| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <20230914064922.3986-1-zajec5@gmail.com>
Date: Thu, 14 Sep 2023 08:49:22 +0200
From: Rafał Miłecki <zajec5@...il.com>
To: Srinivas Kandagatla <srinivas.kandagatla@...aro.org>
Cc: linux-mtd@...ts.infradead.org,
linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org,
Rafał Miłecki <rafal@...ecki.pl>,
Arınç ÜNAL <arinc.unal@...nc9.com>,
Florian Fainelli <florian.fainelli@...adcom.com>,
Scott Branden <scott.branden@...adcom.com>
Subject: [PATCH] nvmem: brcm_nvram: store a copy of NVRAM content
From: Rafał Miłecki <rafal@...ecki.pl>
This driver uses MMIO access for reading NVRAM from a flash device.
Underneath there is a flash controller that reads data and provides
mapping window.
Using MMIO interface affects controller configuration and may break real
controller driver. It was reported by multiple users of devices with
NVRAM stored on NAND.
Modify driver to read & cache all NVRAM content during init and use that
copy to provide NVMEM data when requested.
Link: https://lore.kernel.org/linux-mtd/CACna6rwf3_9QVjYcM+847biTX=K0EoWXuXcSMkJO1Vy_5vmVqA@mail.gmail.com/
Cc: Arınç ÜNAL <arinc.unal@...nc9.com>
Cc: Florian Fainelli <florian.fainelli@...adcom.com>
Cc: Scott Branden <scott.branden@...adcom.com>
Signed-off-by: Rafał Miłecki <rafal@...ecki.pl>
---
drivers/nvmem/brcm_nvram.c | 77 +++++++++++++++++++++-----------------
1 file changed, 43 insertions(+), 34 deletions(-)
diff --git a/drivers/nvmem/brcm_nvram.c b/drivers/nvmem/brcm_nvram.c
index 9737104f3b76..cfc1c485e20a 100644
--- a/drivers/nvmem/brcm_nvram.c
+++ b/drivers/nvmem/brcm_nvram.c
@@ -19,7 +19,8 @@
struct brcm_nvram {
struct device *dev;
- void __iomem *base;
+ uint8_t *data;
+ size_t size;
struct nvmem_cell_info *cells;
int ncells;
};
@@ -36,10 +37,8 @@ static int brcm_nvram_read(void *context, unsigned int offset, void *val,
size_t bytes)
{
struct brcm_nvram *priv = context;
- u8 *dst = val;
- while (bytes--)
- *dst++ = readb(priv->base + offset++);
+ memcpy(val, priv->data + offset, bytes);
return 0;
}
@@ -68,7 +67,12 @@ static int brcm_nvram_add_cells(struct brcm_nvram *priv, uint8_t *data,
{
struct device *dev = priv->dev;
char *var, *value, *eq;
+ uint8_t tmp;
int idx;
+ int err = 0;
+
+ tmp = priv->data[len - 1];
+ priv->data[len - 1] = '\0';
priv->ncells = 0;
for (var = data + sizeof(struct brcm_nvram_header);
@@ -78,8 +82,10 @@ static int brcm_nvram_add_cells(struct brcm_nvram *priv, uint8_t *data,
}
priv->cells = devm_kcalloc(dev, priv->ncells, sizeof(*priv->cells), GFP_KERNEL);
- if (!priv->cells)
- return -ENOMEM;
+ if (!priv->cells) {
+ err = -ENOMEM;
+ goto out;
+ }
for (var = data + sizeof(struct brcm_nvram_header), idx = 0;
var < (char *)data + len && *var;
@@ -91,8 +97,10 @@ static int brcm_nvram_add_cells(struct brcm_nvram *priv, uint8_t *data,
value = eq + 1;
priv->cells[idx].name = devm_kstrdup(dev, var, GFP_KERNEL);
- if (!priv->cells[idx].name)
- return -ENOMEM;
+ if (!priv->cells[idx].name) {
+ err = -ENOMEM;
+ goto out;
+ }
priv->cells[idx].offset = value - (char *)data;
priv->cells[idx].bytes = strlen(value);
priv->cells[idx].np = of_get_child_by_name(dev->of_node, priv->cells[idx].name);
@@ -105,40 +113,32 @@ static int brcm_nvram_add_cells(struct brcm_nvram *priv, uint8_t *data,
}
}
- return 0;
+out:
+ priv->data[len - 1] = tmp;
+ return err;
}
static int brcm_nvram_parse(struct brcm_nvram *priv)
{
+ struct brcm_nvram_header *header = (struct brcm_nvram_header *)priv->data;
struct device *dev = priv->dev;
- struct brcm_nvram_header header;
- uint8_t *data;
size_t len;
int err;
- memcpy_fromio(&header, priv->base, sizeof(header));
-
- if (memcmp(header.magic, NVRAM_MAGIC, 4)) {
+ if (memcmp(header->magic, NVRAM_MAGIC, 4)) {
dev_err(dev, "Invalid NVRAM magic\n");
return -EINVAL;
}
- len = le32_to_cpu(header.len);
-
- data = kzalloc(len, GFP_KERNEL);
- if (!data)
- return -ENOMEM;
-
- memcpy_fromio(data, priv->base, len);
- data[len - 1] = '\0';
-
- err = brcm_nvram_add_cells(priv, data, len);
- if (err) {
- dev_err(dev, "Failed to add cells: %d\n", err);
- return err;
+ len = le32_to_cpu(header->len);
+ if (len > priv->size) {
+ dev_err(dev, "NVRAM length (%zd) exceeds mapped size (%zd)\n", len, priv->size);
+ return -EINVAL;
}
- kfree(data);
+ err = brcm_nvram_add_cells(priv, priv->data, len);
+ if (err)
+ dev_err(dev, "Failed to add cells: %d\n", err);
return 0;
}
@@ -150,8 +150,9 @@ static int brcm_nvram_probe(struct platform_device *pdev)
.reg_read = brcm_nvram_read,
};
struct device *dev = &pdev->dev;
- struct resource *res;
struct brcm_nvram *priv;
+ struct resource *res;
+ void __iomem *base;
int err;
priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
@@ -159,21 +160,29 @@ static int brcm_nvram_probe(struct platform_device *pdev)
return -ENOMEM;
priv->dev = dev;
- priv->base = devm_platform_get_and_ioremap_resource(pdev, 0, &res);
- if (IS_ERR(priv->base))
- return PTR_ERR(priv->base);
+ base = devm_platform_get_and_ioremap_resource(pdev, 0, &res);
+ if (IS_ERR(base))
+ return PTR_ERR(base);
+
+ priv->size = resource_size(res);
+
+ priv->data = devm_kzalloc(dev, priv->size, GFP_KERNEL);
+ if (!priv->data)
+ return -ENOMEM;
+
+ memcpy_fromio(priv->data, base, priv->size);
err = brcm_nvram_parse(priv);
if (err)
return err;
- bcm47xx_nvram_init_from_iomem(priv->base, resource_size(res));
+ bcm47xx_nvram_init_from_iomem(base, priv->size);
config.dev = dev;
config.cells = priv->cells;
config.ncells = priv->ncells;
config.priv = priv;
- config.size = resource_size(res);
+ config.size = priv->size;
return PTR_ERR_OR_ZERO(devm_nvmem_register(dev, &config));
}
--
2.35.3
Powered by blists - more mailing lists