[coreboot] New Defects reported by Coverity Scan for coreboot

scan-admin at coverity.com scan-admin at coverity.com
Fri Apr 8 13:44:36 CEST 2016


Hi,

Please find the latest report on new defect(s) introduced to coreboot found with Coverity Scan.

20 new defect(s) introduced to coreboot found with Coverity Scan.
152 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan.

New defect(s) Reported-by: Coverity Scan
Showing 20 of 20 defect(s)


** CID 1353346:  Memory - illegal accesses  (OVERRUN)
/3rdparty/chromeec/chip/lm4/pwm.c: 63 in pwm_init()


________________________________________________________________________________________________________
*** CID 1353346:  Memory - illegal accesses  (OVERRUN)
/3rdparty/chromeec/chip/lm4/pwm.c: 63 in pwm_init()
57     
58     static void pwm_init(void)
59     {
60     	int i;
61     
62     	for (i = 0; i < PWM_CH_COUNT; ++i)
>>>     CID 1353346:  Memory - illegal accesses  (OVERRUN)
>>>     Overrunning array "pwm_channels" of 1 8-byte elements at element index 1 (byte offset 8) using index "i" (which evaluates to 1).
63     		fan_channel_setup(pwm_channels[i].channel,
64     				       (pwm_channels[i].flags &
65     					PWM_CONFIG_HAS_RPM_MODE)
66     				       ? FAN_USE_RPM_MODE : 0);
67     }
68     
69     /* The chip-specific fan module initializes before this. */

** CID 1353342:    (OVERRUN)
/3rdparty/chromeec/common/pwm.c: 41 in cc_pwm_duty()
/3rdparty/chromeec/common/pwm.c: 41 in cc_pwm_duty()
/3rdparty/chromeec/common/pwm.c: 41 in cc_pwm_duty()
/3rdparty/chromeec/common/pwm.c: 35 in cc_pwm_duty()


________________________________________________________________________________________________________
*** CID 1353342:    (OVERRUN)
/3rdparty/chromeec/common/pwm.c: 41 in cc_pwm_duty()
35     		for (ch = 0; ch < PWM_CH_COUNT; ch++)
36     			print_channel(ch);
37     		return EC_SUCCESS;
38     	}
39     
40     	ch = strtoi(argv[1], &e, 0);
>>>     CID 1353342:    (OVERRUN)
>>>     Checking "ch >= PWM_CH_COUNT" implies that "ch" is between 0 and 1 (inclusive) on the false branch.
41     	if (*e || ch < 0 || ch >= PWM_CH_COUNT)
42     		return EC_ERROR_PARAM1;
43     
44     	if (argc > 2) {
45     		percent = strtoi(argv[2], &e, 0);
46     		if (*e || percent > 100) {
/3rdparty/chromeec/common/pwm.c: 41 in cc_pwm_duty()
35     		for (ch = 0; ch < PWM_CH_COUNT; ch++)
36     			print_channel(ch);
37     		return EC_SUCCESS;
38     	}
39     
40     	ch = strtoi(argv[1], &e, 0);
>>>     CID 1353342:    (OVERRUN)
>>>     Checking "ch >= PWM_CH_COUNT" implies that "ch" is between 0 and 1 (inclusive) on the false branch.
41     	if (*e || ch < 0 || ch >= PWM_CH_COUNT)
42     		return EC_ERROR_PARAM1;
43     
44     	if (argc > 2) {
45     		percent = strtoi(argv[2], &e, 0);
46     		if (*e || percent > 100) {
/3rdparty/chromeec/common/pwm.c: 41 in cc_pwm_duty()
35     		for (ch = 0; ch < PWM_CH_COUNT; ch++)
36     			print_channel(ch);
37     		return EC_SUCCESS;
38     	}
39     
40     	ch = strtoi(argv[1], &e, 0);
>>>     CID 1353342:    (OVERRUN)
>>>     Checking "ch >= PWM_CH_COUNT" implies that "ch" is between 0 and 1 (inclusive) on the false branch.
41     	if (*e || ch < 0 || ch >= PWM_CH_COUNT)
42     		return EC_ERROR_PARAM1;
43     
44     	if (argc > 2) {
45     		percent = strtoi(argv[2], &e, 0);
46     		if (*e || percent > 100) {
/3rdparty/chromeec/common/pwm.c: 35 in cc_pwm_duty()
29     	int percent = 0;
30     	int ch;
31     	char *e;
32     
33     	if (argc < 2) {
34     		ccprintf("PWM channels:\n");
>>>     CID 1353342:    (OVERRUN)
>>>     Checking "ch < PWM_CH_COUNT" implies that "ch" may be up to 1 on the true branch.
35     		for (ch = 0; ch < PWM_CH_COUNT; ch++)
36     			print_channel(ch);
37     		return EC_SUCCESS;
38     	}
39     
40     	ch = strtoi(argv[1], &e, 0);

** CID 1353304:  Memory - corruptions  (OVERRUN)


________________________________________________________________________________________________________
*** CID 1353304:  Memory - corruptions  (OVERRUN)
/3rdparty/chromeec/common/mkbp_event.c: 39 in set_host_interrupt()
33     /**
34      * Assert host keyboard interrupt line.
35      */
36     static void set_host_interrupt(int active)
37     {
38     	/* interrupt host by using active low EC_INT signal */
>>>     CID 1353304:  Memory - corruptions  (OVERRUN)
>>>     Overrunning callee's array of size 44 by passing argument "GPIO_EC_INT_L" in call to "gpio_set_level".
39     	gpio_set_level(GPIO_EC_INT_L, !active);
40     }
41     
42     void mkbp_send_event(uint8_t event_type)
43     {
44     	set_event(event_type);

** CID 1353297:    (OVERRUN)


________________________________________________________________________________________________________
*** CID 1353297:    (OVERRUN)
/3rdparty/chromeec/common/usb_charger.c: 61 in usb_charger_port_is_sourcing_vbus()
55     	}
56     }
57     
58     int usb_charger_port_is_sourcing_vbus(int port)
59     {
60     	if (port == 0)
>>>     CID 1353297:    (OVERRUN)
>>>     Overrunning callee's array of size 44 by passing argument "GPIO_USB_C0_5V_EN" in call to "gpio_get_level".
61     		return gpio_get_level(GPIO_USB_C0_5V_EN);
62     #if CONFIG_USB_PD_PORT_COUNT >= 2
63     	else if (port == 1)
64     		return gpio_get_level(GPIO_USB_C1_5V_EN);
65     #endif
66     	/* Not a valid port */
/3rdparty/chromeec/common/usb_charger.c: 64 in usb_charger_port_is_sourcing_vbus()
58     int usb_charger_port_is_sourcing_vbus(int port)
59     {
60     	if (port == 0)
61     		return gpio_get_level(GPIO_USB_C0_5V_EN);
62     #if CONFIG_USB_PD_PORT_COUNT >= 2
63     	else if (port == 1)
>>>     CID 1353297:    (OVERRUN)
>>>     Overrunning callee's array of size 44 by passing argument "GPIO_USB_C1_5V_EN" in call to "gpio_get_level".
64     		return gpio_get_level(GPIO_USB_C1_5V_EN);
65     #endif
66     	/* Not a valid port */
67     	return 0;
68     }
69     
/3rdparty/chromeec/common/usb_charger.c: 61 in usb_charger_port_is_sourcing_vbus()
55     	}
56     }
57     
58     int usb_charger_port_is_sourcing_vbus(int port)
59     {
60     	if (port == 0)
>>>     CID 1353297:    (OVERRUN)
>>>     Overrunning callee's array of size 44 by passing argument "GPIO_USB_C0_5V_EN" in call to "gpio_get_level".
61     		return gpio_get_level(GPIO_USB_C0_5V_EN);
62     #if CONFIG_USB_PD_PORT_COUNT >= 2
63     	else if (port == 1)
64     		return gpio_get_level(GPIO_USB_C1_5V_EN);
65     #endif
66     	/* Not a valid port */
/3rdparty/chromeec/common/usb_charger.c: 64 in usb_charger_port_is_sourcing_vbus()
58     int usb_charger_port_is_sourcing_vbus(int port)
59     {
60     	if (port == 0)
61     		return gpio_get_level(GPIO_USB_C0_5V_EN);
62     #if CONFIG_USB_PD_PORT_COUNT >= 2
63     	else if (port == 1)
>>>     CID 1353297:    (OVERRUN)
>>>     Overrunning callee's array of size 44 by passing argument "GPIO_USB_C1_5V_EN" in call to "gpio_get_level".
64     		return gpio_get_level(GPIO_USB_C1_5V_EN);
65     #endif
66     	/* Not a valid port */
67     	return 0;
68     }
69     

** CID 1353286:  Memory - corruptions  (OVERRUN)


________________________________________________________________________________________________________
*** CID 1353286:  Memory - corruptions  (OVERRUN)
/3rdparty/chromeec/power/braswell.c: 340 in enter_pseudo_g3()
334     void enter_pseudo_g3(void)
335     {
336     	CPRINTS("Enter Psuedo G3");
337     	cflush();
338     
339     	gpio_set_level(GPIO_EC_HIB_L, 1);
>>>     CID 1353286:  Memory - corruptions  (OVERRUN)
>>>     Overrunning callee's array of size 44 by passing argument "GPIO_SMC_SHUTDOWN" in call to "gpio_set_level".
340     	gpio_set_level(GPIO_SMC_SHUTDOWN, 1);
341     
342     	/* Power to EC should shut down now */
343     	while (1)
344     		;
345     }

** CID 1353265:    (OVERRUN)


________________________________________________________________________________________________________
*** CID 1353265:    (OVERRUN)
/3rdparty/chromeec/common/system.c: 644 in system_get_board_version()
638     	int v = 0;
639     
640     #ifdef CONFIG_BOARD_VERSION
641     #ifdef CONFIG_BOARD_SPECIFIC_VERSION
642     	v = board_get_version();
643     #else
>>>     CID 1353265:    (OVERRUN)
>>>     Overrunning callee's array of size 44 by passing argument "GPIO_BOARD_VERSION1" in call to "gpio_get_level".
644     	if (gpio_get_level(GPIO_BOARD_VERSION1))
645     		v |= 0x01;
646     	if (gpio_get_level(GPIO_BOARD_VERSION2))
647     		v |= 0x02;
648     	if (gpio_get_level(GPIO_BOARD_VERSION3))
649     		v |= 0x04;
/3rdparty/chromeec/common/system.c: 646 in system_get_board_version()
640     #ifdef CONFIG_BOARD_VERSION
641     #ifdef CONFIG_BOARD_SPECIFIC_VERSION
642     	v = board_get_version();
643     #else
644     	if (gpio_get_level(GPIO_BOARD_VERSION1))
645     		v |= 0x01;
>>>     CID 1353265:    (OVERRUN)
>>>     Overrunning callee's array of size 44 by passing argument "GPIO_BOARD_VERSION2" in call to "gpio_get_level".
646     	if (gpio_get_level(GPIO_BOARD_VERSION2))
647     		v |= 0x02;
648     	if (gpio_get_level(GPIO_BOARD_VERSION3))
649     		v |= 0x04;
650     #endif
651     #endif
/3rdparty/chromeec/common/system.c: 648 in system_get_board_version()
642     	v = board_get_version();
643     #else
644     	if (gpio_get_level(GPIO_BOARD_VERSION1))
645     		v |= 0x01;
646     	if (gpio_get_level(GPIO_BOARD_VERSION2))
647     		v |= 0x02;
>>>     CID 1353265:    (OVERRUN)
>>>     Overrunning callee's array of size 44 by passing argument "GPIO_BOARD_VERSION3" in call to "gpio_get_level".
648     	if (gpio_get_level(GPIO_BOARD_VERSION3))
649     		v |= 0x04;
650     #endif
651     #endif
652     
653     	return v;

** CID 1353263:    (OVERRUN)


________________________________________________________________________________________________________
*** CID 1353263:    (OVERRUN)
/3rdparty/chromeec/power/braswell.c: 226 in power_handle_state()
220     		msleep(15);
221     
222     		/*
223     		 * Throttle CPU if necessary.  This should only be asserted
224     		 * when +VCCP is powered (it is by now).
225     		 */
>>>     CID 1353263:    (OVERRUN)
>>>     Overrunning callee's array of size 44 by passing argument "GPIO_CPU_PROCHOT" in call to "gpio_set_level".
226     		gpio_set_level(GPIO_CPU_PROCHOT, throttle_cpu);
227     
228     		/* Set SYS and CORE PWROK */
229     		gpio_set_level(GPIO_PCH_SYS_PWROK, 1);
230     
231     		return POWER_S0;
/3rdparty/chromeec/power/braswell.c: 271 in power_handle_state()
265     		enable_sleep(SLEEP_MASK_AP_RUN);
266     
267     		/*
268     		 * Deassert prochot since CPU is off and we're about to drop
269     		 * +VCCP.
270     		 */
>>>     CID 1353263:    (OVERRUN)
>>>     Overrunning callee's array of size 44 by passing argument "GPIO_CPU_PROCHOT" in call to "gpio_set_level".
271     		gpio_set_level(GPIO_CPU_PROCHOT, 0);
272     
273     		return POWER_S3;
274     
275     	case POWER_S3S5:
276     
/3rdparty/chromeec/power/braswell.c: 162 in power_handle_state()
156     		if (power_wait_signals(IN_PGOOD_S5)) {
157     			chipset_force_shutdown();
158     			return POWER_G3;
159     		}
160     
161     		/* Deassert RSMRST# */
>>>     CID 1353263:    (OVERRUN)
>>>     Overrunning callee's array of size 44 by passing argument "GPIO_PCH_RSMRST_L" in call to "gpio_set_level".
162     		gpio_set_level(GPIO_PCH_RSMRST_L, 1);
163     		return POWER_S5;
164     
165     	case POWER_S5:
166     		/* Check for SLP S4 */
167     		if (gpio_get_level(GPIO_PCH_SLP_S4_L) == 1)
/3rdparty/chromeec/power/braswell.c: 309 in power_handle_state()
303     
304     			return POWER_G3;
305     		}
306     
307     		if (gpio_get_level(GPIO_PCH_SUSPWRDNACK) == 1) {
308     			/* Assert RSMRST# */
>>>     CID 1353263:    (OVERRUN)
>>>     Overrunning callee's array of size 44 by passing argument "GPIO_PCH_RSMRST_L" in call to "gpio_set_level".
309     			gpio_set_level(GPIO_PCH_RSMRST_L, 0);
310     
311     			/* Config pins for SOC G3 */
312     			gpio_config_module(MODULE_GPIO, 1);
313     
314     			/* Enter SOC G3 */
/3rdparty/chromeec/power/braswell.c: 318 in power_handle_state()
312     			gpio_config_module(MODULE_GPIO, 1);
313     
314     			/* Enter SOC G3 */
315     #ifdef CONFIG_PMIC
316     			gpio_set_level(GPIO_PCH_SYS_PWROK, 0);
317     			udelay(1);
>>>     CID 1353263:    (OVERRUN)
>>>     Overrunning callee's array of size 44 by passing argument "GPIO_PCH_RSMRST_L" in call to "gpio_set_level".
318     			gpio_set_level(GPIO_PCH_RSMRST_L, 0);
319     #else
320     			gpio_set_level(GPIO_SUSPWRDNACK_SOC_EC, 1);
321     #endif
322     			CPRINTS("Enter SOC G3");
323     
/3rdparty/chromeec/power/braswell.c: 307 in power_handle_state()
301     
302     			CPRINTS("Enter SOC G3");
303     
304     			return POWER_G3;
305     		}
306     
>>>     CID 1353263:    (OVERRUN)
>>>     Overrunning callee's array of size 44 by passing argument "GPIO_PCH_SUSPWRDNACK" in call to "gpio_get_level".
307     		if (gpio_get_level(GPIO_PCH_SUSPWRDNACK) == 1) {
308     			/* Assert RSMRST# */
309     			gpio_set_level(GPIO_PCH_RSMRST_L, 0);
310     
311     			/* Config pins for SOC G3 */
312     			gpio_config_module(MODULE_GPIO, 1);

** CID 1353262:  Memory - corruptions  (OVERRUN)


________________________________________________________________________________________________________
*** CID 1353262:  Memory - corruptions  (OVERRUN)
/3rdparty/chromeec/power/braswell.c: 67 in chipset_force_shutdown()
61     	 * Force power off. This condition will reset once the state machine
62     	 * transitions to G3.
63     	 */
64     #ifndef CONFIG_PMIC
65     	gpio_set_level(GPIO_PCH_SYS_PWROK, 0);
66     #endif
>>>     CID 1353262:  Memory - corruptions  (OVERRUN)
>>>     Overrunning callee's array of size 44 by passing argument "GPIO_PCH_RSMRST_L" in call to "gpio_set_level".
67     	gpio_set_level(GPIO_PCH_RSMRST_L, 0);
68     	forcing_shutdown = 1;
69     }
70     
71     void chipset_reset(int cold_reset)
72     {

** CID 1353249:  Memory - corruptions  (OVERRUN)


________________________________________________________________________________________________________
*** CID 1353249:  Memory - corruptions  (OVERRUN)
/3rdparty/chromeec/power/braswell.c: 108 in chipset_throttle_cpu()
102     	}
103     }
104     
105     void chipset_throttle_cpu(int throttle)
106     {
107     	if (chipset_in_state(CHIPSET_STATE_ON))
>>>     CID 1353249:  Memory - corruptions  (OVERRUN)
>>>     Overrunning callee's array of size 44 by passing argument "GPIO_CPU_PROCHOT" in call to "gpio_set_level".
108     		gpio_set_level(GPIO_CPU_PROCHOT, throttle);
109     }
110     
111     enum power_state power_chipset_init(void)
112     {
113     	/* Pause in S5 when shutting down. */

** CID 1353248:    (OVERRUN)


________________________________________________________________________________________________________
*** CID 1353248:    (OVERRUN)
/3rdparty/chromeec/power/braswell.c: 99 in chipset_reset()
93     		/*
94     		 * Send a reset pulse to the PCH.  This just causes it to
95     		 * assert INIT# to the CPU without dropping power or asserting
96     		 * PLTRST# to reset the rest of the system.  The PCH uses a 16
97     		 * ms debounce time, so assert the signal for twice that.
98     		 */
>>>     CID 1353248:    (OVERRUN)
>>>     Overrunning callee's array of size 44 by passing argument "GPIO_PCH_RCIN_L" in call to "gpio_set_level".
99     		gpio_set_level(GPIO_PCH_RCIN_L, 0);
100     		usleep(32 * MSEC);
101     		gpio_set_level(GPIO_PCH_RCIN_L, 1);
102     	}
103     }
104     
/3rdparty/chromeec/power/braswell.c: 101 in chipset_reset()
95     		 * assert INIT# to the CPU without dropping power or asserting
96     		 * PLTRST# to reset the rest of the system.  The PCH uses a 16
97     		 * ms debounce time, so assert the signal for twice that.
98     		 */
99     		gpio_set_level(GPIO_PCH_RCIN_L, 0);
100     		usleep(32 * MSEC);
>>>     CID 1353248:    (OVERRUN)
>>>     Overrunning callee's array of size 44 by passing argument "GPIO_PCH_RCIN_L" in call to "gpio_set_level".
101     		gpio_set_level(GPIO_PCH_RCIN_L, 1);
102     	}
103     }
104     
105     void chipset_throttle_cpu(int throttle)
106     {

** CID 1353243:  Memory - corruptions  (OVERRUN)


________________________________________________________________________________________________________
*** CID 1353243:  Memory - corruptions  (OVERRUN)
/3rdparty/chromeec/board/kunimitsu/board.c: 629 in board_handle_reboot()
623     
624     	ccprintf("Restarting system with PMIC.\n");
625     	/* Flush console */
626     	cflush();
627     
628     	/* Bring down all rails but RTC rail (including EC power). */
>>>     CID 1353243:  Memory - corruptions  (OVERRUN)
>>>     Overrunning callee's array of size 44 by passing argument "GPIO_LDO_EN" in call to "gpio_set_level".
629     	gpio_set_level(GPIO_LDO_EN, 1);
630     	while (1)
631     		; /* wait here */
632     }

** CID 1353241:  Memory - corruptions  (OVERRUN)


________________________________________________________________________________________________________
*** CID 1353241:  Memory - corruptions  (OVERRUN)
/3rdparty/chromeec/common/flash.c: 409 in flash_get_protect()
403     #ifdef CONFIG_WP_ALWAYS
404     	flags |= EC_FLASH_PROTECT_GPIO_ASSERTED;
405     #elif defined(CONFIG_WP_ACTIVE_HIGH)
406     	if (gpio_get_level(GPIO_WP))
407     		flags |= EC_FLASH_PROTECT_GPIO_ASSERTED;
408     #else
>>>     CID 1353241:  Memory - corruptions  (OVERRUN)
>>>     Overrunning callee's array of size 44 by passing argument "GPIO_WP_L" in call to "gpio_get_level".
409     	if (!gpio_get_level(GPIO_WP_L))
410     		flags |= EC_FLASH_PROTECT_GPIO_ASSERTED;
411     #endif
412     
413     #ifdef CONFIG_FLASH_PSTATE
414     	/* Read persistent state of RO-at-boot flag */

** CID 1353215:  Memory - corruptions  (OVERRUN)


________________________________________________________________________________________________________
*** CID 1353215:  Memory - corruptions  (OVERRUN)
/3rdparty/chromeec/power/braswell.c: 132 in power_chipset_init()
126     			CPRINTS("already in S0");
127     			return POWER_S0;
128     		} else {
129     			/* Force all signals to their G3 states */
130     			CPRINTS("forcing G3");
131     			gpio_set_level(GPIO_PCH_SYS_PWROK, 0);
>>>     CID 1353215:  Memory - corruptions  (OVERRUN)
>>>     Overrunning callee's array of size 44 by passing argument "GPIO_PCH_RSMRST_L" in call to "gpio_set_level".
132     			gpio_set_level(GPIO_PCH_RSMRST_L, 0);
133     
134     			/*wireless_set_state(WIRELESS_OFF);*/
135     		}
136     	}
137     

** CID 1353203:    (OVERRUN)


________________________________________________________________________________________________________
*** CID 1353203:    (OVERRUN)
/3rdparty/chromeec/board/chell/board.c: 181 in board_reset_pd_mcu()
175     
176     /**
177      * Reset PD MCU
178      */
179     void board_reset_pd_mcu(void)
180     {
>>>     CID 1353203:    (OVERRUN)
>>>     Overrunning callee's array of size 44 by passing argument "GPIO_PD_RST_L" in call to "gpio_set_level".
181     	gpio_set_level(GPIO_PD_RST_L, 0);
182     	usleep(100);
183     	gpio_set_level(GPIO_PD_RST_L, 1);
184     }
185     
186     void board_rtc_reset(void)
/3rdparty/chromeec/board/chell/board.c: 183 in board_reset_pd_mcu()
177      * Reset PD MCU
178      */
179     void board_reset_pd_mcu(void)
180     {
181     	gpio_set_level(GPIO_PD_RST_L, 0);
182     	usleep(100);
>>>     CID 1353203:    (OVERRUN)
>>>     Overrunning callee's array of size 44 by passing argument "GPIO_PD_RST_L" in call to "gpio_set_level".
183     	gpio_set_level(GPIO_PD_RST_L, 1);
184     }
185     
186     void board_rtc_reset(void)
187     {
188     	CPRINTS("Asserting RTCRST# to PCH");

** CID 1353199:    (OVERRUN)


________________________________________________________________________________________________________
*** CID 1353199:    (OVERRUN)
/3rdparty/chromeec/chip/mec1322/system.c: 266 in system_hibernate()
260     	/*
261     	 * Leave USB-C charging enabled in hibernate, in order to
262     	 * allow wake-on-plug. 5V enable must be pulled low.
263     	 */
264     #if CONFIG_USB_PD_PORT_COUNT > 0
265     	gpio_set_flags(GPIO_USB_C0_5V_EN, GPIO_PULL_DOWN | GPIO_INPUT);
>>>     CID 1353199:    (OVERRUN)
>>>     Overrunning callee's array of size 44 by passing argument "GPIO_USB_C0_CHARGE_EN_L" in call to "gpio_set_level".
266     	gpio_set_level(GPIO_USB_C0_CHARGE_EN_L, 0);
267     #endif
268     #if CONFIG_USB_PD_PORT_COUNT > 1
269     	gpio_set_flags(GPIO_USB_C1_5V_EN, GPIO_PULL_DOWN | GPIO_INPUT);
270     	gpio_set_level(GPIO_USB_C1_CHARGE_EN_L, 0);
271     #endif
/3rdparty/chromeec/chip/mec1322/system.c: 270 in system_hibernate()
264     #if CONFIG_USB_PD_PORT_COUNT > 0
265     	gpio_set_flags(GPIO_USB_C0_5V_EN, GPIO_PULL_DOWN | GPIO_INPUT);
266     	gpio_set_level(GPIO_USB_C0_CHARGE_EN_L, 0);
267     #endif
268     #if CONFIG_USB_PD_PORT_COUNT > 1
269     	gpio_set_flags(GPIO_USB_C1_5V_EN, GPIO_PULL_DOWN | GPIO_INPUT);
>>>     CID 1353199:    (OVERRUN)
>>>     Overrunning callee's array of size 44 by passing argument "GPIO_USB_C1_CHARGE_EN_L" in call to "gpio_set_level".
270     	gpio_set_level(GPIO_USB_C1_CHARGE_EN_L, 0);
271     #endif
272     #endif /* CONFIG_USB_PD_PORT_COUNT */
273     
274     	if (hibernate_wake_pins_used > 0) {
275     		for (i = 0; i < hibernate_wake_pins_used; ++i) {

** CID 1353189:    (OVERRUN)


________________________________________________________________________________________________________
*** CID 1353189:    (OVERRUN)
/3rdparty/chromeec/board/chell/board.c: 303 in board_set_active_charge_port()
297     int board_set_active_charge_port(int charge_port)
298     {
299     	/* charge port is a realy physical port */
300     	int is_real_port = (charge_port >= 0 &&
301     			    charge_port < CONFIG_USB_PD_PORT_COUNT);
302     	/* check if we are source vbus on that port */
>>>     CID 1353189:    (OVERRUN)
>>>     Overrunning callee's array of size 44 by passing argument "(charge_port == 0) ? GPIO_USB_C0_5V_EN : GPIO_USB_C1_5V_EN" (which evaluates to 54) in call to "gpio_get_level".
303     	int source = gpio_get_level(charge_port == 0 ? GPIO_USB_C0_5V_EN :
304     						       GPIO_USB_C1_5V_EN);
305     
306     	if (is_real_port && source) {
307     		CPRINTS("Skip enable p%d", charge_port);
308     		return EC_ERROR_INVAL;
/3rdparty/chromeec/board/chell/board.c: 319 in board_set_active_charge_port()
313     	if (charge_port == CHARGE_PORT_NONE) {
314     		/* Disable both ports */
315     		gpio_set_level(GPIO_USB_C0_CHARGE_EN_L, 1);
316     		gpio_set_level(GPIO_USB_C1_CHARGE_EN_L, 1);
317     	} else {
318     		/* Make sure non-charging port is disabled */
>>>     CID 1353189:    (OVERRUN)
>>>     Overrunning callee's array of size 44 by passing argument "charge_port ? GPIO_USB_C0_CHARGE_EN_L : GPIO_USB_C1_CHARGE_EN_L" (which evaluates to 57) in call to "gpio_set_level".
319     		gpio_set_level(charge_port ? GPIO_USB_C0_CHARGE_EN_L :
320     					     GPIO_USB_C1_CHARGE_EN_L, 1);
321     		/* Enable charging port */
322     		gpio_set_level(charge_port ? GPIO_USB_C1_CHARGE_EN_L :
323     					     GPIO_USB_C0_CHARGE_EN_L, 0);
324     	}
/3rdparty/chromeec/board/chell/board.c: 322 in board_set_active_charge_port()
316     		gpio_set_level(GPIO_USB_C1_CHARGE_EN_L, 1);
317     	} else {
318     		/* Make sure non-charging port is disabled */
319     		gpio_set_level(charge_port ? GPIO_USB_C0_CHARGE_EN_L :
320     					     GPIO_USB_C1_CHARGE_EN_L, 1);
321     		/* Enable charging port */
>>>     CID 1353189:    (OVERRUN)
>>>     Overrunning callee's array of size 44 by passing argument "charge_port ? GPIO_USB_C1_CHARGE_EN_L : GPIO_USB_C0_CHARGE_EN_L" (which evaluates to 56) in call to "gpio_set_level".
322     		gpio_set_level(charge_port ? GPIO_USB_C1_CHARGE_EN_L :
323     					     GPIO_USB_C0_CHARGE_EN_L, 0);
324     	}
325     
326     	return EC_SUCCESS;
327     }
/3rdparty/chromeec/board/chell/board.c: 315 in board_set_active_charge_port()
309     	}
310     
311     	CPRINTS("New chg p%d", charge_port);
312     
313     	if (charge_port == CHARGE_PORT_NONE) {
314     		/* Disable both ports */
>>>     CID 1353189:    (OVERRUN)
>>>     Overrunning callee's array of size 44 by passing argument "GPIO_USB_C0_CHARGE_EN_L" in call to "gpio_set_level".
315     		gpio_set_level(GPIO_USB_C0_CHARGE_EN_L, 1);
316     		gpio_set_level(GPIO_USB_C1_CHARGE_EN_L, 1);
317     	} else {
318     		/* Make sure non-charging port is disabled */
319     		gpio_set_level(charge_port ? GPIO_USB_C0_CHARGE_EN_L :
320     					     GPIO_USB_C1_CHARGE_EN_L, 1);
/3rdparty/chromeec/board/chell/board.c: 316 in board_set_active_charge_port()
310     
311     	CPRINTS("New chg p%d", charge_port);
312     
313     	if (charge_port == CHARGE_PORT_NONE) {
314     		/* Disable both ports */
315     		gpio_set_level(GPIO_USB_C0_CHARGE_EN_L, 1);
>>>     CID 1353189:    (OVERRUN)
>>>     Overrunning callee's array of size 44 by passing argument "GPIO_USB_C1_CHARGE_EN_L" in call to "gpio_set_level".
316     		gpio_set_level(GPIO_USB_C1_CHARGE_EN_L, 1);
317     	} else {
318     		/* Make sure non-charging port is disabled */
319     		gpio_set_level(charge_port ? GPIO_USB_C0_CHARGE_EN_L :
320     					     GPIO_USB_C1_CHARGE_EN_L, 1);
321     		/* Enable charging port */
/3rdparty/chromeec/board/kunimitsu/board.c: 551 in board_set_active_charge_port()
545     int board_set_active_charge_port(int charge_port)
546     {
547     	/* charge port is a realy physical port */
548     	int is_real_port = (charge_port >= 0 &&
549     			    charge_port < CONFIG_USB_PD_PORT_COUNT);
550     	/* check if we are source vbus on that port */
>>>     CID 1353189:    (OVERRUN)
>>>     Overrunning callee's array of size 44 by passing argument "(charge_port == 0) ? GPIO_USB_C0_5V_EN : GPIO_USB_C1_5V_EN" (which evaluates to 56) in call to "gpio_get_level".
551     	int source = gpio_get_level(charge_port == 0 ? GPIO_USB_C0_5V_EN :
552     						       GPIO_USB_C1_5V_EN);
553     
554     	if (is_real_port && source) {
555     		CPRINTS("Skip enable p%d", charge_port);
556     		return EC_ERROR_INVAL;
/3rdparty/chromeec/board/kunimitsu/board.c: 567 in board_set_active_charge_port()
561     	if (charge_port == CHARGE_PORT_NONE) {
562     		/* Disable both ports */
563     		gpio_set_level(GPIO_USB_C0_CHARGE_EN_L, 1);
564     		gpio_set_level(GPIO_USB_C1_CHARGE_EN_L, 1);
565     	} else {
566     		/* Make sure non-charging port is disabled */
>>>     CID 1353189:    (OVERRUN)
>>>     Overrunning callee's array of size 44 by passing argument "charge_port ? GPIO_USB_C0_CHARGE_EN_L : GPIO_USB_C1_CHARGE_EN_L" (which evaluates to 59) in call to "gpio_set_level".
567     		gpio_set_level(charge_port ? GPIO_USB_C0_CHARGE_EN_L :
568     					     GPIO_USB_C1_CHARGE_EN_L, 1);
569     		/* Enable charging port */
570     		gpio_set_level(charge_port ? GPIO_USB_C1_CHARGE_EN_L :
571     					     GPIO_USB_C0_CHARGE_EN_L, 0);
572     	}
/3rdparty/chromeec/board/kunimitsu/board.c: 570 in board_set_active_charge_port()
564     		gpio_set_level(GPIO_USB_C1_CHARGE_EN_L, 1);
565     	} else {
566     		/* Make sure non-charging port is disabled */
567     		gpio_set_level(charge_port ? GPIO_USB_C0_CHARGE_EN_L :
568     					     GPIO_USB_C1_CHARGE_EN_L, 1);
569     		/* Enable charging port */
>>>     CID 1353189:    (OVERRUN)
>>>     Overrunning callee's array of size 44 by passing argument "charge_port ? GPIO_USB_C1_CHARGE_EN_L : GPIO_USB_C0_CHARGE_EN_L" (which evaluates to 58) in call to "gpio_set_level".
570     		gpio_set_level(charge_port ? GPIO_USB_C1_CHARGE_EN_L :
571     					     GPIO_USB_C0_CHARGE_EN_L, 0);
572     	}
573     
574     	return EC_SUCCESS;
575     }
/3rdparty/chromeec/board/kunimitsu/board.c: 563 in board_set_active_charge_port()
557     	}
558     
559     	CPRINTS("New chg p%d", charge_port);
560     
561     	if (charge_port == CHARGE_PORT_NONE) {
562     		/* Disable both ports */
>>>     CID 1353189:    (OVERRUN)
>>>     Overrunning callee's array of size 44 by passing argument "GPIO_USB_C0_CHARGE_EN_L" in call to "gpio_set_level".
563     		gpio_set_level(GPIO_USB_C0_CHARGE_EN_L, 1);
564     		gpio_set_level(GPIO_USB_C1_CHARGE_EN_L, 1);
565     	} else {
566     		/* Make sure non-charging port is disabled */
567     		gpio_set_level(charge_port ? GPIO_USB_C0_CHARGE_EN_L :
568     					     GPIO_USB_C1_CHARGE_EN_L, 1);
/3rdparty/chromeec/board/kunimitsu/board.c: 564 in board_set_active_charge_port()
558     
559     	CPRINTS("New chg p%d", charge_port);
560     
561     	if (charge_port == CHARGE_PORT_NONE) {
562     		/* Disable both ports */
563     		gpio_set_level(GPIO_USB_C0_CHARGE_EN_L, 1);
>>>     CID 1353189:    (OVERRUN)
>>>     Overrunning callee's array of size 44 by passing argument "GPIO_USB_C1_CHARGE_EN_L" in call to "gpio_set_level".
564     		gpio_set_level(GPIO_USB_C1_CHARGE_EN_L, 1);
565     	} else {
566     		/* Make sure non-charging port is disabled */
567     		gpio_set_level(charge_port ? GPIO_USB_C0_CHARGE_EN_L :
568     					     GPIO_USB_C1_CHARGE_EN_L, 1);
569     		/* Enable charging port */

** CID 1353188:  Memory - corruptions  (OVERRUN)


________________________________________________________________________________________________________
*** CID 1353188:  Memory - corruptions  (OVERRUN)
/3rdparty/chromeec/board/kunimitsu/board.c: 524 in board_init()
518     
519     	/* Enable pericom BC1.2 interrupts */
520     	gpio_enable_interrupt(GPIO_USB_C0_BC12_INT_L);
521     	gpio_enable_interrupt(GPIO_USB_C1_BC12_INT_L);
522     
523     	/* Provide AC status to the PCH */
>>>     CID 1353188:  Memory - corruptions  (OVERRUN)
>>>     Overrunning callee's array of size 44 by passing argument "GPIO_PCH_ACOK" in call to "gpio_set_level".
524     	gpio_set_level(GPIO_PCH_ACOK, extpower_is_present());
525     }
526     DECLARE_HOOK(HOOK_INIT, board_init, HOOK_PRIO_DEFAULT);
527     
528     /**
529      * Buffer the AC present GPIO to the PCH.

** CID 1353187:  Memory - corruptions  (OVERRUN)


________________________________________________________________________________________________________
*** CID 1353187:  Memory - corruptions  (OVERRUN)
/3rdparty/chromeec/board/kunimitsu/board.c: 533 in board_extpower()
527     
528     /**
529      * Buffer the AC present GPIO to the PCH.
530      */
531     static void board_extpower(void)
532     {
>>>     CID 1353187:  Memory - corruptions  (OVERRUN)
>>>     Overrunning callee's array of size 44 by passing argument "GPIO_PCH_ACOK" in call to "gpio_set_level".
533     	gpio_set_level(GPIO_PCH_ACOK, extpower_is_present());
534     }
535     DECLARE_HOOK(HOOK_AC_CHANGE, board_extpower, HOOK_PRIO_DEFAULT);
536     
537     /**
538      * Set active charge port -- only one port can be active at a time.

** CID 1353185:    (OVERRUN)


________________________________________________________________________________________________________
*** CID 1353185:    (OVERRUN)
/3rdparty/chromeec/board/chell/board.c: 344 in board_chipset_startup()
338     }
339     
340     /* Called on AP S5 -> S3 transition */
341     static void board_chipset_startup(void)
342     {
343     	gpio_set_level(GPIO_USB1_ENABLE, 1);
>>>     CID 1353185:    (OVERRUN)
>>>     Overrunning callee's array of size 44 by passing argument "GPIO_ENABLE_TOUCHPAD" in call to "gpio_set_level".
344     	gpio_set_level(GPIO_ENABLE_TOUCHPAD, 1);
345     }
346     DECLARE_HOOK(HOOK_CHIPSET_STARTUP, board_chipset_startup, HOOK_PRIO_DEFAULT);
347     
348     /* Called on AP S3 -> S5 transition */
349     static void board_chipset_shutdown(void)
/3rdparty/chromeec/board/chell/board.c: 343 in board_chipset_startup()
337     					   CONFIG_CHARGER_INPUT_CURRENT));
338     }
339     
340     /* Called on AP S5 -> S3 transition */
341     static void board_chipset_startup(void)
342     {
>>>     CID 1353185:    (OVERRUN)
>>>     Overrunning callee's array of size 44 by passing argument "GPIO_USB1_ENABLE" in call to "gpio_set_level".
343     	gpio_set_level(GPIO_USB1_ENABLE, 1);
344     	gpio_set_level(GPIO_ENABLE_TOUCHPAD, 1);
345     }
346     DECLARE_HOOK(HOOK_CHIPSET_STARTUP, board_chipset_startup, HOOK_PRIO_DEFAULT);
347     
348     /* Called on AP S3 -> S5 transition */

** CID 1353184:    (OVERRUN)


________________________________________________________________________________________________________
*** CID 1353184:    (OVERRUN)
/3rdparty/chromeec/board/chell/board.c: 352 in board_chipset_shutdown()
346     DECLARE_HOOK(HOOK_CHIPSET_STARTUP, board_chipset_startup, HOOK_PRIO_DEFAULT);
347     
348     /* Called on AP S3 -> S5 transition */
349     static void board_chipset_shutdown(void)
350     {
351     	gpio_set_level(GPIO_USB1_ENABLE, 0);
>>>     CID 1353184:    (OVERRUN)
>>>     Overrunning callee's array of size 44 by passing argument "GPIO_ENABLE_TOUCHPAD" in call to "gpio_set_level".
352     	gpio_set_level(GPIO_ENABLE_TOUCHPAD, 0);
353     }
354     DECLARE_HOOK(HOOK_CHIPSET_SHUTDOWN, board_chipset_shutdown, HOOK_PRIO_DEFAULT);
355     
356     /* Called on AP S3 -> S0 transition */
357     static void board_chipset_resume(void)
/3rdparty/chromeec/board/chell/board.c: 351 in board_chipset_shutdown()
345     }
346     DECLARE_HOOK(HOOK_CHIPSET_STARTUP, board_chipset_startup, HOOK_PRIO_DEFAULT);
347     
348     /* Called on AP S3 -> S5 transition */
349     static void board_chipset_shutdown(void)
350     {
>>>     CID 1353184:    (OVERRUN)
>>>     Overrunning callee's array of size 44 by passing argument "GPIO_USB1_ENABLE" in call to "gpio_set_level".
351     	gpio_set_level(GPIO_USB1_ENABLE, 0);
352     	gpio_set_level(GPIO_ENABLE_TOUCHPAD, 0);
353     }
354     DECLARE_HOOK(HOOK_CHIPSET_SHUTDOWN, board_chipset_shutdown, HOOK_PRIO_DEFAULT);
355     
356     /* Called on AP S3 -> S0 transition */


________________________________________________________________________________________________________
To view the defects in Coverity Scan visit, https://scan.coverity.com/projects/coreboot?tab=overview

To manage Coverity Scan email notifications for "coreboot at coreboot.org", click https://scan.coverity.com/subscriptions/edit?email=coreboot%40coreboot.org&token=49533df725f93b78361afb7b89ccde93




More information about the coreboot mailing list