Bug 233180 - Several errors in pmbr: 64-bits arithmetics and some others
Summary: Several errors in pmbr: 64-bits arithmetics and some others
Status: New
Alias: None
Product: Base System
Classification: Unclassified
Component: misc (show other bugs)
Version: 11.2-RELEASE
Hardware: Any Any
: --- Affects Some People
Assignee: Warner Losh
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2018-11-12 19:45 UTC by Emrion
Modified: 2019-01-10 18:52 UTC (History)
3 users (show)

See Also:


Attachments
pmbr source code patched (7.88 KB, text/plain)
2019-01-10 18:49 UTC, Emrion
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Emrion 2018-11-12 19:45:13 UTC
These issues have low impact because they require precise circumstances to trigger one of them. The disk must be > 2 TiB in size and either:
- The primary GPT header is dammaged.
- The freebsd-boot partiton is located farther than the first 2 TiB of the disc and one of its sectors takes place at a lba value that makes the higher 32 bits of this very value change.

Errors and corrections folow:


* Lines 117 - 118

main.3a:	decl (%si)			# 0x0(%si) = last sec (0-31)
		movw $2,%cx

Should be:
main.3a:	subl $1, (%si)			# 0x0(%si) = last sec (0-31)
		sbbl $0, 4(%si)
		movw $4,%cx

-> Copies only two 16-bits words but it's a 64-bits value. Moreover, decrements this 64-bit value without care for a possible carry.


* Line 131

movb $0x10,%cl
repe cmpsb

Should be:
movw $0x10,%cx
repe cmpsb

-> It's CX the counter for repe not CL. It works as is but it's dangerous to keep that.


* Lines 153 - 154

next_boot:	incl (%si)			# Next LBA
		adcl $0,4(%si)

Should be:
next_boot:	addl $1, (%si)			# Next LBA
		adcl $0,4(%si)

-> inc instruction doesn't affect the carry flag.


* Lines 174 - 175

incl GPT_ADDR+GPT_PART_LBA	# Next sector
adcl $0,GPT_ADDR+GPT_PART_LBA+4

Should be:
addl $1, GPT_ADDR+GPT_PART_LBA.
adcl $0,GPT_ADDR+GPT_PART_LBA+4

-> Same as before.
Comment 1 Emrion 2019-01-10 18:49:46 UTC
Created attachment 200996 [details]
pmbr source code patched
Comment 2 Emrion 2019-01-10 18:52:13 UTC
For your information, I compiled the code corrected as indicated above and installed it on a 12.0-RELEASE. It works.

However, I can't test the cases where the original pmbr would crash as I don't have a disk > 2 TiB.