Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 237ea0d4 authored by Rafał Miłecki's avatar Rafał Miłecki Committed by Boris Brezillon
Browse files

mtd: bcm47xxpart: improve handling TRX partition size 



When bcm47xxpart finds a TRX partition (container) it's supposed to jump
to the end of it and keep looking for more partitions. TRX and its
subpartitions are handled by a separate parser.

The problem with old code was relying on the length specified in a TRX
header. That isn't reliable as TRX is commonly modified to have checksum
cover only non-changing subpartitions. Otherwise modifying e.g. a rootfs
would result in CRC32 mismatch and bootloader refusing to boot a
firmware.

Fix it by trying better to figure out a real TRX size. We can securely
assume that TRX has to cover all subpartitions and the last one is at
least of a block size in size. Then compare it with a length field.

This makes code more optimal & reliable thanks to skipping data that
shouldn't be parsed.

Signed-off-by: default avatarRafał Miłecki <rafal@milecki.pl>
Signed-off-by: default avatarBoris Brezillon <boris.brezillon@bootlin.com>
parent 5ac67ce3

drivers/mtd/bcm47xxpart.c

+18 −4
Original line number Original line Diff line number Diff line
@@ -186,6 +186,8 @@ static int bcm47xxpart_parse(struct mtd_info *master, 
		/* TRX */

		/* TRX */

		if (buf[0x000 / 4] == TRX_MAGIC) {

		if (buf[0x000 / 4] == TRX_MAGIC) {

			struct trx_header *trx;

			struct trx_header *trx;

			uint32_t last_subpart;

			uint32_t trx_size;





			if (trx_num >= ARRAY_SIZE(trx_parts))

			if (trx_num >= ARRAY_SIZE(trx_parts))

				pr_warn("No enough space to store another TRX found at 0x%X\n",

				pr_warn("No enough space to store another TRX found at 0x%X\n",
@@ -195,11 +197,23 @@ static int bcm47xxpart_parse(struct mtd_info *master, 
			bcm47xxpart_add_part(&parts[curr_part++], "firmware",

			bcm47xxpart_add_part(&parts[curr_part++], "firmware",

					     offset, 0);

					     offset, 0);





			/* Jump to the end of TRX */

			/*

			 * Try to find TRX size. The "length" field isn't fully

			 * reliable as it could be decreased to make CRC32 cover

			 * only part of TRX data. It's commonly used as checksum

			 * can't cover e.g. ever-changing rootfs partition.

			 * Use offsets as helpers for assuming min TRX size.

			 */

			trx = (struct trx_header *)buf;

			trx = (struct trx_header *)buf;

			offset = roundup(offset + trx->length, blocksize);

			last_subpart = max3(trx->offset[0], trx->offset[1],

			/* Next loop iteration will increase the offset */

					    trx->offset[2]);

			offset -= blocksize;

			trx_size = max(trx->length, last_subpart + blocksize);



			/*

			 * Skip the TRX data. Decrease offset by block size as

			 * the next loop iteration will increase it.

			 */

			offset += roundup(trx_size, blocksize) - blocksize;

			continue;

			continue;

		}

		}