flash_read_security() ends its loop the same way flash_read_bulk() did
before the previous commit: only through comparisons with 1, 2, 3 and 4. A length of
zero matches none of them, the following subtraction wraps on uint16_t
and the loop keeps printing until the counter comes back down to 4.
No caller passes zero today, since the only one is the CLI with a
constant length of 40, but the bound belongs in the function rather
than in whoever calls it.
flash_read_bulk() ends its copy loop only through the comparisons
len == 1|2|3|4, so a length of zero matches none of them. The
following len -= 4 wraps on uint16_t to 65532 and reaches 4 only
after 16384 iterations, writing 65536 bytes to the destination and
overwriting the whole XDATA space.
send_config() gets there with valid_len 0 whenever the stored
configuration begins with a NUL byte, which is the state left by
uploading an empty configuration file. Every later request for the
configuration page then clears the management VLAN and the STP
flag and replaces the host address, while the switch keeps running
and keeps forwarding traffic.
In commit 884bc18, `Fast Read 0x0b` was exchanged for `Read 0x03` command.
This was done because I did not see the difference between the commands
and the extra dummycycles looks like wasted time. But I overlooked that
many flash devices, the `Read 0x03` command can't run at the maximum
SPI-clock speed, but only half or less of the maximum SPI-clock speed.
This can cause in-transit data corruption while reading the device.
So change it back to `Fast Read 0x0b` command, so the SPI device is used
within the device specification.
flash_read_bulk() is kind of a printf function. But did not work as well.
flash_read_bulk() was used in the http generation so this needed to be changed as well.
For the website we decided that we are going to use CSR(Client Side Rendering).
So every HTML and JS files are now static.
Variables are fetched via json calls and output is render on the client side.
Also usefull for the future when we want a REST like API.
execute_config() was also using flash_read_bulk().
This have been replaced with flash_read_bulk() and parsing the flash_buf buffer.
Fix several bugs found in the write-flash code during installer coding.
Move all flash functions into CODE0. This is required to share these
functions with the installer image (currently they are duplicated so
they are not within the CODE1 segment).
De-magics all Flash command codes based on the Winbond W25Q32JV
datasheet.
DrDoof
bennydiamond
feelfree69
logicog
René van Dorst