| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The semantics of %l changed during the enabling of compile-time
printf format checking. Old firmware branches will treat something
like %lx as a 64-bit value, but new code on master will enforce at
compile-time that a long (32-bits on our ECs) is passed in as the
argument. This creates a dangerous and difficult to notice situation
if the following code is cherry-picked from master into an old
firmware branch:
printf("%lx %s", myval32, mystr);
On master, this behaves correctly. On the old firmware branch, this
would swallow myval32 and mystr for %lx, and then %s would grab a
random stack pointer and print a string from it.
Deprecating %l is our mechanism for keeping such a printf from
creeping into master in the future. Obviously we can't protect against
someone that checks in code that's never tested, but anyone who tests
a printf with %l in it will notice their printf comes out with ERROR
instead of what they want.
BUG=chromium:984041
TEST=make -j buildall
BRANCH=None
Change-Id: I0267430363af7954c2ec5d2c45222759fe0ec2c1
Signed-off-by: Evan Green <evgreen@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/ec/+/1834604
Reviewed-by: Jack Rosenthal <jrosenth@chromium.org>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Add annotations to allow the compiler to check printf-style format
strings in the EC.
BUG=chromium:984041
TEST=make -j buildall
BRANCH=None
Change-Id: Ic39f37f8362372de7d289becea684d9da535599a
Signed-off-by: Evan Green <evgreen@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/ec/+/1733101
Reviewed-by: Jack Rosenthal <jrosenth@chromium.org>
Reviewed-by: Daisuke Nojiri <dnojiri@chromium.org>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
In the standard, %l[dioux] takes an integer of type long. In the EC
up until now, we had been using it as shorthand for a 64-bit long.
Now that we're enabling the compile-time printf format checker, it's
time to correct the semantics of %l.
This is a breaking change. I would advise against cherry-picking this
commit into any firmware branches. The reasoning is that the specifier
now swallows a different number of arguments, causing any subsequent
specifiers to be wrong.
BUG=chromium:984041
TEST=make -j buildall
BRANCH=None
Change-Id: Ia5630e59611097dc0deda648498c7f43b9c62ac9
Signed-off-by: Evan Green <evgreen@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/ec/+/1829576
Reviewed-by: Jack Rosenthal <jrosenth@chromium.org>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
In order to make our printf more standard, utilize %ll for long long
arguments, rather than %l. This does cost a little bit in flash space
for that extra l in a couple of places, but enables us to turn on
compile-time printf format checking.
For this commit only, the semantics are such that both %l and %ll
take 64-bit arguments. In the next commit, %l goes to its correct
behavior of taking a sizeof(long) argument.
BUG=chromium:984041
TEST=make -j buildall
BRANCH=none
Cq-Depend:chrome-internal:1863686,chrome-internal:1860161,chrome-internal:1914029
Change-Id: I18081b55a8dbf5ef8ec15fc499ca75e59d31da58
Signed-off-by: Evan Green <evgreen@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/ec/+/1819652
Reviewed-by: Jack Rosenthal <jrosenth@chromium.org>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
When printing size_t sized integers, utilize the standard %z
modifier so that the specifier format is correct. This will enable us
to turn on compile-time printf format verification.
BUG=chromium:984041
TEST=make -j buildall
BRANCH=none
Cq-Depend:chrome-internal:1860160
Change-Id: I2c95df5c0d87677cb9fcbde33ab8846708a774a1
Signed-off-by: Evan Green <evgreen@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/ec/+/1819651
Reviewed-by: Jack Rosenthal <jrosenth@chromium.org>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
In order to make printf more standard, use %ph. Pass a pointer to
a struct describing the buffer, including its size. Add a convenience
macro so that conversion between the old style and new style is purely
mechanical. The old style of %h cannot be converted directly to %ph as-is
because the C standard doesn't allow flags, precision, or field width on
%p.
Ultimately the goal is to enable compile-time printf format checking.
This gets us one step closer to that.
BUG=chromium:984041
TEST=make -j buildall
BRANCH=None
Cq-Depend:chrome-internal:1559798,chrome-internal:1560598
Change-Id: I9c0ca124a048314c9b62d64bd55b36be55034e0e
Signed-off-by: Evan Green <evgreen@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/ec/+/1730605
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
In order to be more compliant to standards, and ultimately turn on
compile-time printf format validation, switch the non-standard %T
into %pT, which takes a pointer to a 64-bit timestamp as an argument.
For convenience, define PRINTF_TIMESTAMP_NOW, which will use the
current time as the timestamp value, rather than forcing everyone
to pass a pointer to get_time().val.
For a couple of instances, simply use CPRINTS instead.
BUG=chromium:984041
TEST=make -j buildall
BRANCH=None
Cq-Depend:chrome-internal:1473305
Change-Id: I83e45b55a95ea27256dc147544ae3f7e39acc5dd
Signed-off-by: Evan Green <evgreen@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/ec/+/1704216
Reviewed-by: Jack Rosenthal <jrosenth@chromium.org>
Reviewed-by: Daisuke Nojiri <dnojiri@chromium.org>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
In order to avoid landmines later with future extensions to %p,
disallow %p by itself. The danger is that we'll have something
like: printf("%pFOO", myptr), and then later will add a %pF
extension, but miss this printf (maybe the string is split, maybe
it's just missed).
Missing a conversion during extension is worse than just seeing a
print like <ptr_val>OO, since %pF likely reaches through the
pointer and interprets its contents according to whatever F means.
Convert existing uses of %p to %pP, so they're explicitly printing
a pointer value, giving us flexibility to extend in the future.
BUG=chromium:984041
TEST=make -j buildall
BRANCH=None
Cq-Depend:chrome-internal:1560879
Change-Id: I36a4bee8d41cb9a6139171f8de0d8f2f19468132
Signed-off-by: Evan Green <evgreen@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/ec/+/1730604
Reviewed-by: Jack Rosenthal <jrosenth@chromium.org>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This patch addresses a few issues with the current formatter.
The major points are as follows:
1. Cannot specify precision 0 (truncate all) for string or hexdump
2. Forced safe precision for malformed strings
3. No padding when using hexdump
4. Bad error EC_ERROR_INVAL in vsnprintf
5. Documentation errors
For (1), no piece of code explicitly sets the precision to 0 in
order to invoke the default behavior, which is currently no
precision limit.
You can check using the following grep line:
grep -rI '%[\*0-9]\{0,20\}\.0\{1,20\}[a-zA-Z]'
However, there are many cases where the precision is used to limit
the character output (as it should be).
grep -rI '%[\*0-9]\{0,20\}\.[\*0-9]\{1,20\}[a-zA-Z]'
There are many more instances that use variable precision without
checking if the precision is zero. One of which is the following:
crrev.com/4a4e2c71a0f6aaa50e0728922f84a7d54c14380a/test/host_command_fuzz.c#116
https://clusterfuzz.com/testcase-detail/5699023975088128
Our current implementation will insert ERROR and stop processing,
if a precision of zero is detected when using the hexdump flag.
This results in a badly formatted console line or runtime string,
when the intended behavior would be to simply read no bytes.
In the aforementioned fuzzer case, outputting ERROR triggers
a false positive.
Our printf should handle explicit zero precision similar to
stdlib's printf, which means truncating all the way to zero
positions, if specified.
For (2), our current implementation uses strlen to identify the
length of the input string, regardless of the set precision.
Since this is an embedded platform, we should use strnlen to
impose safe limits, when a precision is specified.
For (3), our implementation should support padding and adjusting
of all formatter types, since that is a primary feature of a
printf formatter.
The remaining commented code highlights odd behavior that should
be fixed at some point, but is not critical.
BUG=chromium:974084
TEST=Checked for any format lines that rely on a set precision of 0
grep -rI '%[\*0-9]\{0,20\}\.[\*0-9]\{1,20\}[a-zA-Z]'
TEST=make run-printf V=1
BRANCH=none
Change-Id: I897c53cce20a701fcbe8fb9572eb878817525cc3
Signed-off-by: Craig Hesling <hesling@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/ec/+/1659835
Reviewed-by: Randall Spangler <rspangler@chromium.org>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Ran the following command:
git grep -l 'Copyright (c)' | \
xargs sed -i 's/Copyright (c)/Copyright/g'
BRANCH=none
BUG=none
TEST=make buildall -j
Change-Id: I6cc4a0f7e8b30d5b5f97d53c031c299f3e164ca7
Signed-off-by: Tom Hughes <tomhughes@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/ec/+/1663262
Reviewed-by: Daisuke Nojiri <dnojiri@chromium.org>
Reviewed-by: Aseda Aboagye <aaboagye@chromium.org>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Fuzzing targets are linked against libec.a so that they can invoke ec
functionality while depending on outside libraries that need cstdlib.
An issue was being hit with a libprotobuf-mutator fuzzer target because
protobuf needed the stdlib version of vfnprintf. This change resolves
the issue by keeping the EC version of vfnprinf within libec.a.
BRANCH=none
BUG=chromium:962947
TEST=make -j buildall
Change-Id: Ie0c79199dfba58d5fb04d9f340967a73921d09c8
Signed-off-by: Allen Webb <allenwebb@google.com>
Reviewed-on: https://chromium-review.googlesource.com/1637580
Legacy-Commit-Queue: Commit Bot <commit-bot@chromium.org>
Reviewed-by: Nicolas Boichat <drinkcat@chromium.org>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This function enables variadic functions to take advantage
of functionality provided by snprintf.
Signed-off-by: Jeff Andersen <jeffandersen@google.com>
BRANCH=none
BUG=b:72360575
TEST=make buildall -j
Change-Id: I0095a96339b374ef8030b87b5184fa4678b439eb
Reviewed-on: https://chromium-review.googlesource.com/971761
Commit-Ready: Jeff Andersen <jeffandersen@google.com>
Tested-by: Jeff Andersen <jeffandersen@google.com>
Reviewed-by: Randall Spangler <rspangler@chromium.org>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
For compatibility/convenience, implement the '%li' printf format
as a *32-bit* integer format, as it might be expected by non-EC code.
Signed-off-by: Vincent Palatin <vpalatin@chromium.org>
BRANCH=none
BUG=b:70320279
TEST=run on Eve EVT with unspecified external binary and see its traces
are correctly printed.
Change-Id: Iac20e823c74aac4f659176416eebd804c321d47c
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
'+' flag can be used with signed integer type (%d) and causes positive
integers to be prefixed with '+' (e.g. +1745). This emphasizes output
values as a signed value. It can be mixed with left-justification flag
'-': %-+8d. It's ignored when used with unsigned integer or non-integer
types: %u, %x, %p, %s, %c, etc.
BUG=none
BRANCH=none
TEST=make buildall &&
int32_t d = 1745;
CPRINTS("'%-+8d'", -d); /* '-1745 ' */
CPRINTS("'%-+8d'", d); /* '+1745 ' */
CPRINTS("'%d'", d); /* '1745' */
CPRINTS("'%+08d'", -d); /* '000-1745' */
CPRINTS("'%+08d'", d); /* '000+1745' */
CPRINTS("'%+d'", -d); /* '-1745' */
CPRINTS("'%+d'", d); /* '+1745' */
CPRINTS("'%+s'", "foo"); /* 'foo' */
CPRINTS("'%-+8s'", "foo"); /* 'foo ' */
CPRINTS("'%+08x'", d); /* '000006d1' */
CPRINTS("'%+u'", d); /* '1745' */
Change-Id: I8dcd34b0cf03dbefc500b9c98fea235d85bde8d3
Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/363924
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
No functional changes.
BUG=chrome-os-partner:15579
BRANCH=none
TEST=boot system; debug output still shows up on EC console
Change-Id: I63f4f9481f5393aaff065b37a274236bd78622d9
Signed-off-by: Randall Spangler <rspangler@chromium.org>
Reviewed-on: https://gerrit.chromium.org/gerrit/36581
Reviewed-by: Bill Richardson <wfrichar@chromium.org>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
1. Add precision to limit string length.
ccprintf("%.4s", "foobar") prints "foob"
2. Handle '*' for length, precision fields.
ccprintf("%.*s", 3, "foobar") prints "foo"
3. Add hex-dump code "%h"
ccprintf("%.*s", 4, "foobar") prints 666f6f62
BUG=none
TEST=at ec console, 'hash' prints the current hash
Change-Id: I568310f2727495b021081bf58df2a0bbb3c74e73
Signed-off-by: Randall Spangler <rspangler@chromium.org>
Reviewed-on: https://gerrit.chromium.org/gerrit/28704
Reviewed-by: Bill Richardson <wfrichar@chromium.org>
|
|
Also add snprintf(), and %X format code.
BUG=chrome-os-partner:10206
TEST=timerinfo; should print correctly. 'ectool battery' on host side should print same serial as 'battery' on EC console.
Change-Id: I5c9f69d1a20ee5d0a59440c122655adbf62c9aea
Signed-off-by: Randall Spangler <rspangler@chromium.org>
Reviewed-on: https://gerrit.chromium.org/gerrit/24635
Reviewed-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Rong Chang <rongchang@chromium.org>
|