Nyaaori/rockbox
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

fiiom3k: trim OF kernel arguments to fix boot hangs

Browse source 
The M3K's kernel has an incredibly stupid function that mangles the
kernel args and copies them to a 100-byte buffer without any kind of
bounds checking. So, if the kernel arguments are more than 99 chars
the stack may be corrupted, sometimes crashing the kernel.

Fortunately, most of the arguments the OF uses are useless, and the
truly necessary arguments fit within the absurd 99-char limit.

Change-Id: I01ef4513298f79d3c08538239802c21e88509631
This commit is contained in:
Aidan MacDonald 2022-03-16 22:22:01 +00:00
parent 6a6c6083fa
commit f7a341555d
1 changed files with 8 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
bootloader/x1000/x1000bootloader.h
View file

@ -44,13 +44,19 @@ struct uimage_header;
# define OF_PLAYER_NAME "FiiO player"
# define OF_PLAYER_ADDR 0x20000
# define OF_PLAYER_LENGTH (4 * 1024 * 1024)
/* WARNING: The length of kernel arguments cannot exceed 99 bytes on the M3K
* due to an Ingenic kernel bug: plat_mem_setup() calls ddr_param_change() and
* that function tries to copy the command line to an 100-char buffer without
* any bounds checking. Overflowing the buffer typically leads to disaster.
* It seems ddr_param_change() is not present on all Ingenic kernels and the
* bug may not affect the Q1. */
# define OF_PLAYER_ARGS OF_RECOVERY_ARGS \
" init=/linuxrc ubi.mtd=3 root=ubi0:rootfs ubi.mtd=4 rootfstype=ubifs rw loglevel=8"
" init=/linuxrc ubi.mtd=3 root=ubi0:rootfs ubi.mtd=4 rootfstype=ubifs rw"
# define OF_RECOVERY_NAME "FiiO recovery"
# define OF_RECOVERY_ADDR 0x420000
# define OF_RECOVERY_LENGTH (5 * 1024 * 1024)
# define OF_RECOVERY_ARGS \
"mem=64M@0x0 no_console_suspend console=ttyS2,115200n8 lpj=5009408 ip=off"
"mem=64M console=ttyS2"
#elif defined(SHANLING_Q1)
# define BL_RECOVERY BUTTON_NEXT
# define BL_UP BUTTON_PREV