From 65a9b9b2dee899d4033e8aad7425d9288208cadf Mon Sep 17 00:00:00 2001 From: Manuel Ebner Date: Fri, 12 Jun 2026 14:51:12 +0200 Subject: docs: ABI: testing: Fix typo Add missing ')'. Signed-off-by: Manuel Ebner Reviewed-by: Brian Norris Link: https://lore.kernel.org/r/20260612125111.187072-2-manuelebner@mailbox.org Signed-off-by: Tzung-Bi Shih --- Documentation/ABI/testing/sysfs-firmware-gsmi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Documentation/ABI/testing/sysfs-firmware-gsmi b/Documentation/ABI/testing/sysfs-firmware-gsmi index 7a558354c1ee..3b3c3ae6f458 100644 --- a/Documentation/ABI/testing/sysfs-firmware-gsmi +++ b/Documentation/ABI/testing/sysfs-firmware-gsmi @@ -19,7 +19,7 @@ Description: /sys/firmware/gsmi/vars: This directory has the same layout (and - underlying implementation as /sys/firmware/efi/vars. + underlying implementation) as /sys/firmware/efi/vars. See `Documentation/ABI/*/sysfs-firmware-efi-vars` for more information on how to interact with this structure. -- cgit v1.2.3 From e31ecda9e3af675bc05039f0791a34a46c27f253 Mon Sep 17 00:00:00 2001 From: Yidi Lin Date: Fri, 17 Jul 2026 08:41:26 +0000 Subject: firmware: coreboot: Skip no-map CBMEM entries On ARM64 platforms, certain reserved memory regions (like those used by pKVM) are marked with the 'no-map' property. This indicates that the host kernel is forbidden from creating a structural mapping for these regions. The coreboot table may describe CBMEM entries that overlap with or are entirely contained within these no-map regions. Attempting to populate these entries as devices and subsequently remapping them can lead to system crashes or security violations. Refine the coreboot table population logic to verify that each CBMEM entry resides in 'Known Good' memory before creating a device. An entry is only considered safe if it is entirely System RAM or entirely standard Reserved memory (tagged with IORES_DESC_RESERVED). This dual-check ensures that: 1. On ARM64, no-map regions are filtered out as they are IORESOURCE_MEM (see request_standard_resources() in arch/arm64/kernel/setup.c). 2. On x86, standard reserved regions (IORES_DESC_RESERVED) remain supported. Signed-off-by: Yidi Lin Signed-off-by: Hsin-Te Yuan Link: https://lore.kernel.org/r/20260717-coreboot-v2-1-8f8b389e3758@chromium.org Signed-off-by: Tzung-Bi Shih --- drivers/firmware/google/coreboot_table.c | 26 +++++++++++++++++++++++--- 1 file changed, 23 insertions(+), 3 deletions(-) diff --git a/drivers/firmware/google/coreboot_table.c b/drivers/firmware/google/coreboot_table.c index e63933ff6747..993056a739ad 100644 --- a/drivers/firmware/google/coreboot_table.c +++ b/drivers/firmware/google/coreboot_table.c @@ -13,8 +13,10 @@ #include #include #include +#include #include #include +#include #include #include #include @@ -123,7 +125,7 @@ static int coreboot_table_populate(struct device *dev, void *ptr, resource_size_ ptr_end = ptr + len; ptr_entry = ptr + header->header_bytes; - for (i = 0; i < header->table_entries; i++) { + for (i = 0; i < header->table_entries; i++, ptr_entry += entry->size) { if (ptr_entry + sizeof(*entry) > ptr_end) return -EINVAL; entry = ptr_entry; @@ -147,6 +149,26 @@ static int coreboot_table_populate(struct device *dev, void *ptr, resource_size_ switch (device->entry.tag) { case LB_TAG_CBMEM_ENTRY: + /* + * Skip entries that are not exclusively System RAM or + * Reserved memory. + * On ARM64, no-map regions are filtered out as they are + * IORESOURCE_MEM (see request_standard_resources() in + * arch/arm64/kernel/setup.c). + * On x86, CBMEM often resides in standard reserved regions + * (IORES_DESC_RESERVED). + */ + if (region_intersects(device->cbmem_entry.address, + device->cbmem_entry.entry_size, + IORESOURCE_SYSTEM_RAM, + IORES_DESC_NONE) != REGION_INTERSECTS && + region_intersects(device->cbmem_entry.address, + device->cbmem_entry.entry_size, + IORESOURCE_MEM, + IORES_DESC_RESERVED) != REGION_INTERSECTS) { + kfree(device); + continue; + } dev_set_name(&device->dev, "cbmem-%08x", device->cbmem_entry.id); break; @@ -155,8 +177,6 @@ static int coreboot_table_populate(struct device *dev, void *ptr, resource_size_ break; } - ptr_entry += entry->size; - ret = device_register(&device->dev); if (ret) { dev_warn(dev, "failed to register coreboot device: %d\n", ret); -- cgit v1.2.3 From a58a57a1076f8c5dae0327e3710899478c3be901 Mon Sep 17 00:00:00 2001 From: Laxman Acharya Padhya Date: Sat, 1 Aug 2026 22:41:51 +0545 Subject: firmware: coreboot: Validate table bounds The existing coreboot_table_populate() bounds checks limit individual entries to the mapped length. However, coreboot_table_probe() replaces the platform resource length with header and table sizes supplied by firmware before mapping the full table. A malformed table can overflow the 32-bit size addition or advertise an extent beyond the resource, causing the driver to map and parse memory outside the resource. A resource shorter than the fixed header is also mapped as though it contained a complete header. Reject resources shorter than the fixed header. After validating the signature, require a complete header, calculate the advertised extent with overflow checking, and reject extents beyond the resource before remapping the table. Fixes: d384d6f43d1e ("firmware: google memconsole: Add coreboot support") Signed-off-by: Laxman Acharya Padhya Link: https://lore.kernel.org/r/20260801165651.42172-1-acharyalaxman8848@gmail.com Signed-off-by: Tzung-Bi Shih --- drivers/firmware/google/coreboot_table.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/drivers/firmware/google/coreboot_table.c b/drivers/firmware/google/coreboot_table.c index 993056a739ad..25ee8cf53429 100644 --- a/drivers/firmware/google/coreboot_table.c +++ b/drivers/firmware/google/coreboot_table.c @@ -190,6 +190,7 @@ static int coreboot_table_populate(struct device *dev, void *ptr, resource_size_ static int coreboot_table_probe(struct platform_device *pdev) { resource_size_t len; + resource_size_t table_span; struct coreboot_table_header *header; struct resource *res; struct device *dev = &pdev->dev; @@ -201,7 +202,7 @@ static int coreboot_table_probe(struct platform_device *pdev) return -EINVAL; len = resource_size(res); - if (!res->start || !len) + if (!res->start || len < sizeof(*header)) return -EINVAL; /* Check just the header first to make sure things are sane */ @@ -209,19 +210,27 @@ static int coreboot_table_probe(struct platform_device *pdev) if (!header) return -ENOMEM; - len = header->header_bytes + header->table_bytes; ret = strncmp(header->signature, "LBIO", sizeof(header->signature)); + + if (!ret && + (header->header_bytes < sizeof(*header) || + check_add_overflow((resource_size_t)header->header_bytes, + (resource_size_t)header->table_bytes, + &table_span) || + table_span > len)) + ret = -EINVAL; + memunmap(header); if (ret) { dev_warn(dev, "coreboot table missing or corrupt!\n"); return -ENODEV; } - ptr = memremap(res->start, len, MEMREMAP_WB); + ptr = memremap(res->start, table_span, MEMREMAP_WB); if (!ptr) return -ENOMEM; - ret = coreboot_table_populate(dev, ptr, len); + ret = coreboot_table_populate(dev, ptr, table_span); memunmap(ptr); -- cgit v1.2.3