042-v4.18-0009-mtd-bcm47xxpart-improve-handling-TRX-partition-size.patch 2.6 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970
  1. From 237ea0d4762cc14d0fc80e80d61f0f08e1050c7f Mon Sep 17 00:00:00 2001
  2. From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
  3. Date: Thu, 12 Apr 2018 07:24:52 +0200
  4. Subject: [PATCH] mtd: bcm47xxpart: improve handling TRX partition size
  5. MIME-Version: 1.0
  6. Content-Type: text/plain; charset=UTF-8
  7. Content-Transfer-Encoding: 8bit
  8. When bcm47xxpart finds a TRX partition (container) it's supposed to jump
  9. to the end of it and keep looking for more partitions. TRX and its
  10. subpartitions are handled by a separate parser.
  11. The problem with old code was relying on the length specified in a TRX
  12. header. That isn't reliable as TRX is commonly modified to have checksum
  13. cover only non-changing subpartitions. Otherwise modifying e.g. a rootfs
  14. would result in CRC32 mismatch and bootloader refusing to boot a
  15. firmware.
  16. Fix it by trying better to figure out a real TRX size. We can securely
  17. assume that TRX has to cover all subpartitions and the last one is at
  18. least of a block size in size. Then compare it with a length field.
  19. This makes code more optimal & reliable thanks to skipping data that
  20. shouldn't be parsed.
  21. Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
  22. Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com>
  23. ---
  24. drivers/mtd/bcm47xxpart.c | 22 ++++++++++++++++++----
  25. 1 file changed, 18 insertions(+), 4 deletions(-)
  26. --- a/drivers/mtd/bcm47xxpart.c
  27. +++ b/drivers/mtd/bcm47xxpart.c
  28. @@ -268,6 +268,8 @@ static int bcm47xxpart_parse(struct mtd_
  29. /* TRX */
  30. if (buf[0x000 / 4] == TRX_MAGIC) {
  31. struct trx_header *trx;
  32. + uint32_t last_subpart;
  33. + uint32_t trx_size;
  34. if (trx_num >= ARRAY_SIZE(trx_parts))
  35. pr_warn("No enough space to store another TRX found at 0x%X\n",
  36. @@ -277,11 +279,23 @@ static int bcm47xxpart_parse(struct mtd_
  37. bcm47xxpart_add_part(&parts[curr_part++], "firmware",
  38. offset, 0);
  39. - /* Jump to the end of TRX */
  40. + /*
  41. + * Try to find TRX size. The "length" field isn't fully
  42. + * reliable as it could be decreased to make CRC32 cover
  43. + * only part of TRX data. It's commonly used as checksum
  44. + * can't cover e.g. ever-changing rootfs partition.
  45. + * Use offsets as helpers for assuming min TRX size.
  46. + */
  47. trx = (struct trx_header *)buf;
  48. - offset = roundup(offset + trx->length, blocksize);
  49. - /* Next loop iteration will increase the offset */
  50. - offset -= blocksize;
  51. + last_subpart = max3(trx->offset[0], trx->offset[1],
  52. + trx->offset[2]);
  53. + trx_size = max(trx->length, last_subpart + blocksize);
  54. +
  55. + /*
  56. + * Skip the TRX data. Decrease offset by block size as
  57. + * the next loop iteration will increase it.
  58. + */
  59. + offset += roundup(trx_size, blocksize) - blocksize;
  60. continue;
  61. }