1bMA19Cm5BMSVwZ1xFRn3pk_wSFIfSTaUY-94BLs…) - First draft in 6 weeks (Feb 21). ### [Martin] Localization of non-console strings for coreboot * With the addition of an early display, we’re looking at printing text to the screen directly from coreboot. Localization is being added for this, but the current patch uses the localization code from vboot. This isn’t a security related feature so shouldn’t depend on the rest of VBOOT being enabled. https://review.coreboot.org/c/coreboot/+/79054 * We also just had an RFC about storing setup engine strings. It seems like we’d want to make sure that whatever plan we have in place also supports localization for those strings as well. * How do we want to handle localization in coreboot? It seems like we’re going to be adding more strings that will be presented to the user. Werner: Do we want to concentrate on the current character set (Latin)? * Daniel: * Lots of dimensions here * Need translators, people understanding coreboot and/or connected to the community * E.g. openSUSE has a whole translation team. * Martin: * I don’t think we need to actually translate, just make sure we have the capability. This is for early display strings and the setup strings. Preparing for setup screen. * See also: https://archive.fosdem.org/2022/schedule/event/fw_settings_and_menus/ * Leader: Daniel ### [SimonG] Coreboot Control Block again * [Link] (https://review.coreboot.org/c/coreboot/+/77712) * Martin: Julius asked to put off discussion. * Simon: Julius seems to be against the proposal, I’m interested in what others think. * Martin: If people need it, it’s not intrusive, and it can be disabled I don’t see a problem. * MaxB: Issue with the patch and having moved things around. Julius’ other issue is that he doesn’t really see the use case, and I tend to agree. I haven’t seen this issue. I probably wouldn’t ever use this. * Matt: The main use case is troubleshooting a production image. CrOS images ship with console disabled, so there’s no way to debug the image. Sometimes you just want console enabled without all the other baggage of a console enabled build. * Nico: The current proposal is more invasive because it needs to be available before CBFS? (Simon: Yes) Is it too invasive for the minimal use case? CBFS should work too, just not on devices with early CBFS access. It increases complexity. * MaxB: Not against the idea, but the implementation is intrusive. Don’t do much in bootblock. * FelixS: Would it be possible to handle the option over chromeEC? Yes, though the EC isn’t available at the start of bootblock. * Martin: Let’s be inclusive and not block changes just because it’s not our use case. * Werner: This is a switch to enable/disable console very early, correct? Can we do that from a flashmap region instead of CBFS? Can we just use a hardcoded address in SPI? (Simon: Yes, on x86 - in a sense, that’s what we’re doing). * MaxB: move CBFS earlier? Currently we only need it at the end to load the next stage. * Patrick: Previous discussion about approaches to this: (https://review.coreboot.org/plugins/gitiles/coreboot/+/refs/changes/85/5438… es/2021-05-selectable-serial-console.md) * Ahmed: Why isn’t the EC available at bootblock? (Simon, A message needs to be sent to the EC. It becomes available during bootblock. The issue isn’t whether the EC is running, just whether we can send a message). * David: Prefer to avoid EC dependencies since that will severely limit the usefulness of this feature. ### [Martin] Setup Option Table implementation in YAML * The initial plan was to use Kconfig syntax to generate the data for the tables, but even though Kconfig was designed to create a menu, there are significant differences between the Kconfig menus and what we’re trying to do here. The biggest difference is how we handle enabling menus. Kconfig is designed to include *ALL* values, and hide entries based on a current value. The SOT menu should completely exclude data that isn’t relevant to a system from the data structures. This can be handled, but this difference makes Kconfig less than ideal. ### [Martin] `region_overlap()` function might not work as expected due to an integer overflow in `region_end()` function * Bug 522 - https://ticket.coreboot.org/issues/522 * Looking for someone to take issue and push a patch. Issue gives an invalid result for an invalid input. Might be more useful to verify where the input is coming from? Max & Nico: Not sure this is an actual issue. * Werner - will push a patch based on their bug. ### Future of coreboot servers * We have an open action item on moving coreboot services off Stefan’s box. Other considerations have been to outsource some of the services we have so we can concentrate on doing a better job on everything else. Moving services off Stefan’s box makes it more feasible to build an admin team with full access, without putting Stefan’s other stuff on the service at risk. There has been some time to look for alternative hosting options, but given our priorities (e.g. to keep Gerrit as review system), no outsourced option looked like a good fit (while also actually offloading work) * [Jay] Did Martin ever get the server hardware from Marc Jones? * [Jay]: Marc says yes. * Yes, It’s in my garage, I need to finish getting it set up. * Martin: It was suggested that we could switch to Github for our CI. This *could* be free - * Felix: isn’t sure that it would be free for a big project like coreboot. * Matt: Ran into this issue when working on HEADS - Way too many limitations. * Nico: What’s the timeframe? (Martin - not decided yet). We can look at how much it takes in terms of resources, then look at running it at a cloud service. * Felix: Why run it on a cloud service instead of a dedicated hardware? That can be expensive * Nico: Just lets us get away from maintaining the server. It doesn’t need to be expensive. ### [Martin] Swag / Merch for FOSDEM * Ordered 24 beer glasses to take to FOSDEM. Will coreboot reimburse? Who should get these? coreboot can reimburse for the order Who gets them? Martin: Top devs day 1, any dev day 2? * Werner: Let’s see how this goes and change next year as needed. ## Completed Action Items * [Done] [Started](https://review.coreboot.org/c/coreboot/+/78832) Martin: Work on clang-format config update. * We can use the clang format version from the coreboot toolchain. * Some issues with clang format - martin will present. * See CB:78833 for what the current format’s changes will look like. * [David] #defines for bits in headers lose their indenting. Maybe we should have clang-format ignore headers for now. Smaller issues can be handled on a "use your best “judgement" basis. * [Done] Martin to add bitfield example to 78833 * Let’s look at running this just for .c files to start with. * [Done] PatrickG, FelixS, MartinR: Look at improving the responsiveness of gerrit. * This had a number of causes, mostly related to running out of storage, as well as both of the NVMe drives going bad. We’ve reduced the amount of data being saved by jenkins and replaced the NVMe drives. # Next meeting * January 24, 2024. * [Meeting link](https://meet.google.com/pyt-newq-rbb) * [coreboot Calendar](https://coreboot.org/calendar.html) # Notice * Decisions shown here are not necessarily final, and are based on the current information available. If there are questions or comments about decisions made, or additional information to present, please put it on the leadership meeting agenda and show up if possible to discuss it. Of course items may also be discussed on the mailing list, but as it's difficult to interpret tone over email, controversial topics frequently do not have good progress in those discussions. For particularly difficult issues, it may be best to try to schedule another meeting. # coreboot leadership meeting minutes * https://docs.google.com/document/d/1NRXqXcLBp5pFkHiJbrLdv3Spqh1Hu086HYkKrgK…

1 0

coreboot Meetings Announcement And Agenda Call
by mina＠coreboot.org Jan. 8, 2024

Jan. 8, 2024

Dear community, Please note that the upcoming coreboot leadership meeting is scheduled for Wednesday, January 10, 2024. [1] You are welcome to update the agenda items with matters you wish to see addressed during the meeting . [2] ## Current Agenda Items ### [Martin/others] Look at writing a doc stating what coreboot is * It’s been argued that this shouldn’t be called a “spec”, but Daniel Maslowski pointed out that coreboot is being defined by others as something that we aren’t, because we don’t have a good definition of what we are. Whatever we want to call it, it seems like a good plan to have *something* discussing what coreboot is. ### [Martin] Localization of non-console strings for coreboot * With the addition of an early display, we’re looking at printing text to the screen directly from coreboot. Localization is being added for this, but the current patch uses the localization code from vboot. This isn’t a security related feature so shouldn’t depend on the rest of VBOOT being enabled. https://review.coreboot.org/c/coreboot/+/79054 * We also just had an RFC about storing setup engine strings. It seems like we’d want to make sure that whatever plan we have in place also supports localization for those strings as well. * How do we want to handle localization in coreboot? It seems like we’re going to be adding more strings that will be presented to the user. ### [SimonG] Coreboot Control Block again * [https://review.coreboot.org/c/coreboot/+/77712] ### [Martin] Review Setup Option Table implementation in YAML * The initial plan was to use Kconfig syntax to generate the data for the tables, but even though Kconfig was designed to create a menu, there are significant differences between the Kconfig menus and what we’re trying to do here. The biggest difference is how we handle enabling menus. Kconfig is designed to include *ALL* values, and hide entries based on a current value. The SOT menu should completely exclude data that isn’t relevant to a system from the data structures. This can be handled, but this difference makes Kconfig less than ideal. ### [Martin] `region_overlap()` function might not work as expected due to an integer overflow in `region_end()` function * Bug 522 - https://ticket.coreboot.org/issues/522 [1] https://www.coreboot.org/calendar.html [2] https://docs.google.com/document/d/1NRXqXcLBp5pFkHiJbrLdv3Spqh1Hu086HYkKrgK…

1 0

coreboot Meetings Announcement And Agenda Call
by mina＠coreboot.org Jan. 8, 2024

Jan. 8, 2024

Dear community, We are pleased to announce that the upcoming coreboot leadership meeting is scheduled for next Wednesday, January 10, 2024. [1] Please take a moment to review the current agenda items and update them with matters you wish to see addressed during the meeting. [2] [1] https://www.coreboot.org/calendar.html [2] https://docs.google.com/document/d/1NRXqXcLBp5pFkHiJbrLdv3Spqh1Hu086HYkKrgK… j6ljr2742djc

2 1