firewire: add warn-only CRC validation for CSR ROM directories

Implemented crom_crc_valid() helper to validate IEEE 1394 config ROM CRC-16
checksums.

Skipped root header CRC validation since csrhdr.crc_len cover the entire
ROM body which is not fully read at header parse time. Per-directory
CRC checks below catch corruption where it needed.

Reviewed by:	adrian
Differential Revision:	https://reviews.freebsd.org/D58307

5 files changed, 32 insertions, 1 deletions

diff --git a/sys/dev/firewire/firewire.c b/sys/dev/firewire/firewire.c
index 3d41b4691276..d3808f5c8e62 100644
--- a/sys/dev/firewire/firewire.c
+++ b/sys/dev/firewire/firewire.c
@@ -1519,7 +1519,11 @@ fw_explore_csrblock(struct fw_device *fwdev, int offset, int recur)
 	if (err)
 		return (-1);
 
-	/* TODO: validate directory CRC */
+	if (!crom_crc_valid((uint32_t *)reg, dir->crc_len, dir->crc)) {
+		if (firewire_debug)
+			printf("%s: bad CRC in directory at 0x%x\n",
+			    __func__, offset - (int)sizeof(uint32_t));
+	}
 
 	off = CSRROMOFF + offset + sizeof(uint32_t) * (dir->crc_len - 1);
 	if (fwdev->rommax < off)
@@ -1586,6 +1590,7 @@ fw_explore_node(struct fw_device *dfwdev)
 		return (-1);
 	}
 	binfo = (struct bus_info *)&csr[1];
+	/* Root header CRC spans entire ROM; validated per-directory below. */
 	if (binfo->bus_name != CSR_BUS_NAME_IEEE1394) {
 		dfwdev->status = FWDEVINVAL;
 		return (-1);
@@ -1828,6 +1833,10 @@ fw_parse_units(struct fw_device *fwdev)
 	root_len = rootdir->crc_len;
 	if (root_off + 1 + root_len > rom_quads)
 		return;
+	if (!crom_crc_valid((uint32_t *)&rootdir->entry[0], root_len,
+	    rootdir->crc) && firewire_debug)
+		device_printf(fwdev->fc->bdev,
+		    "fw_parse_units: bad root directory CRC\n");
 
 	uindex = 0;
 	for (ri = 0; ri < (int)root_len; ri++) {
@@ -1844,6 +1853,10 @@ fw_parse_units(struct fw_device *fwdev)
 		udir_len = udir->crc_len;
 		if (udir_qoff + 1 + udir_len > rom_quads)
 			continue;
+		if (!crom_crc_valid((uint32_t *)&udir->entry[0], udir_len,
+		    udir->crc) && firewire_debug)
+			printf("fw_parse_units: bad CRC in unit dir at 0x%x\n",
+			    udir_qoff);
 
 		spec_id = 0;
 		sw_version = 0;
diff --git a/sys/dev/firewire/fwcam.c b/sys/dev/firewire/fwcam.c
index b2381c4be3f9..72bf429f061a 100644
--- a/sys/dev/firewire/fwcam.c
+++ b/sys/dev/firewire/fwcam.c
@@ -98,6 +98,11 @@ fwcam_search_dir_cmd_base(uint32_t *csrrom, uint32_t dir_qoff,
 	dir_len = dir->crc_len;
 	if (dir_qoff + 1 + dir_len > rom_quads)
 		return (0);
+	if (!crom_crc_valid((uint32_t *)&dir->entry[0], dir_len, dir->crc)) {
+		if (firewire_debug)
+			printf("fwcam: bad CRC in directory at 0x%x\n",
+			    dir_qoff);
+	}
 
 	for (i = 0; i < (int)dir_len; i++) {
 		if (dir_qoff + 1 + i >= rom_quads)
diff --git a/sys/dev/firewire/fwcrom.c b/sys/dev/firewire/fwcrom.c
index 6e588b08a40f..ec88902e582e 100644
--- a/sys/dev/firewire/fwcrom.c
+++ b/sys/dev/firewire/fwcrom.c
@@ -237,6 +237,13 @@ crom_crc(uint32_t *ptr, int len)
 	return ((uint16_t) crc);
 }
 
+int
+crom_crc_valid(uint32_t *data, int len, uint16_t expected)
+{
+
+	return (crom_crc(data, len) == expected);
+}
+
 #if !defined(_KERNEL) && !defined(_BOOT)
 static void
 crom_desc_specver(uint32_t spec, uint32_t ver, char *buf, int len)
diff --git a/sys/dev/firewire/fwisound.c b/sys/dev/firewire/fwisound.c
index 63ebd5f01917..12a32fb25aab 100644
--- a/sys/dev/firewire/fwisound.c
+++ b/sys/dev/firewire/fwisound.c
@@ -123,6 +123,11 @@ fwisound_find_audio_base(struct fw_unit *unit)
 	udir_len = udir->crc_len;
 	if (udir_qoff + 1 + udir_len > rom_quads)
 		return (0);
+	if (!crom_crc_valid((uint32_t *)&udir->entry[0], udir_len, udir->crc)) {
+		if (firewire_debug)
+			printf("fwisound: bad CRC in unit directory at 0x%x\n",
+			    udir_qoff);
+	}
 
 	for (i = 0; i < (int)udir_len; i++) {
 		if (udir_qoff + 1 + i >= rom_quads)
diff --git a/sys/dev/firewire/iec13213.h b/sys/dev/firewire/iec13213.h
index 0f6ac5b35224..a0d57ab4781a 100644
--- a/sys/dev/firewire/iec13213.h
+++ b/sys/dev/firewire/iec13213.h
@@ -215,6 +215,7 @@ struct csrreg *crom_get(struct crom_context *);
 void crom_next(struct crom_context *);
 void crom_parse_text(struct crom_context *, char *, int);
 uint16_t crom_crc(uint32_t *r, int);
+int crom_crc_valid(uint32_t *data, int len, uint16_t expected);
 struct csrreg *crom_search_key(struct crom_context *, uint8_t);
 int crom_has_specver(uint32_t *, uint32_t, uint32_t);