flashrom December 2013

flashrom@flashrom.org

24 participants
69 discussions

Add timeout check to SPI bitbang bus request
by Carl-Daniel Hailfinger 29 Apr '14

29 Apr '14

Hi Iain, your Intel 82540EM which hangs on a flashrom run should spew "Timeout!" messages with this patch. It would be nice if you could tell us how long it waits for each chip probe so I can adjust the timeout value. Please note that this patch will _not_ fix the underlying issue, but I believe that an endless loop on possibly broken hardware is worse than aborting. Signed-off-by: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006(a)gmx.net> Index: flashrom-bitbang_timeout/flash.h =================================================================== --- flashrom-bitbang_timeout/flash.h (Revision 1185) +++ flashrom-bitbang_timeout/flash.h (Arbeitskopie) @@ -35,6 +35,9 @@ #define ERROR_PTR ((void*)-1) +/* Error codes */ +#define TIMEOUT_ERROR -101 + typedef unsigned long chipaddr; int register_shutdown(void (*function) (void *data), void *data); Index: flashrom-bitbang_timeout/bitbang_spi.c =================================================================== --- flashrom-bitbang_timeout/bitbang_spi.c (Revision 1185) +++ flashrom-bitbang_timeout/bitbang_spi.c (Arbeitskopie) @@ -53,10 +53,11 @@ return bitbang_spi_master->get_miso(); } -static void bitbang_spi_request_bus(void) +static int bitbang_spi_request_bus(void) { if (bitbang_spi_master->request_bus) - bitbang_spi_master->request_bus(); + return bitbang_spi_master->request_bus(); + return 0; } static void bitbang_spi_release_bus(void) @@ -86,7 +87,7 @@ bitbang_spi_master = master; bitbang_spi_half_period = halfperiod; - /* FIXME: Run bitbang_spi_request_bus here or in programmer init? */ + /* FIXME: Run bitbang_spi_request_bus here or per command? */ bitbang_spi_set_cs(1); bitbang_spi_set_sck(0); bitbang_spi_set_mosi(0); @@ -131,13 +132,15 @@ int bitbang_spi_send_command(unsigned int writecnt, unsigned int readcnt, const unsigned char *writearr, unsigned char *readarr) { - int i; + int i, ret; /* FIXME: Run bitbang_spi_request_bus here or in programmer init? * Requesting and releasing the SPI bus is handled in here to allow the * programmer to use its own SPI engine for native accesses. */ - bitbang_spi_request_bus(); + ret = bitbang_spi_request_bus(); + if (ret) + return ret; bitbang_spi_set_cs(0); for (i = 0; i < writecnt; i++) bitbang_spi_readwrite_byte(writearr[i]); Index: flashrom-bitbang_timeout/nicintel_spi.c =================================================================== --- flashrom-bitbang_timeout/nicintel_spi.c (Revision 1185) +++ flashrom-bitbang_timeout/nicintel_spi.c (Arbeitskopie) @@ -58,6 +58,8 @@ // #define FL_BUSY 30 // #define FL_ER 31 +#define MAX_REQUEST_LOOPS 10000 + uint8_t *nicintel_spibar; const struct pcidev_status nics_intel_spi[] = { @@ -68,16 +70,27 @@ {}, }; -static void nicintel_request_spibus(void) +static void nicintel_release_spibus(void); + +static int nicintel_request_spibus(void) { uint32_t tmp; + int i = 0; tmp = pci_mmio_readl(nicintel_spibar + FLA); tmp |= 1 << FL_REQ; pci_mmio_writel(tmp, nicintel_spibar + FLA); /* Wait until we are allowed to use the SPI bus. */ - while (!(pci_mmio_readl(nicintel_spibar + FLA) & (1 << FL_GNT))) ; + while (!(pci_mmio_readl(nicintel_spibar + FLA) & (1 << FL_GNT))) { + if (i++ > MAX_REQUEST_LOOPS) { + nicintel_release_spibus(); + msg_perr("%s: Timeout! Aborting.\n", __func__); + return TIMEOUT_ERROR; + } + } + + return 0; } static void nicintel_release_spibus(void) Index: flashrom-bitbang_timeout/mcp6x_spi.c =================================================================== --- flashrom-bitbang_timeout/mcp6x_spi.c (Revision 1185) +++ flashrom-bitbang_timeout/mcp6x_spi.c (Arbeitskopie) @@ -40,22 +40,37 @@ #define MCP6X_SPI_REQUEST 0 #define MCP6X_SPI_GRANT 8 +#define MAX_REQUEST_LOOPS 10000 + void *mcp6x_spibar = NULL; /* Cached value of last GPIO state. */ static uint8_t mcp_gpiostate; -static void mcp6x_request_spibus(void) +static void mcp6x_release_spibus(void); + +static int mcp6x_request_spibus(void) { + int i = 0; + mcp_gpiostate = mmio_readb(mcp6x_spibar + 0x530); mcp_gpiostate |= 1 << MCP6X_SPI_REQUEST; mmio_writeb(mcp_gpiostate, mcp6x_spibar + 0x530); /* Wait until we are allowed to use the SPI bus. */ - while (!(mmio_readw(mcp6x_spibar + 0x530) & (1 << MCP6X_SPI_GRANT))) ; + while (!(mmio_readw(mcp6x_spibar + 0x530) & (1 << MCP6X_SPI_GRANT))) { + if (i++ > MAX_REQUEST_LOOPS) { + /* Update the cache. */ + mcp_gpiostate = mmio_readb(mcp6x_spibar + 0x530); + mcp6x_release_spibus(); + msg_perr("%s: Timeout! Aborting.\n", __func__); + return TIMEOUT_ERROR; + } + } /* Update the cache. */ mcp_gpiostate = mmio_readb(mcp6x_spibar + 0x530); + return 0; } static void mcp6x_release_spibus(void) Index: flashrom-bitbang_timeout/programmer.h =================================================================== --- flashrom-bitbang_timeout/programmer.h (Revision 1185) +++ flashrom-bitbang_timeout/programmer.h (Arbeitskopie) @@ -131,7 +131,7 @@ void (*set_sck) (int val); void (*set_mosi) (int val); int (*get_miso) (void); - void (*request_bus) (void); + int (*request_bus) (void); void (*release_bus) (void); }; -- http://www.hailfinger.org/

4 15

Flashrom stuck using 100% cpu while probing for a chip
by GatoLoko 28 Apr '14

28 Apr '14

I've tried to run flashrom -V to see if it could identify the chip on my new board (AsRock M3A-GLAN), and it got stuck while probing for the first chip. I've tried commenting out that specific chip (AMIC A25L05PT) and then it gets stuck on the next one. Then commented out all AMIC chips, and it got stuck on the next one (the first ATMEL on the list) I've tried with an older flashrom (0.9.2-r1141). It skipped some AMD chips, then got stuck on AMIC again. Talked with "tlt" and "stefanct" on irc and they asked for a strace and a gdb backtrace. Strace produced no results. Gdb log is attached. "stefanct" tried and reproduced it on a machine with nicintel_spi, but warned it was with an unsupported nic: http://paste.flashrom.org/view.php?id=738 -- GatoLoko

4 11

[PATCH] CID1130009: Resource leak
by Stefan Reinauer 26 Apr '14

26 Apr '14

CID1130009: Resource leak The system resource will not be reclaimed and reused, reducing the future availability of the resource. In sp_opensocket: Leak of memory or pointers to system resources Signed-off-by: Stefan Reinauer <stefan.reinauer(a)coreboot.org> Index: serprog.c =================================================================== --- serprog.c (revision 1763) +++ serprog.c (working copy) @@ -100,6 +100,7 @@ if (NULL == hostPtr) { hostPtr = gethostbyaddr(ip, strlen(ip), AF_INET); if (NULL == hostPtr) { + close(sock); msg_perr("Error: cannot resolve %s\n", ip); return -1; }

2 1

[PATCH] CID1130008: Resource leak
by Stefan Reinauer 26 Apr '14

26 Apr '14

CID1130008: Resource leak The system resource will not be reclaimed and reused, reducing the future availability of the resource. In read_romlayout: Leak of memory or pointers to system resources Signed-off-by: Stefan Reinauer <stefan.reinauer(a)coreboot.org> Index: layout.c =================================================================== --- layout.c (revision 1763) +++ layout.c (working copy) @@ -65,6 +65,7 @@ if (num_rom_entries >= MAX_ROMLAYOUT) { msg_gerr("Maximum number of ROM images (%i) in layout " "file reached.\n", MAX_ROMLAYOUT); + fclose(romlayout); return 1; } if (2 != fscanf(romlayout, "%s %s\n", tempstr, rom_entries[num_rom_entries].name))

2 1

[PATCH] CID1130007: Resource leak
by Stefan Reinauer 26 Apr '14

26 Apr '14

CID1130007: Resource leak The system resource will not be reclaimed and reused, reducing the future availability of the resource. In ogp_spi_init: Leak of memory or pointers to system resources Signed-off-by: Stefan Reinauer <stefan.reinauer(a)coreboot.org> Index: ogp_spi.c =================================================================== --- ogp_spi.c (revision 1763) +++ ogp_spi.c (working copy) @@ -120,8 +120,10 @@ ogp_reg_sck = OGA1_XP10_CPROM_SCK; } else { msg_perr("Invalid or missing rom= parameter.\n"); + free(type); return 1; } + free(type); if (rget_io_perms()) return 1;

2 1

[PATCH] CID1130011: Use after free
by Stefan Reinauer 26 Apr '14

26 Apr '14

CID1130011: Use after free This could cause an immediate crash or incorrect values might be read subsequently resulting in incorrect computations. In dump_file: A pointer to freed memory is dereferenced, used as a function argument, or otherwise used Signed-off-by: Stefan Reinauer <stefan.reinauer(a)coreboot.org> Index: util/ich_descriptors_tool/ich_descriptors_tool.c =================================================================== --- util/ich_descriptors_tool/ich_descriptors_tool.c (revision 1763) +++ util/ich_descriptors_tool/ich_descriptors_tool.c (working copy) @@ -77,12 +77,13 @@ printf("Dumping %u bytes of the %s region from 0x%08x-0x%08x to %s... ", file_len, region_names[i], base, limit, fn); int fh = open(fn, O_WRONLY | O_CREAT, S_IRUSR | S_IWUSR); - free(fn); if (fh < 0) { fprintf(stderr, "ERROR: couldn't open(%s): %s\n", fn, strerror(errno)); + free(fn); exit(1); } + free(fn); ret = write(fh, &dump[base >> 2], file_len); if (ret != file_len) {

2 1

[PATCH] CID1130012: Double free
by Stefan Reinauer 26 Apr '14

26 Apr '14

CID1130012: Double free Depending on the implementation of the deallocator function, the memory may by placed on the free list more than once. In pony_spi_init: Memory is deallocated more than once Signed-off-by: Stefan Reinauer <stefan.reinauer(a)coreboot.org> Index: pony_spi.c =================================================================== --- pony_spi.c (revision 1763) +++ pony_spi.c (working copy) @@ -140,6 +140,7 @@ } else if (arg && !strlen(arg)) { msg_perr("Error: Missing argument for programmer type.\n"); free(arg); + return 1; } else if (arg){ msg_perr("Error: Invalid programmer type specified.\n"); free(arg);

2 1

[PATCH] CID1130004: Nesting level does not match indentation
by Stefan Reinauer 26 Apr '14

26 Apr '14

CID1130004: Nesting level does not match indentation Code that is meant to be executed conditionally may be executed unconditionally In print_supported_boards_helper: The indentation of this code suggests it is nested when it is not. Signed-off-by: Stefan Reinauer <stefan.reinauer(a)coreboot.org> Index: print.c =================================================================== --- print.c (revision 1763) +++ print.c (working copy) @@ -436,13 +436,14 @@ msg_ginfo("%s", b->name); for (i = 0; i < maxboardlen - strlen(b->name); i++) msg_ginfo(" "); - if (b->working == OK) - msg_ginfo("OK "); - else if (b->working == NT) - msg_ginfo("NT "); - else - msg_ginfo("BAD "); + if (b->working == OK) + msg_ginfo("OK "); + else if (b->working == NT) + msg_ginfo("NT "); + else + msg_ginfo("BAD "); + for (e = board_matches; e->vendor_name != NULL; e++) { if (strcmp(e->vendor_name, b->vendor) || strcmp(e->board_name, b->name))

2 1

[PATCH] CID1129996: Unchecked return value from library
by Stefan Reinauer 26 Apr '14

26 Apr '14

CID1129996: Unchecked return value from library The function returns a value that indicates an error condition. If this is not checked, the error condition may not be handled correctly. In sp_opensocket: Value returned from a library function is not checked for errors before being used. This value may indicate an error condition. (CWE-252) Signed-off-by: Stefan Reinauer <stefan.reinauer(a)coreboot.org> Index: serprog.c =================================================================== --- serprog.c (revision 1763) +++ serprog.c (working copy) @@ -114,7 +114,11 @@ } /* We are latency limited, and sometimes do write-write-read * * (write-n) - so enable TCP_NODELAY. */ - setsockopt(sock, IPPROTO_TCP, TCP_NODELAY, &flag, sizeof(int)); + if (setsockopt(sock, IPPROTO_TCP, TCP_NODELAY, &flag, sizeof(int))) { + close(sock); + msg_perr("Error: serprog cannot set socket options: %s\n", strerror(errno)); + return -1; + } return sock; } #endif

2 1

[PATCH] CID1130000: Unchecked return value
by Stefan Reinauer 26 Apr '14

26 Apr '14

CID1130000: Unchecked return value If the function returns an error value, the error value may be mistaken for a normal value. In default_spi_write_aai: Value returned from a function is not checked for errors before being used Signed-off-by: Stefan Reinauer <stefan.reinauer(a)coreboot.org> Index: spi25.c =================================================================== --- spi25.c (revision 1763) +++ spi25.c (working copy) @@ -1146,8 +1146,10 @@ while (pos < start + len - 1) { cmd[1] = buf[pos++ - start]; cmd[2] = buf[pos++ - start]; - spi_send_command(flash, JEDEC_AAI_WORD_PROGRAM_CONT_OUTSIZE, 0, - cmd, NULL); + result = spi_send_command(flash, JEDEC_AAI_WORD_PROGRAM_CONT_OUTSIZE, + 0, cmd, NULL); + if (result != 0) + msg_cerr("%s failed.\n", __func__); while (spi_read_status_register(flash) & SPI_SR_WIP) programmer_delay(10); }

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

flashrom December 2013