The branch main has been updated by adrian: URL: https://cgit.FreeBSD.org/src/commit/?id=d3259935f7780507248044cdce67646b5fa3e7c6
commit d3259935f7780507248044cdce67646b5fa3e7c6 Author: Abdelkader Boudih <[email protected]> AuthorDate: 2026-07-20 22:38:41 +0000 Commit: Adrian Chadd <[email protected]> CommitDate: 2026-07-20 22:38:47 +0000 firewire: add warn-only CRC validation for CSR ROM directories Implemented crom_crc_valid() helper to validate IEEE 1394 config ROM CRC-16 checksums. Skipped root header CRC validation since csrhdr.crc_len cover the entire ROM body which is not fully read at header parse time. Per-directory CRC checks below catch corruption where it needed. Reviewed by: adrian Differential Revision: https://reviews.freebsd.org/D58307 --- sys/dev/firewire/firewire.c | 15 ++++++++++++++- sys/dev/firewire/fwcam.c | 5 +++++ sys/dev/firewire/fwcrom.c | 7 +++++++ sys/dev/firewire/fwisound.c | 5 +++++ sys/dev/firewire/iec13213.h | 1 + 5 files changed, 32 insertions(+), 1 deletion(-) diff --git a/sys/dev/firewire/firewire.c b/sys/dev/firewire/firewire.c index 3d41b4691276..d3808f5c8e62 100644 --- a/sys/dev/firewire/firewire.c +++ b/sys/dev/firewire/firewire.c @@ -1519,7 +1519,11 @@ fw_explore_csrblock(struct fw_device *fwdev, int offset, int recur) if (err) return (-1); - /* TODO: validate directory CRC */ + if (!crom_crc_valid((uint32_t *)reg, dir->crc_len, dir->crc)) { + if (firewire_debug) + printf("%s: bad CRC in directory at 0x%x\n", + __func__, offset - (int)sizeof(uint32_t)); + } off = CSRROMOFF + offset + sizeof(uint32_t) * (dir->crc_len - 1); if (fwdev->rommax < off) @@ -1586,6 +1590,7 @@ fw_explore_node(struct fw_device *dfwdev) return (-1); } binfo = (struct bus_info *)&csr[1]; + /* Root header CRC spans entire ROM; validated per-directory below. */ if (binfo->bus_name != CSR_BUS_NAME_IEEE1394) { dfwdev->status = FWDEVINVAL; return (-1); @@ -1828,6 +1833,10 @@ fw_parse_units(struct fw_device *fwdev) root_len = rootdir->crc_len; if (root_off + 1 + root_len > rom_quads) return; + if (!crom_crc_valid((uint32_t *)&rootdir->entry[0], root_len, + rootdir->crc) && firewire_debug) + device_printf(fwdev->fc->bdev, + "fw_parse_units: bad root directory CRC\n"); uindex = 0; for (ri = 0; ri < (int)root_len; ri++) { @@ -1844,6 +1853,10 @@ fw_parse_units(struct fw_device *fwdev) udir_len = udir->crc_len; if (udir_qoff + 1 + udir_len > rom_quads) continue; + if (!crom_crc_valid((uint32_t *)&udir->entry[0], udir_len, + udir->crc) && firewire_debug) + printf("fw_parse_units: bad CRC in unit dir at 0x%x\n", + udir_qoff); spec_id = 0; sw_version = 0; diff --git a/sys/dev/firewire/fwcam.c b/sys/dev/firewire/fwcam.c index b2381c4be3f9..72bf429f061a 100644 --- a/sys/dev/firewire/fwcam.c +++ b/sys/dev/firewire/fwcam.c @@ -98,6 +98,11 @@ fwcam_search_dir_cmd_base(uint32_t *csrrom, uint32_t dir_qoff, dir_len = dir->crc_len; if (dir_qoff + 1 + dir_len > rom_quads) return (0); + if (!crom_crc_valid((uint32_t *)&dir->entry[0], dir_len, dir->crc)) { + if (firewire_debug) + printf("fwcam: bad CRC in directory at 0x%x\n", + dir_qoff); + } for (i = 0; i < (int)dir_len; i++) { if (dir_qoff + 1 + i >= rom_quads) diff --git a/sys/dev/firewire/fwcrom.c b/sys/dev/firewire/fwcrom.c index 6e588b08a40f..ec88902e582e 100644 --- a/sys/dev/firewire/fwcrom.c +++ b/sys/dev/firewire/fwcrom.c @@ -237,6 +237,13 @@ crom_crc(uint32_t *ptr, int len) return ((uint16_t) crc); } +int +crom_crc_valid(uint32_t *data, int len, uint16_t expected) +{ + + return (crom_crc(data, len) == expected); +} + #if !defined(_KERNEL) && !defined(_BOOT) static void crom_desc_specver(uint32_t spec, uint32_t ver, char *buf, int len) diff --git a/sys/dev/firewire/fwisound.c b/sys/dev/firewire/fwisound.c index 63ebd5f01917..12a32fb25aab 100644 --- a/sys/dev/firewire/fwisound.c +++ b/sys/dev/firewire/fwisound.c @@ -123,6 +123,11 @@ fwisound_find_audio_base(struct fw_unit *unit) udir_len = udir->crc_len; if (udir_qoff + 1 + udir_len > rom_quads) return (0); + if (!crom_crc_valid((uint32_t *)&udir->entry[0], udir_len, udir->crc)) { + if (firewire_debug) + printf("fwisound: bad CRC in unit directory at 0x%x\n", + udir_qoff); + } for (i = 0; i < (int)udir_len; i++) { if (udir_qoff + 1 + i >= rom_quads) diff --git a/sys/dev/firewire/iec13213.h b/sys/dev/firewire/iec13213.h index 0f6ac5b35224..a0d57ab4781a 100644 --- a/sys/dev/firewire/iec13213.h +++ b/sys/dev/firewire/iec13213.h @@ -215,6 +215,7 @@ struct csrreg *crom_get(struct crom_context *); void crom_next(struct crom_context *); void crom_parse_text(struct crom_context *, char *, int); uint16_t crom_crc(uint32_t *r, int); +int crom_crc_valid(uint32_t *data, int len, uint16_t expected); struct csrreg *crom_search_key(struct crom_context *, uint8_t); int crom_has_specver(uint32_t *, uint32_t, uint32_t);
