[Skiboot] [PATCH 1/4] core/flash: Allow OPAL flash calls for size equal to flash
Cyril Bur
cyril.bur at au1.ibm.com
Thu Jun 29 09:38:01 AEST 2017
A bounds checking mistake prevents opal_flash_{read,write,erase} calls
from having a length equal to the size of the flash. This bug has been
present since the beginning (e7d1f60e core/flash: Add flash API) of
these calls.
Until before d6a5b53f libflash/blocklevel: Add blocklevel_smart_erase()
6/4/2017 none of our tools would have performed a single command for the
full size of the flash. It would still have be possible to persuade `dd`
to do this by using a block size equal to the size of the flash or other
mtd related tools.
Any pflash built with blocklevel_smart_erase() will perform one call to
Linux and then Skiboot for the size of flash.
Signed-off-by: Cyril Bur <cyril.bur at au1.ibm.com>
---
core/flash.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/core/flash.c b/core/flash.c
index 8a908e5b..f0390394 100644
--- a/core/flash.c
+++ b/core/flash.c
@@ -16,6 +16,7 @@
#include <skiboot.h>
#include <cpu.h>
+#include <inttypes.h>
#include <lock.h>
#include <opal.h>
#include <opal-msg.h>
@@ -342,8 +343,10 @@ static int64_t opal_flash_op(enum flash_op op, uint64_t id, uint64_t offset,
goto err;
}
- if (size >= flash->size || offset >= flash->size
+ if (size > flash->size || offset >= flash->size
|| offset + size > flash->size) {
+ prlog(PR_DEBUG, "Requested flash op %d beyond flash size %" PRIu64 "\n",
+ op, flash->size);
rc = OPAL_PARAMETER;
goto err;
}
--
2.13.2
More information about the Skiboot
mailing list