The full verification step was not accounting for sparse layouts.
Instead of the old contents, combine_image_by_layout() implicitly
assumed the new contents for unspecified regions.
Change-Id: I44e0cea621f2a3d4dc70fa7e93c52ed95e54014a
Signed-off-by: Nico Huber <nico.h@gmx.de>
Reviewed-on: https://review.coreboot.org/c/30372
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Add an option --ifd to read the ROM layout from an Intel Firmware
Descriptor (IFD). Works the same as the -l option, if given, -i
specifies the images to update.
v2: o Rebased on libflashrom, use libflashrom interface.
o Use functions from ich_descriptors.c.
v3: o Move ich_descriptors.o to LIB_OBJS, thus build it independent
of arch and programmers.
o Bail out if we aren't compiled for little endian.
o Update flashrom.8.tmpl.
v4: o Incorporated David's comments.
o Removed single-character `-d` option.
v5: Changed region names to match the output of `ifdtool --layout ...`
Change-Id: Ifafff2bf6d5c5e62283416b3269723f81fdc0fa3
Signed-off-by: Nico Huber <nico.huber@secunet.com>
Reviewed-on: https://review.coreboot.org/17953
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Stefan Reinauer <stefan.reinauer@coreboot.org>
Introduce `struct flashrom_layout` and refactor layout.c a little, so
we can reuse the layout from there and have other sources of layouts
beside it.
I didn't want to clutter up flash.h any more. So things went into a new
layout.h.
Change-Id: Icea1a58c283131cc9c5fde6f16d783538dc1a4c7
Signed-off-by: Nico Huber <nico.huber@secunet.com>
Reviewed-on: https://review.coreboot.org/17944
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: David Hendricks <david.hendricks@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philippe.mathieu.daude@gmail.com>
An internal security audit of the flashrom project by
Carl-Daniel Hailfinger found a buffer overflow bug present in all
flashrom versions since the year 2005.
This bug was independently found and reported to flashrom.org by
Cosmin Gorgovan a few days ago.
A buffer on the stack and a buffer on the heap are affected by the
overflow caused by an incorrect fscanf format string.
The buffer overflow can only be triggered if the optional layout feature
is used and if the user manually specifies a specially crafted layout
file on the command line. Command line parsing and flash image handling
do not trigger the buggy code path.
Most usage of flashrom does not involve layout files.
The fix in this commit (changed fscanf format string) can be applied to
layout.c of all past flashrom versions.
Corresponding to flashrom svn r1953.
Signed-off-by: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006@gmx.net>
Acked-by: Stefan Tauner <stefan.tauner@alumni.tuwien.ac.at>
Even if fwrite() succeeds the data is not necessarily out of the clib's buffers
and writing it eventually could fail. Even if the data is flushed out (explicitly by
fflush() or implicitly by fclose()) the kernel might still hold a buffer.
Previously we have ignored this to a large extent - even in important cases
like writing the flash contents to a file. The results can be truncated
images that would brick the respective machine if written back as is (though
flashrom would not allow that due to a size mismatch). flashrom would not
indicate the problem in any output - so far we only check the return value
of fwrite() that is not conclusive.
This patch checks the return values of all related system calls like fclose()
unless we only read the file and are not really interested in output errors.
In the latter case the return value is casted to void to document this fact.
Additionally, this patch explicitly calls fflush() and fsync() (on regular files only)
to do the best we can to guarantee the read image reaches the disk safely
and at least inform the user if it did not work.
Corresponding to flashrom svn r1902.
Signed-off-by: Stefan Tauner <stefan.tauner@alumni.tuwien.ac.at>
Acked-by: Urja Rannikko <urjaman@gmail.com>
- Introduce a variable in doit() that allows to influence
read-before-write and its consequences.
- Modify build_new_image so that it still works even if the old content
is not read before.
- Add copy_old_content() to ease the pain for future patches.
Corresponding to flashrom svn r1851.
Signed-off-by: Stefan Tauner <stefan.tauner@alumni.tuwien.ac.at>
Signed-off-by: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006@gmx.net>
Acked-by: Stefan Tauner <stefan.tauner@alumni.tuwien.ac.at>
Corresponding to flashrom svn r1789.
Inspired by and mostly based on a patch
Signed-off-by: Mark Marshall <mark.marshall@omicron.at>
Signed-off-by: Stefan Tauner <stefan.tauner@alumni.tuwien.ac.at>
Acked-by: Stefan Tauner <stefan.tauner@alumni.tuwien.ac.at>
Corresponding to flashrom svn r1773.
Signed-off-by: Stefan Reinauer <stefan.reinauer@coreboot.org>
Acked-by: Stefan Tauner <stefan.tauner@alumni.tuwien.ac.at>
This fixes a SEGFAULT if a layout entry is included that addresses memory
outside the current chip's address range. flashrom will only abort if the
offending region(s) is/are included else it will just warn.
It will print warnings for regions with negative or zero-length address ranges
and bail out after checking all of them.
Also, abort for non-write operations if a layout file is given because there is
no layout support for other operations yet.
Corresponding to flashrom svn r1751.
Signed-off-by: Stefan Tauner <stefan.tauner@alumni.tuwien.ac.at>
Acked-by: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006@gmx.net>
Add layout_cleanup() to layout.c and hook it up in cli_classic.c.
Corresponding to flashrom svn r1749.
Signed-off-by: Stefan Tauner <stefan.tauner@alumni.tuwien.ac.at>
Acked-by: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006@gmx.net>
The type describes one entry of the whole layout actually.
Using layout_entry_t or something similar would be more correct,
but due to it length we will use "rom" instead of "layout" here and
in upcoming code.
Corresponding to flashrom svn r1732.
Signed-off-by: Stefan Tauner <stefan.tauner@alumni.tuwien.ac.at>
Acked-by: Stefan Tauner <stefan.tauner@alumni.tuwien.ac.at>
Since we are planning to support image files for rom entries, rename the
variable used to count the number of known rom entries to avoid confusion.
There is already num_include_args with similar semantics, hence we use
num_rom_entries.
Corresponding to flashrom svn r1731.
Signed-off-by: Stefan Tauner <stefan.tauner@alumni.tuwien.ac.at>
Acked-by: Stefan Tauner <stefan.tauner@alumni.tuwien.ac.at>
All the driver conversion work and cleanup has been done by Stefan.
flashrom.c and cli_classic.c are a joint work of Stefan and Carl-Daniel.
Corresponding to flashrom svn r1579.
Signed-off-by: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006@gmx.net>
Signed-off-by: Stefan Tauner <stefan.tauner@alumni.tuwien.ac.at>
Acked-by: Stefan Tauner <stefan.tauner@alumni.tuwien.ac.at>
Acked-by: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006@gmx.net>
And remove the unused force parameter.
Corresponding to flashrom svn r1569.
Signed-off-by: Stefan Tauner <stefan.tauner@alumni.tuwien.ac.at>
Acked-by: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006@gmx.net>
The only caller is able to check the return code and handle it
correctly.
Corresponding to flashrom svn r1545.
Signed-off-by: Niklas Söderlund <niso@kth.se>
Acked-by: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006@gmx.net>
And a tiny cleanup.
Corresponding to flashrom svn r1523.
Signed-off-by: Stefan Tauner <stefan.tauner@alumni.tuwien.ac.at>
Acked-by: Uwe Hermann <uwe@hermann-uwe.de>
NOTE:
The --list-supported-wiki output changed to use -p internal:mainboard=
instead of -m
The --list-supported output changed the heading of the mainboard list
from
Vendor Board Status Required option
to
Vendor Board Status Required value for
-p internal:mainboard=
Fix lb_vendor_dev_from_string() not to write to the supplied string.
Corresponding to flashrom svn r1483.
Signed-off-by: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006@gmx.net>
Acked-by: Stefan Tauner <stefan.tauner@alumni.tuwien.ac.at>
The general idea and most of the code are based on the following
commits in the chromiumos flashrom tree:
Corresponding to flashrom svn r1482.
8fc0740356ca15d02fb1c65ab43b10844f148c3b
bb9049c66ca55e0dc621dd2c70b5d2cb6e5179bf
Signed-off-by: Louis Yung-Chieh Lo <yjlou@chromium.org>
and the main part:
d0ea9ed71e7f86bb8e8db2ca7c32a96de25343d8
Signed-off-by: David Hendricks <dhendrix@chromium.org>
This implementation does not defer the processing until doit(), but after the
argument parsing loop only (doit() should not contain argument checks).
This allows to specify -i and -l parameters in any order.
Signed-off-by: Stefan Tauner <stefan.tauner@alumni.tuwien.ac.at>
Acked-by: David Hendricks <dhendrix@google.com>
- rename from find_next_included_romentry to get_next_included_romentry
- return a pointer to a rom_entry instead of just its index.
this relieves the (single existing) caller from directly accessing the
data structure holding the entries hence improving segregation and
readability.
Corresponding to flashrom svn r1481.
Signed-off-by: Stefan Tauner <stefan.tauner@alumni.tuwien.ac.at>
Acked-by: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006@gmx.net>
Struct flashchip is used only for the flashchips array and for
operations which do not access hardware, e.g. printing a list of
supported flash chips.
struct flashctx (flash context) contains all data available in
struct flashchip, but it also contains runtime information like
mapping addresses. struct flashctx is expected to grow additional
members over time, a prime candidate being programmer info.
struct flashctx contains all of struct flashchip with identical
member layout, but struct flashctx has additional members at the end.
The separation between struct flashchip/flashctx shrinks the memory
requirement of the big flashchips array and allows future extension
of flashctx without having to worry about bloat.
Corresponding to flashrom svn r1473.
Signed-off-by: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006@gmx.net>
Acked-by: Michael Karcher <flashrom@mkarcher.dialup.fu-berlin.de>
If a layout file was specified, all regions not mentioned in the layout
file were taken from the new image instead of being preserved.
If regions overlap, the non-included regions won.
New behaviour:
If a layout file is specified, only the regions explicitly requested for
inclusion will be taken from the new image.
If regions overlap, the included regions win.
Corresponding to flashrom svn r1223.
Signed-off-by: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006@gmx.net>
Acked-by: David Hendricks <dhendrix@google.com>
Focus is on partial write and layout functionality.
Minor modifications by Carl-Daniel Hailfinger.
Corresponding to flashrom svn r1218.
Signed-off-by: David Hendricks <dhendrix@google.com>
Acked-by: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006@gmx.net>
This will allow flashrom to skip erase of already-erased blocks and to
skip write of blocks which already have the wanted contents.
Avoid emergency messages by checking if the chip contents after a failed
write operation (erase/write) are unchanged.
Keep the emergency messages after a failed pure erase. That part is
debatable because if someone wants erase, he pretty sure doesn't care
about the flash contents anymore.
Please note that this introduces additional overhead of a full chip read
before write. This is frowned upon by people with slow programmers. A
followup patch will make this configurable.
Corresponding to flashrom svn r1215.
Signed-off-by: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006@gmx.net>
Acked-by: Stefan Reinauer <stepan@coreboot.org>
This doesn't include changes to the frontend which must be
done separately, so this won't work out of the box.
This code was tested on hardware.
Corresponding to flashrom svn r1184.
Signed-off-by: Patrick Georgi <patrick.georgi@coresystems.de>
Acked-by: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006@gmx.net>
Programmer specific functions are of absolutely no interest to any file
except those dealing with programmer specific actions (special SPI
commands and the generic core).
The new header structure is as follows (and yes, improvements are
possible):
flashchips.h flash chip IDs
chipdrivers.h chip-specific read/write/... functions
flash.h common header for all stuff that doesn't fit elsewhere
hwaccess.h hardware access functions
programmer.h programmer specific functions
coreboot_tables.h header from coreboot, internal programmer only
spi.h SPI command definitions
Corresponding to flashrom svn r1112.
Signed-off-by: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006@gmx.net>
Acked-by: Uwe Hermann <uwe@hermann-uwe.de>
Constify variables where possible.
Initialize programmer-related variables explicitly in programmer_init to
allow running programmer_init from a clean state after
programmer_shutdown.
Prohibit registering programmer shutdown functions before init or after
shutdown.
Kill some dead code.
Rename global variables with namespace-polluting names.
Use a previously unused locking helper function in sst49lfxxxc.c.
This is needed for libflashrom.
Effects on the binary size of flashrom are minimal (300 bytes
shrinkage), but the data section shrinks by 4384 bytes, and that's a
good thing if flashrom is operating in constrained envionments.
Corresponding to flashrom svn r1068.
Signed-off-by: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006@gmx.net>
Acked-by: Michael Karcher <flashrom@mkarcher.dialup.fu-berlin.de>
CONFIG_FT2232SPI (makefile config option)
FT2232_SPI_SUPPORT (#define)
ft2232spi (programmer name)
ft2232_spi.c (programmer file)
Use CONFIG_* with underscores for makefile config options and #defines
and kill the useless _SUPPORT idiom.
Use lowercase names with underscores for programmer names and programmer
files.
With this, you can run "grep -i ft2232_spi" and find everything related
to the ft2232_spi driver. Same applies to all other programmers.
Corresponding to flashrom svn r1023.
Signed-off-by: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006@gmx.net>
Acked-by: Uwe Hermann <uwe@hermann-uwe.de>
Unistd.h was only used to get a definition of NULL in all files. Add our
own NULL #define and remove unistd.h from flash.h
stdio.h has no place in flash.h, it should be included only in files
which really need it.
Add #include statements in individual .c files where needed.
Replace a few printf with msg_* to eliminate the need for stdio.h.
Corresponding to flashrom svn r1021.
Signed-off-by: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006@gmx.net>
Acked-by: Uwe Hermann <uwe@hermann-uwe.de>
- Force chip read by faking probe success.
- Force chip access even if the chip is bigger than max decode size for
the flash bus.
- Force erase even if erase is known bad.
- Force write even if write is known bad.
- Force writing even if cbtable tells us that this is the wrong image
for this board.
This patch cleans up --force usage:
- Remove any suggestions to use --force for probe/read from flashrom
output.
- Don't talk about "success" or "Found chip" if the chip is forced.
- Add a new internal programmer parameter boardmismatch=force. This
overrides any mismatch detection from cbtable/image comparisons.
- Add a new internal programmer parameter laptop=force_I_want_a_brick.
- Adjust the documentation for --force.
- Clean up the man page a bit whereever it talks about --force or
laptops.
Additional changes in this patch:
- Add warnings about laptops to the documentation.
- Abort if a laptop is detected. Can be overridden with the programmer
parameter mentioned above.
- Add "Portable" to the list of DMI strings indicating laptops.
- Check if a chip specified with -c is known to flashrom.
- Programmer parameter reliability and consistency fixes.
- More paranoid self-checks.
- Improve documentation.
Corresponding to flashrom svn r996.
Signed-off-by: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006@gmx.net>
Acked-by: Michael Karcher <flashrom@mkarcher.dialup.fu-berlin.de>
Make various pieces of code conditional on support for internal
programming. Code shared between PCI device programmers and onboard
programming is now conditional as well.
It is now possible to build only with dummy support:
make CONFIG_INTERNAL=no CONFIG_NIC3COM=no CONFIG_SATASII=no
CONFIG_DRKAISER=no CONFIG_SERPROG=no CONFIG_FT2232SPI=no
This allows building for a specific use case only, and it also
facilitates porting to a new architecture because it is possible to
focus on highlevel code only.
Note: Either internal or dummy programmer needs to be compiled in due to
the current behaviour of always picking a default programmer if -p is
not specified. Picking an arbitrary external programmer as default
wouldn't make sense.
Build and runtime tested in all 1024 possible build combinations. The
only failures are by design as mentioned above.
Corresponding to flashrom svn r797.
Signed-off-by: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006@gmx.net>
Acked-by: Sean Nelson <audiohacked@gmail.com>
Flashrom has the ability to use layout files with romentries, but
this feature was not adapted to the programmer infrastructure and had
undefined behaviour for flasher!=internal. The romentry handling had an
off-by-one error which caused all copies to end up one byte short. Fix
these issues.
Corresponding to flashrom svn r694.
Signed-off-by: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006@gmx.net>
Acked-by: Stefan Reinauer <stepan@coresystems.de>
Add chip_{read,write}n to the external flasher infrastructure which
read/write n bytes at once.
Fix a few places where the code used memcpy/memcmp although that is
strictly impossible with external flashers.
Place a FIXME in the layout.c code because usage is not totally clear
and needs to be fixed to support external flashers.
As a nice side benefit, we get a noticeable speedup for builtin flash
reading which is now a memcpy() of the full flash area instead of a
series of single-byte reads.
Corresponding to flashrom svn r579.
Signed-off-by: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006@gmx.net>
Acked-by: Urja Rannikko <urjaman@gmail.com>
Acked-by: Uwe Hermann <uwe@hermann-uwe.de>
Build-tested on 32bit x86.
Corresponding to flashrom svn r521.
Signed-off-by: Uwe Hermann <uwe@hermann-uwe.de>
Acked-by: Uwe Hermann <uwe@hermann-uwe.de>
Also, additional small cosmetic fix.
Corresponding to flashrom svn r440 and coreboot v2 svn r4196.
Signed-off-by: Uwe Hermann <uwe@hermann-uwe.de>
Acked-by: Uwe Hermann <uwe@hermann-uwe.de>
Fix build error on distros with warn_unused_result attributes in glibc.
Corresponding to flashrom svn r378 and coreboot v2 svn r3857.
Signed-off-by: Peter Stuge <peter@stuge.se>
Acked-by: Yul Rottmann <yulrottmann@bitel.net>
Fix that by throwing an error instead.
Corresponding to flashrom svn r370 and coreboot v2 svn r3834.
Signed-off-by: Uwe Hermann <uwe@hermann-uwe.de>
Acked-by: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006@gmx.net>
Acked-by: Peter Stuge <peter@stuge.se>
Corresponding to flashrom svn r326 and coreboot v2 svn r3669.
Signed-off-by: Uwe Hermann <uwe@hermann-uwe.de>
Acked-by: Uwe Hermann <uwe@hermann-uwe.de>
Make stuff fit in 80 chars/line etc.
Corresponding to flashrom svn r296 and coreboot v2 svn r3412.
Signed-off-by: Uwe Hermann <uwe@hermann-uwe.de>
Acked-by: Uwe Hermann <uwe@hermann-uwe.de>
It's not absolutely perfect, but the likelihood of this check to fail is
0.000000000000000000000000013 (1.3*10^-26) which is good enough for me.
Corresponding to flashrom svn r292 and coreboot v2 svn r3408.
Signed-off-by: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006@gmx.net>
Acked-by: Stefan Reinauer <stepan@coresystems.de>
When flash chip detection fails, it is still useful and possible to read the
flash chip contents. If no flash chip is found in normal probes and the
-f -r -c CHIPNAME options are given, a successful probe for the specified
chip is forced, and then flashrom reads the flash chip using either the read
function for the specified chip, or if there is none, a simple memcpy().
The patch also moves the global variable int force in flashrom.c into main()
and passes it as a parameter to layout.c:show_id(), which was the only other
function that used the variable. This is needed to avoid confusion with the
new parameter int force which is added to flashrom.c:probe_flash() and used
to force probe success for the chip named in char *chip_to_probe.
Corresponding to flashrom svn r259 and coreboot v2 svn r3367.
Signed-off-by: Peter Stuge <peter@stuge.se>
Acked-by: Ward Vandewege <ward@gnu.org>
The file was written by Stefan Reinauer for coresystems GmbH in 2005, as
confirmed on IRC.
Corresponding to flashrom svn r198 and coreboot v2 svn r3126.
Signed-off-by: Uwe Hermann <uwe@hermann-uwe.de>
Acked-by: Stefan Reinauer <stepan@coresystems.de>
Corresponding to flashrom svn r178 and coreboot v2 svn r3054.
Signed-off-by: Stefan Reinauer <stepan@coresystems.de>
Acked-by: Stefan Reinauer <stepan@coresystems.de>
Corresponding to flashrom svn r151 and coreboot v2 svn r2873.
Signed-off-by: Uwe Hermann <uwe@hermann-uwe.de>
Acked-by: Stefan Reinauer <stepan@coresystems.de>
Corresponding to flashrom svn r143 and coreboot v2 svn r2847.
Signed-off-by: Uwe Hermann <uwe@hermann-uwe.de>
Acked-by: Uwe Hermann <uwe@hermann-uwe.de>
Corresponding to flashrom svn r142 and coreboot v2 svn r2846.
Signed-off-by: Uwe Hermann <uwe@hermann-uwe.de>
Acked-by: Uwe Hermann <uwe@hermann-uwe.de>
