From nobody Mon Jul 20 22:50:18 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4h3whV4ddPz6dZTw for ; Mon, 20 Jul 2026 22:50:18 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4h3whV3j1bz3MZh for ; Mon, 20 Jul 2026 22:50:18 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1784587818; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ui0/qFdxn5C5+rHoYqdl75+FUC4YqqGFs9+HFnh4cic=; b=VpWfe1+uHkeeFd4b+QxXqUvkzRBvb2WTziqPyL75xBcM3HgsbUTvuOPp9o3VHmTQ4Lw0hI X1iattr46wyHgZKie3fr8pZxZ3p0dyRAX5nZmNjL1FdYpERLNcQysRrAQOBYFg9GcqoJuo 9JHoWFO008Jh5xHASlT6YV4zMwggXWty0rmjrblLEqRO41YIkVN6XjgyKuarTdHRaxAheC eM9ypIM/eZH0Cc8ag0H3+asS30gTrdqLTdTG2x9niPxHmluhZXy+vkzaC9kgZV+Zc82jbj Yvfws997ggOPA0/pNdubbWwHuxg4rMK/YqI9KSqg8B0mHxwyZLYlqM7gmjKtvA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1784587818; a=rsa-sha256; cv=none; b=PYj/5R+CuzyEzo0FDBIl6MOoffQMfltZHJ1K6iuxT2kclk/bEkg5PXUbusk7K+MkAWZCj/ EuU9xjSbI4agBKvPUjNO9LNUEVYrMWq2CMeXjvA0lzuFaFBT2lmOFOqX/LCNMSH3Fb7Hcv aMO0hEh94ZYa6HSYtRaLCIb3Iti+QCSpO1BXJfD0RHSG4Dj0wsKxn2rWZQG7R/oV/tBPQf ZE6CfqXveZXTzJ7vB8o3ThKEFZKleyMOCv/afe3R4ovANwlbeXeqC6Q/Imzjq5ncmt0j7t ggnrMIX5kX51VAAehQXGeqzA6OexFiHYk145GSvKIs/+NQM8KyAXQIt/xPHM1Q== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1784587818; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ui0/qFdxn5C5+rHoYqdl75+FUC4YqqGFs9+HFnh4cic=; b=XQPI3cjH2cY3GEJkpcegHxVHKgVjCzae42RNiR6Pu3otOWnNOuL5+P5TvHAcDYYga1jQon SZ/k9b5d/4zYIrmsi1KN7qo0f3FhoqPKft70imY9ple7hU/5SWT1GY7jBBAemlBqyaCXNN v5r7lOOl8bwVf1vSl+BCI5ZM9mRSNV3HFt4vX8jP1bYr7rw8CKtyXyGcZpbrtq2/c+9GXI 5GY1X0cBH1V5FG81/ZKPIBabr3A/IOzY1PGUAImEOeEhVHF4Ej1rPeIsnJT7uwAUuBtumb 8u0mGaFYwV9GKwiYMKt/R3b6DSnFl0jxFI124NHPvzldU7WLzyrv3fHJnwvilg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4h3whV1Zp9z5vd for ; Mon, 20 Jul 2026 22:50:18 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 31d85 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 20 Jul 2026 22:50:18 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Cc: Abdelkader Boudih From: Adrian Chadd Subject: git: d3259935f778 - main - firewire: add warn-only CRC validation for CSR ROM directories List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: adrian X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: d3259935f7780507248044cdce67646b5fa3e7c6 Auto-Submitted: auto-generated Date: Mon, 20 Jul 2026 22:50:18 +0000 Message-Id: <6a5ea62a.31d85.65b25dd6@gitrepo.freebsd.org> The branch main has been updated by adrian: URL: https://cgit.FreeBSD.org/src/commit/?id=d3259935f7780507248044cdce67646b5fa3e7c6 commit d3259935f7780507248044cdce67646b5fa3e7c6 Author: Abdelkader Boudih AuthorDate: 2026-07-20 22:38:41 +0000 Commit: Adrian Chadd CommitDate: 2026-07-20 22:38:47 +0000 firewire: add warn-only CRC validation for CSR ROM directories Implemented crom_crc_valid() helper to validate IEEE 1394 config ROM CRC-16 checksums. Skipped root header CRC validation since csrhdr.crc_len cover the entire ROM body which is not fully read at header parse time. Per-directory CRC checks below catch corruption where it needed. Reviewed by: adrian Differential Revision: https://reviews.freebsd.org/D58307 --- sys/dev/firewire/firewire.c | 15 ++++++++++++++- sys/dev/firewire/fwcam.c | 5 +++++ sys/dev/firewire/fwcrom.c | 7 +++++++ sys/dev/firewire/fwisound.c | 5 +++++ sys/dev/firewire/iec13213.h | 1 + 5 files changed, 32 insertions(+), 1 deletion(-) diff --git a/sys/dev/firewire/firewire.c b/sys/dev/firewire/firewire.c index 3d41b4691276..d3808f5c8e62 100644 --- a/sys/dev/firewire/firewire.c +++ b/sys/dev/firewire/firewire.c @@ -1519,7 +1519,11 @@ fw_explore_csrblock(struct fw_device *fwdev, int offset, int recur) if (err) return (-1); - /* TODO: validate directory CRC */ + if (!crom_crc_valid((uint32_t *)reg, dir->crc_len, dir->crc)) { + if (firewire_debug) + printf("%s: bad CRC in directory at 0x%x\n", + __func__, offset - (int)sizeof(uint32_t)); + } off = CSRROMOFF + offset + sizeof(uint32_t) * (dir->crc_len - 1); if (fwdev->rommax < off) @@ -1586,6 +1590,7 @@ fw_explore_node(struct fw_device *dfwdev) return (-1); } binfo = (struct bus_info *)&csr[1]; + /* Root header CRC spans entire ROM; validated per-directory below. */ if (binfo->bus_name != CSR_BUS_NAME_IEEE1394) { dfwdev->status = FWDEVINVAL; return (-1); @@ -1828,6 +1833,10 @@ fw_parse_units(struct fw_device *fwdev) root_len = rootdir->crc_len; if (root_off + 1 + root_len > rom_quads) return; + if (!crom_crc_valid((uint32_t *)&rootdir->entry[0], root_len, + rootdir->crc) && firewire_debug) + device_printf(fwdev->fc->bdev, + "fw_parse_units: bad root directory CRC\n"); uindex = 0; for (ri = 0; ri < (int)root_len; ri++) { @@ -1844,6 +1853,10 @@ fw_parse_units(struct fw_device *fwdev) udir_len = udir->crc_len; if (udir_qoff + 1 + udir_len > rom_quads) continue; + if (!crom_crc_valid((uint32_t *)&udir->entry[0], udir_len, + udir->crc) && firewire_debug) + printf("fw_parse_units: bad CRC in unit dir at 0x%x\n", + udir_qoff); spec_id = 0; sw_version = 0; diff --git a/sys/dev/firewire/fwcam.c b/sys/dev/firewire/fwcam.c index b2381c4be3f9..72bf429f061a 100644 --- a/sys/dev/firewire/fwcam.c +++ b/sys/dev/firewire/fwcam.c @@ -98,6 +98,11 @@ fwcam_search_dir_cmd_base(uint32_t *csrrom, uint32_t dir_qoff, dir_len = dir->crc_len; if (dir_qoff + 1 + dir_len > rom_quads) return (0); + if (!crom_crc_valid((uint32_t *)&dir->entry[0], dir_len, dir->crc)) { + if (firewire_debug) + printf("fwcam: bad CRC in directory at 0x%x\n", + dir_qoff); + } for (i = 0; i < (int)dir_len; i++) { if (dir_qoff + 1 + i >= rom_quads) diff --git a/sys/dev/firewire/fwcrom.c b/sys/dev/firewire/fwcrom.c index 6e588b08a40f..ec88902e582e 100644 --- a/sys/dev/firewire/fwcrom.c +++ b/sys/dev/firewire/fwcrom.c @@ -237,6 +237,13 @@ crom_crc(uint32_t *ptr, int len) return ((uint16_t) crc); } +int +crom_crc_valid(uint32_t *data, int len, uint16_t expected) +{ + + return (crom_crc(data, len) == expected); +} + #if !defined(_KERNEL) && !defined(_BOOT) static void crom_desc_specver(uint32_t spec, uint32_t ver, char *buf, int len) diff --git a/sys/dev/firewire/fwisound.c b/sys/dev/firewire/fwisound.c index 63ebd5f01917..12a32fb25aab 100644 --- a/sys/dev/firewire/fwisound.c +++ b/sys/dev/firewire/fwisound.c @@ -123,6 +123,11 @@ fwisound_find_audio_base(struct fw_unit *unit) udir_len = udir->crc_len; if (udir_qoff + 1 + udir_len > rom_quads) return (0); + if (!crom_crc_valid((uint32_t *)&udir->entry[0], udir_len, udir->crc)) { + if (firewire_debug) + printf("fwisound: bad CRC in unit directory at 0x%x\n", + udir_qoff); + } for (i = 0; i < (int)udir_len; i++) { if (udir_qoff + 1 + i >= rom_quads) diff --git a/sys/dev/firewire/iec13213.h b/sys/dev/firewire/iec13213.h index 0f6ac5b35224..a0d57ab4781a 100644 --- a/sys/dev/firewire/iec13213.h +++ b/sys/dev/firewire/iec13213.h @@ -215,6 +215,7 @@ struct csrreg *crom_get(struct crom_context *); void crom_next(struct crom_context *); void crom_parse_text(struct crom_context *, char *, int); uint16_t crom_crc(uint32_t *r, int); +int crom_crc_valid(uint32_t *data, int len, uint16_t expected); struct csrreg *crom_search_key(struct crom_context *, uint8_t); int crom_has_specver(uint32_t *, uint32_t, uint32_t);