flashrom

flashrom@flashrom.org

6 participants
9186 discussions

Re: [flashrom] [PATCH] Fix garbage handling in DMI strings.
by Stefan Tauner 13 Jul '14

13 Jul '14

On Fri, 11 Jul 2014 22:15:17 +0200 Stefan Tauner <stefan.tauner(a)alumni.tuwien.ac.at> wrote: > Previously we tried to replace garbage characters with <space> directly in > the read-only memory-mapped SMBIOS area(!). This could never have > worked for any DMI strings with garbage and results in a segfault on > machines with such strings. > > With this patch the strings are duplicated within dmi_string() already, > just before we sanitize them. Also, the limit variable used everywhere > points to the first invalid byte address. Refine respective checks > accordingly. > > Signed-off-by: Stefan Tauner <stefan.tauner(a)alumni.tuwien.ac.at> Hi, a refined version (using isprint() instead of explicit limits) was committed in r1824. Thanks to Carl-Daniel for the review and Brian for testing the preliminary patch. -- Kind regards/Mit freundlichen Grüßen, Stefan Tauner

1 0

[commit] r1824 - trunk
by repository service 13 Jul '14

13 Jul '14

Author: stefanct Date: Sun Jul 13 14:52:15 2014 New Revision: 1824 URL: http://flashrom.org/trac/flashrom/changeset/1824 Log: Fix garbage handling in DMI strings. Previously we tried to replace garbage characters with <space> directly in the read-only memory-mapped SMBIOS area(!). This could never have worked for any DMI strings with garbage and results in a segfault on machines with such strings. Thanks to Brian Rak (Supermicro X10SLE-F) and John Pohlman (HP XW9400) for reporting this issue. With this patch the strings are duplicated within dmi_string() already, just before we sanitize them. Also, the limit variable used everywhere points to the first invalid byte address. Refine respective checks accordingly. Signed-off-by: Stefan Tauner <stefan.tauner(a)alumni.tuwien.ac.at> Acked-by: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006(a)gmx.net> Modified: trunk/dmi.c Modified: trunk/dmi.c ============================================================================== --- trunk/dmi.c Sun Jul 13 02:05:07 2014 (r1823) +++ trunk/dmi.c Sun Jul 13 14:52:15 2014 (r1824) @@ -23,6 +23,7 @@ #include <strings.h> #include <string.h> +#include <ctype.h> #include <stdio.h> #include <stdlib.h> @@ -105,7 +106,16 @@ return (sum == 0); } -static char *dmi_string(uint8_t *buf, uint8_t string_id, uint8_t *limit) +/** Retrieve a DMI string. + * + * See SMBIOS spec. section 6.1.3 "Text strings". + * The table will be unmapped ASAP, hence return a duplicated & sanitized string that needs to be freed later. + * + * \param buf the buffer to search through (usually appended directly to a DMI structure) + * \param string_id index of the string to look for + * \param limit pointer to the first byte beyond \em buf + */ +static char *dmi_string(const char *buf, uint8_t string_id, const char *limit) { size_t i, len; @@ -113,26 +123,33 @@ return "Not Specified"; while (string_id > 1 && string_id--) { - if (buf > limit) { + if (buf >= limit) { msg_perr("DMI table is broken (string portion out of bounds)!\n"); return "<OUT OF BOUNDS>"; } - buf += strnlen((char *)buf, limit - buf) + 1; + buf += strnlen(buf, limit - buf) + 1; } if (!*buf) /* as long as the current byte we're on isn't null */ return "<BAD INDEX>"; - len = strnlen((char *)buf, limit - buf); - if (len > DMI_MAX_ANSWER_LEN) - len = DMI_MAX_ANSWER_LEN; + len = strnlen(buf, limit - buf); + char *newbuf = malloc(len + 1); + if (newbuf == NULL) { + msg_perr("Out of memory!\n"); + return NULL; + } /* fix junk bytes in the string */ - for (i = 0; i < len; i++) - if (buf[i] < 32 || buf[i] >= 127) - buf[i] = ' '; + for (i = 0; i < len && buf[i] != '\0'; i++) { + if (isprint(buf[i])) + newbuf[i] = buf[i]; + else + newbuf[i] = ' '; + } + newbuf[i] = '\0'; - return (char *)buf; + return newbuf; } static void dmi_chassis_type(uint8_t code) @@ -167,7 +184,7 @@ * - uint8_t length; // data section w/ header w/o strings * - uint16_t handle; */ - while (i < num && data + 4 <= limit) { + while (i < num && data + 4 < limit) { /* - If a short entry is found (less than 4 bytes), not only it * is invalid, but we cannot reliably locate the next entry. * - If the length value indicates that this structure spreads @@ -175,15 +192,16 @@ * Better stop at this point, and let the user know his/her * table is broken. */ - if (data[1] < 4 || data + data[1] > limit) { + if (data[1] < 4 || data + data[1] >= limit) { msg_perr("DMI table is broken (bogus header)!\n"); break; } if(data[0] == 3) { - if (data + 5 <= limit) + if (data + 5 < limit) dmi_chassis_type(data[5]); - /* else the table is broken, but laptop detection is optional, hence continue. */ + else /* the table is broken, but laptop detection is optional, hence continue. */ + msg_pwarn("DMI table is broken (chassis_type out of bounds)!\n"); } else for (j = 0; j < ARRAY_SIZE(dmi_strings); j++) { uint8_t offset = dmi_strings[j].offset; @@ -192,13 +210,13 @@ if (data[0] != type) continue; - if (data[1] <= offset || data+offset > limit) { + if (data[1] <= offset || data + offset >= limit) { msg_perr("DMI table is broken (offset out of bounds)!\n"); goto out; } - /* Table will be unmapped, hence fill the struct with duplicated strings. */ - dmi_strings[j].value = strdup(dmi_string(data + data[1], data[offset], limit)); + dmi_strings[j].value = dmi_string((const char *)(data + data[1]), data[offset], + (const char *)limit); } /* Find next structure by skipping data and string sections */ data += data[1];

1 0

[PATCH] MX25U12835F
by Martin Roth 13 Jul '14

13 Jul '14

Here's a patch for supporting the MX25U12835F part Datasheet is here: http://www.macronix.com/Lists/DataSheet/Attachments/1653/MX25U12835F,%201.8… The ID was already in flashchips.h 1702 stefanct #define MACRONIX_MX25U12835E 0x2538 /* Same as MX25U12835F */ Martin

2 3

[commit] r1823 - trunk
by repository service 13 Jul '14

13 Jul '14

Author: stefanct Date: Sun Jul 13 02:05:07 2014 New Revision: 1823 URL: http://flashrom.org/trac/flashrom/changeset/1823 Log: Add support for Macronix MX25U12835F. Signed-off-by: Martin Roth <gaumless(a)gmail.com> Signed-off-by: Stefan Tauner <stefan.tauner(a)alumni.tuwien.ac.at> Acked-by: Stefan Tauner <stefan.tauner(a)alumni.tuwien.ac.at> Modified: trunk/flashchips.c Modified: trunk/flashchips.c ============================================================================== --- trunk/flashchips.c Tue Jun 17 00:36:17 2014 (r1822) +++ trunk/flashchips.c Sun Jul 13 02:05:07 2014 (r1823) @@ -6866,6 +6866,46 @@ { .vendor = "Macronix", + .name = "MX25U12835F", + .bustype = BUS_SPI, + .manufacture_id = MACRONIX_ID, + .model_id = MACRONIX_MX25U12835E, + .total_size = 16384, + .page_size = 256, + /* OTP: 512B total; enter 0xB1, exit 0xC1 */ + .feature_bits = FEATURE_WRSR_WREN | FEATURE_OTP | FEATURE_QPI, + .tested = TEST_UNTESTED, + .probe = probe_spi_rdid, + .probe_timing = TIMING_ZERO, + .block_erasers = + { + { + .eraseblocks = { {4 * 1024, 4096} }, + .block_erase = spi_block_erase_20, + }, { + .eraseblocks = { {32 * 1024, 512} }, + .block_erase = spi_block_erase_52, + }, { + .eraseblocks = { {64 * 1024, 256} }, + .block_erase = spi_block_erase_d8, + }, { + .eraseblocks = { {16 * 1024 * 1024, 1} }, + .block_erase = spi_block_erase_60, + }, { + .eraseblocks = { {16 * 1024 * 1024, 1} }, + .block_erase = spi_block_erase_c7, + } + }, + /* TODO: security register */ + .printlock = spi_prettyprint_status_register_bp3_srwd, /* bit6 is quad enable */ + .unlock = spi_disable_blockprotect_bp3_srwd, + .write = spi_chip_write_256, /* Multi I/O supported */ + .read = spi_chip_read, /* Fast read (0x0B) and multi I/O supported */ + .voltage = {1650, 2000}, + }, + + { + .vendor = "Macronix", .name = "MX29F001B", .bustype = BUS_PARALLEL, .manufacture_id = MACRONIX_ID,

1 0

Test result of ARM-USB-OCD-H
by Ruud Schramp 12 Jul '14

12 Jul '14

For archive purposes and recording of my email: The test result I posted on IRC. Best regards, Ruud Schramp <ruud> sudo ./flashrom -p ft2232_spi:divisor=16,type=ARM-USB-OCD-H -w test.bin flashrom v0.9.7-r1822 on Linux 3.2.0-60-generic (i686) flashrom is free software, get the source code at http://www.flashrom.org Calibrating delay loop... OK. Found SST flash chip "SST25VF016B" (2048 kB, SPI) on ft2232_spi. Reading old flash chip contents... done. Erasing and writing flash chip... Erase/write done. Verifying flash... VERIFIED. [23:05] <ruud> I Noticed that ARM-USB-OCD-H is still noted as "untested". [23:05] <ruud> Now it isn't untested any more: It works! [23:08] <ruud> But please note that I used a rather high divisor. Using the default (2) resulted in the chip not being detected, the bits seemed to be shifted one position, so the ARM-USB-OCS-H seemed to read the value of the previous clock-cycle. [23:09] <ruud> It may be caused by the long wires of my breadboard.. but it seems more like a timing issue than a noise issue. [23:16] <carldani> yes, timing due to either long wires or a slow chip [23:17] <carldani> capacitance of the wires can mess with the timing a lot, e.g. by making flanks less steep and thus needing more time until a level change is reached [23:18] <carldani> and other funny business [23:18] <carldani> ruud: thanks for the report! [23:18] <carldani> ruud: would you please send the report by email to flashrom(a)flashrom.org as well? That way we have your e-mail address in case we ever need retesting for that programmer [23:19] <carldani> ruud: and please mention the problems with the default divisor in your mail, preferably also with noting the wire length (rough estimate or measurement in cm) [23:20] <ruud> Will do. [23:21] <ruud> I used a standard small breadboard (5cm x 8cm approx) [23:22] <carldani> stefanct: If I had known about this two weeks ago, I would have been able to do something about it. [23:22] <ruud> Standard olimex provided ribon cable between Olimix ARM-USB-OCD-H of about 15cm [23:22] <ruud> Wiring on the breadboard <4cm [23:23] <ruud> Power decoupled using a 100uF elco [23:23] <carldani> do you know what frequency you get with a divisor of 2? [23:24] <ruud> Power supply: 2 big 1.5 Volt batteries in series (3V) [23:24] <ruud> Unfortunately I do not have a scope or frequency counter.

2 1

[PATCH] Fix garbage handling in DMI strings.
by Stefan Tauner 11 Jul '14

11 Jul '14

Previously we tried to replace garbage characters with <space> directly in the read-only memory-mapped SMBIOS area(!). This could never have worked for any DMI strings with garbage and results in a segfault on machines with such strings. With this patch the strings are duplicated within dmi_string() already, just before we sanitize them. Also, the limit variable used everywhere points to the first invalid byte address. Refine respective checks accordingly. Signed-off-by: Stefan Tauner <stefan.tauner(a)alumni.tuwien.ac.at> --- dmi.c | 49 +++++++++++++++++++++++++++++++++---------------- 1 file changed, 33 insertions(+), 16 deletions(-) diff --git a/dmi.c b/dmi.c index 25a4957..cd6e434 100644 --- a/dmi.c +++ b/dmi.c @@ -105,7 +105,16 @@ static bool dmi_checksum(const uint8_t * const buf, size_t len) return (sum == 0); } -static char *dmi_string(uint8_t *buf, uint8_t string_id, uint8_t *limit) +/** Retrieve a DMI string. + * + * See SMBIOS spec. section 6.1.3 "Text strings". + * The table will be unmapped ASAP, hence return a duplicated & sanitized string that needs to be freed later. + * + * \param buf the buffer to search through (usually appended directly to a DMI structure) + * \param string_id index of the string to look for + * \param limit pointer to the first byte beyond \em buf + */ +static char *dmi_string(const char *buf, uint8_t string_id, const char *limit) { size_t i, len; @@ -113,26 +122,33 @@ static char *dmi_string(uint8_t *buf, uint8_t string_id, uint8_t *limit) return "Not Specified"; while (string_id > 1 && string_id--) { - if (buf > limit) { + if (buf >= limit) { msg_perr("DMI table is broken (string portion out of bounds)!\n"); return "<OUT OF BOUNDS>"; } - buf += strnlen((char *)buf, limit - buf) + 1; + buf += strnlen(buf, limit - buf) + 1; } if (!*buf) /* as long as the current byte we're on isn't null */ return "<BAD INDEX>"; - len = strnlen((char *)buf, limit - buf); - if (len > DMI_MAX_ANSWER_LEN) - len = DMI_MAX_ANSWER_LEN; + len = strnlen(buf, limit - buf); + char *newbuf = malloc(len + 1); + if (newbuf == NULL) { + msg_perr("Out of memory!\n"); + return NULL; + } /* fix junk bytes in the string */ - for (i = 0; i < len; i++) + for (i = 0; i < len && buf[i] != '\0'; i++) { if (buf[i] < 32 || buf[i] >= 127) - buf[i] = ' '; + newbuf[i] = ' '; + else + newbuf[i] = buf[i]; + } + newbuf[i] = '\0'; - return (char *)buf; + return newbuf; } static void dmi_chassis_type(uint8_t code) @@ -167,7 +183,7 @@ static void dmi_table(uint32_t base, uint16_t len, uint16_t num) * - uint8_t length; // data section w/ header w/o strings * - uint16_t handle; */ - while (i < num && data + 4 <= limit) { + while (i < num && data + 4 < limit) { /* - If a short entry is found (less than 4 bytes), not only it * is invalid, but we cannot reliably locate the next entry. * - If the length value indicates that this structure spreads @@ -175,15 +191,16 @@ static void dmi_table(uint32_t base, uint16_t len, uint16_t num) * Better stop at this point, and let the user know his/her * table is broken. */ - if (data[1] < 4 || data + data[1] > limit) { + if (data[1] < 4 || data + data[1] >= limit) { msg_perr("DMI table is broken (bogus header)!\n"); break; } if(data[0] == 3) { - if (data + 5 <= limit) + if (data + 5 < limit) dmi_chassis_type(data[5]); - /* else the table is broken, but laptop detection is optional, hence continue. */ + else /* the table is broken, but laptop detection is optional, hence continue. */ + msg_pwarn("DMI table is broken (chassis_type out of bounds)!\n"); } else for (j = 0; j < ARRAY_SIZE(dmi_strings); j++) { uint8_t offset = dmi_strings[j].offset; @@ -192,13 +209,13 @@ static void dmi_table(uint32_t base, uint16_t len, uint16_t num) if (data[0] != type) continue; - if (data[1] <= offset || data+offset > limit) { + if (data[1] <= offset || data + offset >= limit) { msg_perr("DMI table is broken (offset out of bounds)!\n"); goto out; } - /* Table will be unmapped, hence fill the struct with duplicated strings. */ - dmi_strings[j].value = strdup(dmi_string(data + data[1], data[offset], limit)); + dmi_strings[j].value = dmi_string((const char *)(data + data[1]), data[offset], + (const char *)limit); } /* Find next structure by skipping data and string sections */ data += data[1]; -- Kind regards, Stefan Tauner

1 0

Re: [flashrom] Confirming successful write for AT29C010A
by Stefan Tauner 11 Jul '14

11 Jul '14

Hi, there are 3 interesting points in your report explained below. I am addressing Uwe in the first one and hence have added him to the explicit recipients of this mail. - The successful write of an AT29C010A. The write function of the AT29C010A was marked as "FIXME" by uwe when he added support for that chip in r520 a long time ago. I presume it is actually fine (now) and we can remove that comment and mark write support as working. Uwe, can you remember any details? Else I'll just remove the comment and mark it as tested. - The W836xx message: you can ignore those. - The unspecified DMI chassis type is a missing bit/bug in coreboot of that board (and possibly the original firmware). There is a whitelist in flashrom to work around that but i dont think it is worth it. -- Kind regards/Mit freundlichen Grüßen, Stefan Tauner

2 1

Re: [flashrom] serprog:dev=/dev/ttyUSB0:2000000
by Stefan Tauner 10 Jul '14

10 Jul '14

Hi, have you connected *all* input pins of the flash chip? -- Kind regards/Mit freundlichen Grüßen, Stefan Tauner

2 1

ASUS P5LD2 board support
by François Revol 10 Jul '14

10 Jul '14

(note I'm not subscribed to the list) This patch enables support for the ASUS A7V8X-MX motherboard. The board-specific code was marked as not tested. Without it, flashing failed. I just found this board at the local LUG and tested it with a patched svn, and it seems to work: http://paste.flashrom.org/view.php?id=2632 It does output some "SCIP never cleared", but it did flash the chip I needed correctly (md5sums match). DMIdecode for this motherboard: http://paste.flashrom.org/view.php?id=2633 François.

2 3

strange behaviour of flashrom
by KOLANICH 10 Jul '14

10 Jul '14

Hi. 1 I have created a logfile some time ago using flashrom -p internal -V > flashrom_info.log 2 I have flashed a rom with flashrom some time ago. Works fine :). 3 I have read my flashed rom after some time (and reboots) have passed after flashing. flashrom -V -p internal -r rom.bin > flashrom_read.log 3 Now I have created a logfile again (I have enabled in bios a network card (Realtek RTL-8110SC/8169SC Gigabit Ethernet built-in into motherboard) rom and wanted to know wheither flashrom is able to detect it and read it, but now i see it isn't) flashrom -p internal -V > flashrom_log.txt and got a warning about not supported and not tested microscheme and some other and an advice to write this address which haven't been appeared the previous time. It is very strange. The new read log is flashrom_read_log.txt

3 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

flashrom