flashrom

flashrom@flashrom.org

5 participants
9161 discussions

[PATCH] ft2232_spi: refine error handling in init() and add shutdown function
by Stefan Tauner 16 Mar '16

16 Mar '16

Signed-off-by: Stefan Tauner <stefan.tauner(a)alumni.tuwien.ac.at> --- ft2232_spi.c | 84 ++++++++++++++++++++++++++++++++++-------------------------- 1 file changed, 47 insertions(+), 37 deletions(-) Build-tested on the buildbot but not runtime-tested (i still do not own an FT*232 device yet... I can't believe that either :P). diff --git a/ft2232_spi.c b/ft2232_spi.c index be60837..6d388e3 100644 --- a/ft2232_spi.c +++ b/ft2232_spi.c @@ -101,7 +101,7 @@ const struct dev_entry devs_ft2232spi[] = { */ static uint8_t cs_bits = 0x08; static uint8_t pindir = 0x0b; -static struct ftdi_context ftdic_context; +static struct ftdi_context ftdic_context = {0}; static const char *get_ft2232_devicename(int ft2232_vid, int ft2232_type) { @@ -168,10 +168,19 @@ static const struct spi_master spi_master_ft2232 = { .write_aai = default_spi_write_aai, }; +static int ft2232_spi_shutdown(void *ftdic) { + int ret = ftdi_usb_close(ftdic); + if (ret < 0) { + msg_perr("Unable to close FTDI device: %s (%d)\n", ftdi_get_error_string(ftdic), ret); + } + /* The following will deinit the context and set various of its fields to initial values. */ + ftdi_free(ftdic); + return ret; +} + /* Returns 0 upon success, a negative number upon errors. */ int ft2232_spi_init(void) { - int ret = 0; struct ftdi_context *ftdic = &ftdic_context; unsigned char buf[512]; int ft2232_vid = FTDI_VID; @@ -193,11 +202,8 @@ int ft2232_spi_init(void) * 92 Hz for 12 MHz inputs. */ uint32_t divisor = DEFAULT_DIVISOR; - int f; - char *arg; - double mpsse_clk; - arg = extract_programmer_param("type"); + char *arg = extract_programmer_param("type"); if (arg) { if (!strcasecmp(arg, "2232H")) { ft2232_type = FTDI_FT2232H_PID; @@ -338,22 +344,31 @@ int ft2232_spi_init(void) (ft2232_interface == INTERFACE_B) ? "B" : (ft2232_interface == INTERFACE_C) ? "C" : "D"); - if (ftdi_init(ftdic) < 0) { - msg_perr("ftdi_init failed.\n"); - return -3; + int ret = ftdi_init(ftdic); + if (ret < 0) { + msg_perr("Failed to initialize libftdi driver (%d).\n", ret); + return 1; } - if (ftdi_set_interface(ftdic, ft2232_interface) < 0) { - msg_perr("Unable to select channel (%s).\n", ftdi_get_error_string(ftdic)); + if (register_shutdown(ft2232_spi_shutdown, NULL) != 0) { + return 1; + } + + ret = ftdi_set_interface(ftdic, ft2232_interface); + if (ret < 0) { + msg_perr("Unable to select channel: %s (%d).\n", ftdi_get_error_string(ftdic), ret); + return 1; } arg = extract_programmer_param("serial"); - f = ftdi_usb_open_desc(ftdic, ft2232_vid, ft2232_type, NULL, arg); + int f = ftdi_usb_open_desc(ftdic, ft2232_vid, ft2232_type, NULL, arg); free(arg); + /* -5 is reported in case we cannot claim the respective device. If that's really the case we will abort + * later anywhere. Till then pretend we did not notice... rationale: we always have beed doing it. */ if (f < 0 && f != -5) { - msg_perr("Unable to open FTDI device: %d (%s).\n", f, ftdi_get_error_string(ftdic)); - return -4; + msg_perr("Unable to open FTDI device: %s (%d).\n", ftdi_get_error_string(ftdic), f); + return 1; } if (ftdic->type != TYPE_2232H && ftdic->type != TYPE_4232H && ftdic->type != TYPE_232H) { @@ -362,27 +377,32 @@ int ft2232_spi_init(void) } if (ftdi_usb_reset(ftdic) < 0) { - msg_perr("Unable to reset FTDI device (%s).\n", ftdi_get_error_string(ftdic)); + msg_perr("Unable to reset FTDI device: %s.\n", ftdi_get_error_string(ftdic)); + return 1; } if (ftdi_set_latency_timer(ftdic, 2) < 0) { - msg_perr("Unable to set latency timer (%s).\n", ftdi_get_error_string(ftdic)); + msg_perr("Unable to set latency timer: %s.\n", ftdi_get_error_string(ftdic)); + return 1; } if (ftdi_write_data_set_chunksize(ftdic, 256)) { - msg_perr("Unable to set chunk size (%s).\n", ftdi_get_error_string(ftdic)); + msg_perr("Unable to set chunk size: %s.\n", ftdi_get_error_string(ftdic)); + return 1; } if (ftdi_set_bitmode(ftdic, 0x00, BITMODE_BITBANG_SPI) < 0) { - msg_perr("Unable to set bitmode to SPI (%s).\n", ftdi_get_error_string(ftdic)); + msg_perr("Unable to set bitmode to SPI: %s.\n", ftdi_get_error_string(ftdic)); + return 1; } + double mpsse_clk; if (clock_5x) { msg_pdbg("Disable divide-by-5 front stage\n"); buf[0] = 0x8a; /* Disable divide-by-5. DIS_DIV_5 in newer libftdi */ if (send_buf(ftdic, buf, 1)) { - ret = -5; - goto ftdi_err; + msg_perr("Unable to disable front stage divider: %s.\n", ftdi_get_error_string(ftdic)); + return 1; } mpsse_clk = 60.0; } else { @@ -394,39 +414,29 @@ int ft2232_spi_init(void) buf[1] = (divisor / 2 - 1) & 0xff; buf[2] = ((divisor / 2 - 1) >> 8) & 0xff; if (send_buf(ftdic, buf, 3)) { - ret = -6; - goto ftdi_err; + msg_perr("Unable to set divider: %s.\n", ftdi_get_error_string(ftdic)); + return 1; } msg_pdbg("MPSSE clock: %f MHz, divisor: %u, SPI clock: %f MHz\n", mpsse_clk, divisor, (double)(mpsse_clk / divisor)); /* Disconnect TDI/DO to TDO/DI for loopback. */ - msg_pdbg("No loopback of TDI/DO TDO/DI\n"); buf[0] = LOOPBACK_END; if (send_buf(ftdic, buf, 1)) { - ret = -7; - goto ftdi_err; + msg_perr("Unable to disable TDI/DO TDO/DI loopback: %s.\n", ftdi_get_error_string(ftdic)); + return 1; } - msg_pdbg("Set data bits\n"); buf[0] = SET_BITS_LOW; buf[1] = cs_bits; buf[2] = pindir; if (send_buf(ftdic, buf, 3)) { - ret = -8; - goto ftdi_err; + msg_perr("Unable to set initial pin states: %s.\n", ftdi_get_error_string(ftdic)); + return 1; } - register_spi_master(&spi_master_ft2232); - - return 0; - -ftdi_err: - if ((f = ftdi_usb_close(ftdic)) < 0) { - msg_perr("Unable to close FTDI device: %d (%s)\n", f, ftdi_get_error_string(ftdic)); - } - return ret; + return register_spi_master(&spi_master_ft2232); } /* Returns 0 upon success, a negative number upon errors. */ -- Kind regards, Stefan Tauner

1 0

Re: [flashrom] [coreboot] ft4232-based spi programmer
by Stefan Tauner 16 Mar '16

16 Mar '16

On Thu, 11 Jun 2009 15:00:05 -0400 pgf at foxharp.boston.ma.us (Paul Fox) wrote: > + // f = ftdi_usb_open(ftdic, 0x0403, 0x6010); // FT2232 > + f = ftdi_usb_open(ftdic, 0x0403, 0x6011); // FT4232 > + > + if (f < 0 && f != -5) { > + fprintf(stderr, "unable to open ftdi device: %d (%s)\n", f, > + ftdi_get_error_string(ftdic)); > + exit(-1); > + } Hi, been a while since this went in... however the exemption for the -5 error (failed to claim the device) was never discussed nor documented ever since. Can you remember why you put it there, Paul? -- Kind regards/Mit freundlichen Grüßen, Stefan Tauner

2 2

flashrom bug report
by Szőgyényi Gábor 15 Mar '16

15 Mar '16

Hi flashrom.org! Motherboad type: ASUS M4A78LT-M-LEBios Version: 0801 Please read the flashrom output: root@debian:/home/szg# root@debian:/home/szg# root@debian:/home/szg# flashrom -p internal flashrom v0.9.7-r1782 on Linux 3.16.0-4-amd64 (x86_64) flashrom is free software, get the source code at http://www.flashrom.orgCalibrating delay loop... OK. Found chipset "AMD SB7x0/SB8x0/SB9x0". Enabling flash write... OK. Found Eon flash chip "EN25F80" (1024 kB, SPI) at physical address 0xfff00000. Trying to unmap a nonexisting mapping! Please report a bug at flashrom(a)flashrom.org Trying to unmap a nonexisting mapping! Please report a bug at flashrom(a)flashrom.org Trying to unmap a nonexisting mapping! Please report a bug at flashrom(a)flashrom.org Trying to unmap a nonexisting mapping! Please report a bug at flashrom(a)flashrom.org Trying to unmap a nonexisting mapping! Please report a bug at flashrom(a)flashrom.org Trying to unmap a nonexisting mapping! Please report a bug at flashrom(a)flashrom.org Trying to unmap a nonexisting mapping! Please report a bug at flashrom(a)flashrom.org Trying to unmap a nonexisting mapping! Please report a bug at flashrom(a)flashrom.org Trying to unmap a nonexisting mapping! Please report a bug at flashrom(a)flashrom.org Trying to unmap a nonexisting mapping! Please report a bug at flashrom(a)flashrom.org Trying to unmap a nonexisting mapping! Please report a bug at flashrom(a)flashrom.org Trying to unmap a nonexisting mapping! Please report a bug at flashrom(a)flashrom.org No operations were specified. root@debian:/home/szg# root@debian:/home/szg#

2 1

toshiba satellite c660d-144 black screen
by Akram Hossain 15 Mar '16

15 Mar '16

Hi, Can someone help me please with my problem. My Toshiba Satellite C660D-144 has black screen and keyboard lights stays on. I've tried to flash the bios through usb from Toshiba website the exact model bios, but it didn't work. And tired to flash with (USB Programmer CH341A) but nothing is working. Its bricked do I need SPI flash and where I can get the right file. I'm not expert in this case please consider if I write something that doesn't make sense. Please help me. Thanks

1 0

X9DRD-iF
by Pierre Grandin 14 Mar '16

14 Mar '16

flashrom v0.9.6.1-r1563 on Linux 3.13.0-24-generic (x86_64) flashrom is free software, get the source code at http://www.flashrom.org flashrom was built with libpci 3.1.9, GCC 4.7.1, little endian Command line (3 args): flashrom -VV -p internal:laptop=this_is_not_a_laptop Calibrating delay loop... OS timer resolution is 1 usecs, 2494M loops per second, 10 myus = 10 us, 100 myus = 100 us, 1000 myus = 998 us, 10000 myus = 10017 us, 4 myus = 4 us, OK. Initializing internal programmer No coreboot table found. DMI string system-manufacturer: "Supermicro" DMI string system-product-name: "SYS-6017R-TDF" DMI string system-version: "0123456789" DMI string baseboard-manufacturer: "Supermicro" DMI string baseboard-product-name: "X9DRD-iF" DMI string baseboard-version: "REV:1.02" DMI string chassis-type: "Other" DMI chassis-type is not specific enough. ======================================================================== WARNING! You may be running flashrom on an unsupported laptop. We could not detect this for sure because your vendor has not setup the SMBIOS tables correctly. You can enforce execution by adding '-p internal:laptop=this_is_not_a_laptop' to the command line, but please read the following warning if you are not sure. Laptops, notebooks and netbooks are difficult to support and we recommend to use the vendor flashing utility. The embedded controller (EC) in these machines often interacts badly with flashing. See http://www.flashrom.org/Laptops for details. If flash is shared with the EC, erase is guaranteed to brick your laptop and write may brick your laptop. Read and probe may irritate your EC and cause fan failure, backlight failure and sudden poweroff. You have been warned. ======================================================================== Proceeding anyway because user forced us to. Found chipset "Intel X79" with PCI ID 8086:1d41. This chipset is marked as untested. If you are using an up-to-date version of flashrom *and* were (not) able to successfully update your firmware with it, then please email a report to flashrom(a)flashrom.org including a verbose (-V) log. Thank you! Enabling flash write... 0xfff80000/0xffb80000 FWH IDSEL: 0x0 0xfff00000/0xffb00000 FWH IDSEL: 0x0 0xffe80000/0xffa80000 FWH IDSEL: 0x1 0xffe00000/0xffa00000 FWH IDSEL: 0x1 0xffd80000/0xff980000 FWH IDSEL: 0x2 0xffd00000/0xff900000 FWH IDSEL: 0x2 0xffc80000/0xff880000 FWH IDSEL: 0x3 0xffc00000/0xff800000 FWH IDSEL: 0x3 0xff700000/0xff300000 FWH IDSEL: 0x4 0xff600000/0xff200000 FWH IDSEL: 0x5 0xff500000/0xff100000 FWH IDSEL: 0x6 0xff400000/0xff000000 FWH IDSEL: 0x7 0xfff80000/0xffb80000 FWH decode enabled 0xfff00000/0xffb00000 FWH decode enabled 0xffe80000/0xffa80000 FWH decode enabled 0xffe00000/0xffa00000 FWH decode enabled 0xffd80000/0xff980000 FWH decode enabled 0xffd00000/0xff900000 FWH decode enabled 0xffc80000/0xff880000 FWH decode enabled 0xffc00000/0xff800000 FWH decode enabled 0xff700000/0xff300000 FWH decode enabled 0xff600000/0xff200000 FWH decode enabled 0xff500000/0xff100000 FWH decode enabled 0xff400000/0xff000000 FWH decode enabled Maximum FWH chip size: 0x100000 bytes BIOS Lock Enable: enabled, BIOS Write Enable: disabled, BIOS_CNTL is 0x2a WARNING: BIOS region SMM protection is enabled! Root Complex Register Block address = 0xfed1c000 GCS = 0xc21: BIOS Interface Lock-Down: enabled, Boot BIOS Straps: 0x3 (SPI) Top Swap : not enabled SPIBAR = 0xfed1c000 + 0x3800 0x04: 0x6018 (HSFS) HSFS: FDONE=0, FCERR=0, AEL=0, BERASE=3, SCIP=0, FDOPSS=1, FDV=1, FLOCKDN=0 Programming OPCODES... program_opcodes: preop=5006 optype=463b opmenu=05d80302c79f0190 done OP Type Pre-OP op[0]: 0x02, write w/ addr, none op[1]: 0x03, read w/ addr, none op[2]: 0xd8, write w/ addr, none op[3]: 0x05, read w/o addr, none op[4]: 0x90, read w/ addr, none op[5]: 0x01, write w/o addr, none op[6]: 0x9f, read w/o addr, none op[7]: 0xc7, write w/o addr, none Pre-OP 0: 0x06, Pre-OP 1: 0x50 0x06: 0x0000 (HSFC) HSFC: FGO=0, FCYCLE=0, FDBC=0, SME=0 0x08: 0x00000000 (FADDR) 0x50: 0x00001a1b (FRAP) BMWAG 0x00, BMRAG 0x00, BRWA 0x1a, BRRA 0x1b 0x54: 0x000f0000 FREG0: WARNING: Flash Descriptor region (0x00000000-0x0000ffff) is read-only. 0x58: 0x0fff0400 FREG1: BIOS region (0x00400000-0x00ffffff) is read-write. 0x5C: 0x03ff0020 FREG2: WARNING: Management Engine region (0x00020000-0x003fffff) is locked. 0x60: 0x00000fff FREG3: Gigabit Ethernet region is unused. 0x64: 0x001f0010 FREG4: Platform Data region (0x00010000-0x0001ffff) is read-write. 0x74: 0x00000000 (PR0 is unused) 0x78: 0x00000000 (PR1 is unused) 0x7C: 0x00000000 (PR2 is unused) 0x80: 0x00000000 (PR3 is unused) 0x84: 0x00000000 (PR4 is unused) Please send a verbose log to flashrom(a)flashrom.org if this board is not listed on http://flashrom.org/Supported_hardware#Supported_mainboards yet. Writes have been disabled. You can enforce write support with the ich_spi_force programmer option, but it will most likely harm your hardware! If you force flashrom you will get no support if something breaks. 0x90: 0x84 (SSFS) SSFS: SCIP=0, FDONE=1, FCERR=0, AEL=0 0x91: 0xf84140 (SSFC) SSFC: SCGO=0, ACS=0, SPOP=0, COP=4, DBC=1, SME=0, SCF=0 0x94: 0x5006 (PREOP) 0x96: 0x463b (OPTYPE) 0x98: 0x05d80302 (OPMENU) 0x9C: 0xc79f0190 (OPMENU+4) 0xA0: 0x00000000 (BBAR) 0xC4: 0x0000d807 (LVSCC) LVSCC: BES=0x3, WG=1, WSR=0, WEWS=0, EO=0xd8, VCL=0 0xC8: 0x0000d807 (UVSCC) UVSCC: BES=0x3, WG=1, WSR=0, WEWS=0, EO=0xd8, VCL=0 0xD0: 0x00000000 (FPB) Reading flash descriptors mapped by the chipset via FDOC/FDOD... done. === Content Section === FLVALSIG 0x0ff0a55a FLMAP0 0x03040003 FLMAP1 0x12100206 FLMAP2 0x00210020 --- Details --- NR (Number of Regions): 4 FRBA (Flash Region Base Address): 0x040 NC (Number of Components): 1 FCBA (Flash Component Base Address): 0x030 ISL (ICH/PCH Strap Length): 18 FISBA/FPSBA (Flash ICH/PCH Strap Base Address): 0x100 NM (Number of Masters): 3 FMBA (Flash Master Base Address): 0x060 MSL/PSL (MCH/PROC Strap Length): 0 FMSBA (Flash MCH/PROC Strap Base Address): 0x200 === Component Section === FLCOMP 0x24900025 FLILL 0x00000000 --- Details --- Component 1 density: 16 MB Component 2 is not used. Read Clock Frequency: 20 MHz Read ID and Status Clock Freq.: 50 MHz Write and Erase Clock Freq.: 50 MHz Fast Read is supported. Fast Read Clock Frequency: 50 MHz No forbidden opcodes. === Region Section === FLREG0 0x000f0000 FLREG1 0x0fff0400 FLREG2 0x03ff0020 FLREG3 0x00000fff FLREG4 0x001f0010 --- Details --- Region 0 (Descr.) 0x00000000 - 0x0000ffff Region 1 (BIOS ) 0x00400000 - 0x00ffffff Region 2 (ME ) 0x00020000 - 0x003fffff Region 3 (GbE ) is unused. Region 4 (Platf.) 0x00010000 - 0x0001ffff === Master Section === FLMSTR1 0x1a1b0000 FLMSTR2 0x04050000 FLMSTR3 0x08090118 --- Details --- Descr. BIOS ME GbE Platf. BIOS r rw rw rw ME r rw GbE r rw SPI Read Configuration: prefetching enabled, caching enabled, OK. The following protocols are supported: FWH, SPI. Probing for AMIC A25L05PT, 64 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for AMIC A25L05PU, 64 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for AMIC A25L10PT, 128 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for AMIC A25L10PU, 128 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for AMIC A25L20PT, 256 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for AMIC A25L20PU, 256 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for AMIC A25L40PT, 512 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for AMIC A25L40PU, 512 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for AMIC A25L80P, 1024 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for AMIC A25L16PT, 2048 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for AMIC A25L16PU, 2048 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for AMIC A25L512, 64 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for AMIC A25L010, 128 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for AMIC A25L020, 256 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for AMIC A25L040, 512 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for AMIC A25L080, 1024 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for AMIC A25L016, 2048 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for AMIC A25L032, 4096 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for AMIC A25LQ032, 4096 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Atmel AT25DF021, 256 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Atmel AT25DF041A, 512 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Atmel AT25DF081, 1024 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Atmel AT25DF081A, 1024 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Atmel AT25DF161, 2048 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Atmel AT25DF321, 4096 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Atmel AT25DF321A, 4096 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Atmel AT25DF641(A), 8192 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Atmel AT25DQ161, 2048 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Atmel AT25F512B, 64 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Atmel AT25FS010, 128 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Atmel AT25FS040, 512 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Atmel AT26DF041, 512 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Atmel AT26DF081A, 1024 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Atmel AT26DF161, 2048 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Atmel AT26DF161A, 2048 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Atmel AT26F004, 512 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Atmel AT45CS1282, 16896 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Atmel AT45DB011D, 128 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Atmel AT45DB021D, 256 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Atmel AT45DB041D, 512 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Atmel AT45DB081D, 1024 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Atmel AT45DB161D, 2048 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Atmel AT45DB321C, 4224 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Atmel AT45DB321D, 4096 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Atmel AT45DB642D, 8192 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for EMST F25L008A, 1024 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Eon EN25B05, 64 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Eon EN25B05T, 64 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Eon EN25B10, 128 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Eon EN25B10T, 128 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Eon EN25B20, 256 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Eon EN25B20T, 256 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Eon EN25B40, 512 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Eon EN25B40T, 512 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Eon EN25B80, 1024 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Eon EN25B80T, 1024 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Eon EN25B16, 2048 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Eon EN25B16T, 2048 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Eon EN25B32, 4096 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Eon EN25B32T, 4096 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Eon EN25B64, 8192 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Eon EN25B64T, 8192 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Eon EN25F05, 64 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Eon EN25F10, 128 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Eon EN25F20, 256 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Eon EN25F40, 512 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Eon EN25F80, 1024 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Eon EN25F16, 2048 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Eon EN25F32, 4096 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Eon EN25Q40, 512 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Eon EN25Q80(A), 1024 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Eon EN25Q16, 2048 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Eon EN25Q32(A/B), 4096 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Eon EN25Q64, 8192 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Eon EN25Q128, 16384 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Eon EN25QH16, 2048 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Eon EN25QH32, 4096 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for GigaDevice GD25Q20, 256 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for GigaDevice GD25Q40, 512 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for GigaDevice GD25Q80, 1024 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for GigaDevice GD25Q16, 2048 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for GigaDevice GD25Q32, 4096 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for GigaDevice GD25Q64, 8192 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for GigaDevice GD25Q128, 16384 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Macronix MX25L512, 64 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Macronix MX25L1005, 128 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Macronix MX25L2005, 256 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Macronix MX25L4005, 512 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Macronix MX25L8005, 1024 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Macronix MX25L1605, 2048 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Macronix MX25L1635D, 2048 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Macronix MX25L1635E, 2048 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Macronix MX25L3205, 4096 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Macronix MX25L3235D, 4096 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Macronix MX25L6405, 8192 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Macronix MX25L12805, 16384 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Numonyx M25PE10, 128 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Numonyx M25PE20, 256 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Numonyx M25PE40, 512 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Numonyx M25PE80, 1024 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Numonyx M25PE16, 2048 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Numonyx N25Q064, 8192 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for PMC Pm25LV010, 128 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for PMC Pm25LV016B, 2048 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for PMC Pm25LV020, 256 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for PMC Pm25LV040, 512 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for PMC Pm25LV080B, 1024 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for PMC Pm25LV512, 64 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Sanyo LF25FW203A, 2048 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Spansion S25FL004A, 512 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Spansion S25FL008A, 1024 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Spansion S25FL016A, 2048 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Spansion S25FL032A, 4096 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Spansion S25FL064A, 8192 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for SST SST25LF040A, 512 kB: program_opcodes: preop=5006 optype=462b opmenu=05ab0302c79f0190 on-the-fly OPCODE (0xAB) re-programmed, op-pos=2 probe_spi_res2: id1 0xff, id2 0xff Probing for SST SST25LF080A, 1024 kB: probe_spi_res2: id1 0xff, id2 0xff Probing for SST SST25VF010, 128 kB: probe_spi_rems: id1 0xff, id2 0xff Probing for SST SST25VF016B, 2048 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for SST SST25VF032B, 4096 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for SST SST25VF064C, 8192 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for SST SST25VF040, 512 kB: probe_spi_rems: id1 0xff, id2 0xff Probing for SST SST25VF040B, 512 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for SST SST25VF040B.REMS, 512 kB: probe_spi_rems: id1 0xff, id2 0xff Probing for SST SST25VF080B, 1024 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for ST M25P05-A, 64 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for ST M25P05, 64 kB: Ignoring RES in favour of RDID. Probing for ST M25P10-A, 128 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for ST M25P10, 128 kB: Ignoring RES in favour of RDID. Probing for ST M25P20, 256 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for ST M25P40, 512 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for ST M25P40-old, 512 kB: Ignoring RES in favour of RDID. Probing for ST M25P80, 1024 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for ST M25P16, 2048 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for ST M25P32, 4096 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for ST M25P64, 8192 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for ST M25P128, 16384 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for ST M25PX16, 2048 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for ST M25PX32, 4096 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for ST M25PX64, 8192 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Winbond W25Q80, 1024 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Winbond W25Q16, 2048 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Winbond W25Q32, 4096 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Winbond W25Q64, 8192 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Winbond W25Q128, 16384 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Winbond W25X10, 128 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Winbond W25X20, 256 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Winbond W25X40, 512 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Winbond W25X80, 1024 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Winbond W25X16, 2048 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Winbond W25X32, 4096 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Winbond W25X64, 8192 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Unknown SFDP-capable chip, 0 kB: program_opcodes: preop=5006 optype=462b opmenu=055a0302c79f0190 on-the-fly OPCODE (0x5A) re-programmed, op-pos=2 SFDP revision = 1.0 SFDP number of parameter headers is 1 (NPH = 0). SFDP parameter table header 0/0: ID 0x00, version 1.0 Length 36 B, Parameter Table Pointer 0x000030 Parsing JEDEC flash parameter table... 3-Byte only addressing. Status register is non-volatile and the standard does not allow vendors to tell us whether EWSR/WREN is needed for status register writes - assuming EWSR. Write chunk size is at least 64 B. Flash chip size is 16384 kB. Block eraser 0: 4096 x 4096 B with opcode 0x20 Tried to add a duplicate block eraser: 4096 x 4096 B with opcode 0x20. Block eraser 1: 256 x 65536 B with opcode 0xd8 done. === SFDP has autodetected a flash chip which is not natively supported by flashrom yet. All standard operations (read, verify, erase and write) should work, but to support all possible features we need to add them manually. You can help us by mailing us the output of the following command to flashrom(a)flashrom.org: 'flashrom -VV [plus the -p/--programmer parameter (if needed)]' Thanks for your help! === Found Unknown flash chip "SFDP-capable chip" (16384 kB, SPI) at physical address 0x0. Probing for AMIC unknown AMIC SPI chip, 0 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Atmel unknown Atmel SPI chip, 0 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Eon unknown Eon SPI chip, 0 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Macronix unknown Macronix SPI chip, 0 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for PMC unknown PMC SPI chip, 0 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for SST unknown SST SPI chip, 0 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for ST unknown ST SPI chip, 0 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Sanyo unknown Sanyo SPI chip, 0 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Generic unknown SPI chip (RDID), 0 kB: probe_spi_rdid_generic: id1 0x20, id2 0xba18 Probing for Generic unknown SPI chip (REMS), 0 kB: probe_spi_rems: id1 0xff, id2 0xff Probing for Atmel AT49LH002, 256 kB: probe_82802ab: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for Intel 82802AB, 512 kB: probe_82802ab: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for Intel 82802AC, 1024 kB: probe_82802ab: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for PMC Pm49FL002, 256 kB: probe_jedec_common: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for PMC Pm49FL004, 512 kB: probe_jedec_common: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for Sharp LHF00L04, 1024 kB: probe_82802ab: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for SST SST49LF002A/B, 256 kB: probe_jedec_common: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for SST SST49LF003A/B, 384 kB: probe_jedec_common: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for SST SST49LF004A/B, 512 kB: probe_jedec_common: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for SST SST49LF004C, 512 kB: probe_82802ab: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for SST SST49LF008A, 1024 kB: probe_jedec_common: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for SST SST49LF008C, 1024 kB: probe_82802ab: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for SST SST49LF016C, 2048 kB: Chip size 2048 kB is bigger than supported size 1024 kB of chipset/board/programmer for FWH interface, probe/read/erase/write may fail. probe_82802ab: id1 0xea, id2 0xd0, id1 is normal flash content, id2 is normal flash content Probing for ST M50FLW040A, 512 kB: probe_82802ab: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for ST M50FLW040B, 512 kB: probe_82802ab: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for ST M50FLW080A, 1024 kB: probe_82802ab: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for ST M50FLW080B, 1024 kB: probe_82802ab: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for ST M50FW002, 256 kB: probe_82802ab: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for ST M50FW016, 2048 kB: Chip size 2048 kB is bigger than supported size 1024 kB of chipset/board/programmer for FWH interface, probe/read/erase/write may fail. probe_82802ab: id1 0xea, id2 0xd0, id1 is normal flash content, id2 is normal flash content Probing for ST M50FW040, 512 kB: probe_82802ab: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for ST M50FW080, 1024 kB: probe_82802ab: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for Winbond W39V040FA, 512 kB: probe_jedec_common: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for Winbond W39V040FB, 512 kB: probe_jedec_common: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for Winbond W39V040FC, 512 kB: probe_jedec_common: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for Winbond W49V002FA, 256 kB: probe_jedec_common: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for Winbond W39V080FA, 1024 kB: probe_jedec_common: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for Winbond W39V080FA (dual mode), 512 kB: probe_jedec_common: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Found Unknown flash chip "SFDP-capable chip" (16384 kB, SPI). No operations were specified. Restoring MMIO space at 0x7f258db388a0 Restoring MMIO space at 0x7f258db3889c Restoring MMIO space at 0x7f258db38898 Restoring MMIO space at 0x7f258db38896 Restoring MMIO space at 0x7f258db38894 Restoring PCI config space for 00:1f:0 reg 0xdc

1 0

W25X64 tested and works with beaglebone black for lenovo x200.
by Andrew Engelbrecht 14 Mar '16

14 Mar '16

i wasn't using the newest version of flashrom, but in case you don't have this chip marked as tested in the newest version, here is the output for reading and writing this chip: andrew > root@beaglebone:~# ./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512 -r x200-0-bios-orig-1.rom > flashrom v0.9.8-unknown on Linux 3.8.13 (armv7l) > flashrom is free software, get the source code at http://www.flashrom.org > > Calibrating delay loop... OK. > Found Winbond flash chip "W25X64" (8192 kB, SPI) on linux_spi. > === > This flash part has status UNTESTED for operations: READ ERASE WRITE > The test status of this chip may have been updated in the latest development > version of flashrom. If you are running the latest development version, > please email a report to flashrom(a)flashrom.org if any of the above operations > work correctly for you with this flash chip. Please include the flashrom log > file for all operations you tested (see the man page for details), and mention > which mainboard or programmer you tested in the subject line. > Thanks for your help! > Reading flash... done. > > root@beaglebone:~/libreboot# ./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512 -w x200-8mb-libreboot.rom > flashrom v0.9.8-unknown on Linux 3.8.13 (armv7l) > flashrom is free software, get the source code at http://www.flashrom.org > > Calibrating delay loop... OK. > Found Winbond flash chip "W25X64" (8192 kB, SPI) on linux_spi. > === > This flash part has status UNTESTED for operations: READ ERASE WRITE > The test status of this chip may have been updated in the latest development > version of flashrom. If you are running the latest development version, > please email a report to flashrom(a)flashrom.org if any of the above operations > work correctly for you with this flash chip. Please include the flashrom log > file for all operations you tested (see the man page for details), and mention > which mainboard or programmer you tested in the subject line. > Thanks for your help! > Reading old flash chip contents... done. > Erasing and writing flash chip... Erase/write done. > Verifying flash... VERIFIED.

1 0

[commit] r1955 - tags/0.9.9
by repository service 13 Mar '16

13 Mar '16

Author: stefanct Date: Sun Mar 13 18:47:39 2016 New Revision: 1955 URL: http://flashrom.org/trac/flashrom/changeset/1955 Log: Tag flashrom 0.9.9. Signed-off-by: Stefan Tauner <stefan.tauner(a)student.tuwien.ac.at> Acked-by: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006(a)gmx.net> Acked-by: Stefan Tauner <stefan.tauner(a)student.tuwien.ac.at> Acked-by: Urja Rannikko <urjaman(a)gmail.com> Added: tags/0.9.9/ - copied from r1954, trunk/

1 0

[commit] r1954 - trunk
by repository service 13 Mar '16

13 Mar '16

Author: stefanct Date: Sun Mar 13 18:46:08 2016 New Revision: 1954 URL: http://flashrom.org/trac/flashrom/changeset/1954 Log: Increase flashrom version number to 0.9.9. Signed-off-by: Stefan Tauner <stefan.tauner(a)alumni.tuwien.ac.at> Acked-by: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006(a)gmx.net> Acked-by: Stefan Tauner <stefan.tauner(a)alumni.tuwien.ac.at> Acked-by: Urja Rannikko <urjaman(a)gmail.com> Modified: trunk/Makefile Modified: trunk/Makefile ============================================================================== --- trunk/Makefile Sun Mar 13 18:36:49 2016 (r1953) +++ trunk/Makefile Sun Mar 13 18:46:08 2016 (r1954) @@ -531,7 +531,7 @@ # will not require subversion. The downloadable snapshots are already exported. SVNVERSION := $(shell ./util/getrevision.sh -u 2>/dev/null ) -RELEASE := 0.9.9-rc1 +RELEASE := 0.9.9 VERSION := $(RELEASE)-$(SVNVERSION) RELEASENAME ?= $(VERSION)

1 0

[Security Announcement] fscanf format string security bug in flashrom layout code
by Carl-Daniel Hailfinger 13 Mar '16

13 Mar '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 NotDashEscaped: You need GnuPG to verify this message An internal security audit of the flashrom project by Carl-Daniel Hailfinger found a buffer overflow bug present in all flashrom versions since the year 2005. This bug was independently found and reported to flashrom.org by Cosmin Gorgovan a few days ago. A buffer on the stack and a buffer on the heap are affected by the overflow caused by an incorrect fscanf format string. The buffer overflow can only be triggered if the optional layout feature is used and if the user manually specifies a specially crafted layout file on the command line. Command line parsing and flash image handling do not trigger the buggy code path. Most usage of flashrom does not involve layout files. The fix in this commit (changed fscanf format string) can be applied to layout.c of all past flashrom versions. Signed-off-by: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006(a)gmx.net> Acked-by: Stefan Tauner <stefan.tauner(a)alumni.tuwien.ac.at> Index: flashrom-parserbugs_simple/layout.c =================================================================== --- flashrom-parserbugs_simple/layout.c (revision 1952) +++ flashrom-parserbugs_simple/layout.c (working copy) @@ -68,7 +68,7 @@ (void)fclose(romlayout); return 1; } - if (2 != fscanf(romlayout, "%s %s\n", tempstr, rom_entries[num_rom_entries].name)) + if (2 != fscanf(romlayout, "%255s %255s\n", tempstr, rom_entries[num_rom_entries].name)) continue; #if 0 // fscanf does not like arbitrary comments like that :( later -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) iD8DBQFW5aNeRdNMz2eF/AERAootAJ4q5RtwHTXk7nSPu/1usG3y3pnVPACgzBbQ uxn/opeqC3Kh2F1PE2lVcUU= =z/7t -----END PGP SIGNATURE-----

1 1

[commit] r1953 - trunk
by repository service 13 Mar '16

13 Mar '16

Author: hailfinger Date: Sun Mar 13 18:36:49 2016 New Revision: 1953 URL: http://flashrom.org/trac/flashrom/changeset/1953 Log: Fix fscanf format string security bug in layout.c An internal security audit of the flashrom project by Carl-Daniel Hailfinger found a buffer overflow bug present in all flashrom versions since the year 2005. This bug was independently found and reported to flashrom.org by Cosmin Gorgovan a few days ago. A buffer on the stack and a buffer on the heap are affected by the overflow caused by an incorrect fscanf format string. The buffer overflow can only be triggered if the optional layout feature is used and if the user manually specifies a specially crafted layout file on the command line. Command line parsing and flash image handling do not trigger the buggy code path. Most usage of flashrom does not involve layout files. The fix in this commit (changed fscanf format string) can be applied to layout.c of all past flashrom versions. Signed-off-by: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006(a)gmx.net> Acked-by: Stefan Tauner <stefan.tauner(a)alumni.tuwien.ac.at> Modified: trunk/layout.c Modified: trunk/layout.c ============================================================================== --- trunk/layout.c Sun Mar 13 17:24:09 2016 (r1952) +++ trunk/layout.c Sun Mar 13 18:36:49 2016 (r1953) @@ -68,7 +68,7 @@ (void)fclose(romlayout); return 1; } - if (2 != fscanf(romlayout, "%s %s\n", tempstr, rom_entries[num_rom_entries].name)) + if (2 != fscanf(romlayout, "%255s %255s\n", tempstr, rom_entries[num_rom_entries].name)) continue; #if 0 // fscanf does not like arbitrary comments like that :( later

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

flashrom