<feed xmlns='http://www.w3.org/2005/Atom'>
<title>kernel/linux.git/drivers/firmware/google/memconsole-coreboot.c, branch v6.6.134</title>
<subtitle>Linux kernel stable tree (mirror)</subtitle>
<id>https://git.radix-linux.su/kernel/linux.git/atom?h=v6.6.134</id>
<link rel='self' href='https://git.radix-linux.su/kernel/linux.git/atom?h=v6.6.134'/>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/'/>
<updated>2021-02-09T11:12:43+00:00</updated>
<entry>
<title>firmware: google: make coreboot driver's remove callback return void</title>
<updated>2021-02-09T11:12:43+00:00</updated>
<author>
<name>Uwe Kleine-König</name>
<email>uwe@kleine-koenig.org</email>
</author>
<published>2021-01-26T21:53:39+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=5f6805327982d1fd45355730e9d1adda616b995b'/>
<id>urn:sha1:5f6805327982d1fd45355730e9d1adda616b995b</id>
<content type='text'>
All coreboot drivers return 0 unconditionally in their remove callback.
Also the device core ignores the return value of the struct
bus_type::remove(), so make the coreboot remove callback return void
instead of giving driver authors the illusion they could return an error
code here.

All drivers are adapted accordingly.

Signed-off-by: Uwe Kleine-König &lt;uwe@kleine-koenig.org&gt;
Link: https://lore.kernel.org/r/20210126215339.706021-1-uwe@kleine-koenig.org
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
</entry>
<entry>
<title>firmware: google: memconsole: Replace zero-length array with flexible-array member</title>
<updated>2020-06-16T04:08:16+00:00</updated>
<author>
<name>Gustavo A. R. Silva</name>
<email>gustavo@embeddedor.com</email>
</author>
<published>2020-02-21T15:30:21+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=ea9ee9976750b3d047141ebeb12ba92b634dfbef'/>
<id>urn:sha1:ea9ee9976750b3d047141ebeb12ba92b634dfbef</id>
<content type='text'>
There is a regular need in the kernel to provide a way to declare having a
dynamically sized set of trailing elements in a structure. Kernel code should
always use “flexible array members”[1] for these cases. The older style of
one-element or zero-length arrays should no longer be used[2].

[1] https://en.wikipedia.org/wiki/Flexible_array_member
[2] https://github.com/KSPP/linux/issues/21

Signed-off-by: Gustavo A. R. Silva &lt;gustavo@embeddedor.com&gt;
</content>
</entry>
<entry>
<title>Merge 5.2-rc4 into char-misc-next</title>
<updated>2019-06-09T07:11:21+00:00</updated>
<author>
<name>Greg Kroah-Hartman</name>
<email>gregkh@linuxfoundation.org</email>
</author>
<published>2019-06-09T07:11:21+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=0154ec71d597692a0d0682b19eac4b3adfb7f3dc'/>
<id>urn:sha1:0154ec71d597692a0d0682b19eac4b3adfb7f3dc</id>
<content type='text'>
We want the char/misc driver fixes in here as well.

Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
</entry>
<entry>
<title>treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 287</title>
<updated>2019-06-05T15:36:37+00:00</updated>
<author>
<name>Thomas Gleixner</name>
<email>tglx@linutronix.de</email>
</author>
<published>2019-05-29T14:18:01+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=d95236782b8d6535d5a9f3fce15af8e29c195b34'/>
<id>urn:sha1:d95236782b8d6535d5a9f3fce15af8e29c195b34</id>
<content type='text'>
Based on 1 normalized pattern(s):

  this program is free software you can redistribute it and or modify
  it under the terms of the gnu general public license v2 0 as
  published by the free software foundation this program is
  distributed in the hope that it will be useful but without any
  warranty without even the implied warranty of merchantability or
  fitness for a particular purpose see the gnu general public license
  for more details

extracted by the scancode license scanner the SPDX license identifier

  GPL-2.0-only

has been chosen to replace the boilerplate/reference in 23 file(s).

Signed-off-by: Thomas Gleixner &lt;tglx@linutronix.de&gt;
Reviewed-by: Alexios Zavras &lt;alexios.zavras@intel.com&gt;
Reviewed-by: Allison Randal &lt;allison@lohutok.net&gt;
Cc: linux-spdx@vger.kernel.org
Link: https://lkml.kernel.org/r/20190529141901.115786599@linutronix.de
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
</entry>
<entry>
<title>firmware: google: coreboot: Drop unnecessary headers</title>
<updated>2019-05-24T18:55:04+00:00</updated>
<author>
<name>Stephen Boyd</name>
<email>swboyd@chromium.org</email>
</author>
<published>2019-05-10T18:01:51+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=381e9760ee87ba53df882c4affadfcc07bdf3bc2'/>
<id>urn:sha1:381e9760ee87ba53df882c4affadfcc07bdf3bc2</id>
<content type='text'>
These headers aren't used by the files they're included in, so drop
them. The memconsole file uses memremap() though, so include io.h there
so that the include is explicit.

Cc: Wei-Ning Huang &lt;wnhuang@chromium.org&gt;
Cc: Julius Werner &lt;jwerner@chromium.org&gt;
Cc: Brian Norris &lt;briannorris@chromium.org&gt;
Cc: Samuel Holland &lt;samuel@sholland.org&gt;
Cc: Guenter Roeck &lt;groeck@chromium.org&gt;
Signed-off-by: Stephen Boyd &lt;swboyd@chromium.org&gt;
Reviewed-by: Julius Werner &lt;jwerner@chromium.org&gt;
Reviewed-by: Samuel Holland &lt;samuel@sholland.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
</entry>
<entry>
<title>firmware: google: memconsole: Drop __iomem on memremap memory</title>
<updated>2019-05-24T18:55:04+00:00</updated>
<author>
<name>Stephen Boyd</name>
<email>swboyd@chromium.org</email>
</author>
<published>2019-05-10T18:01:49+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=e07f100993c6d411c4886ba37b2047322e302917'/>
<id>urn:sha1:e07f100993c6d411c4886ba37b2047322e302917</id>
<content type='text'>
memremap() doesn't return __iomem marked memory, so drop the marking
here. This makes static analysis tools like sparse happy again.

Cc: Wei-Ning Huang &lt;wnhuang@chromium.org&gt;
Cc: Julius Werner &lt;jwerner@chromium.org&gt;
Cc: Brian Norris &lt;briannorris@chromium.org&gt;
Cc: Samuel Holland &lt;samuel@sholland.org&gt;
Cc: Guenter Roeck &lt;groeck@chromium.org&gt;
Signed-off-by: Stephen Boyd &lt;swboyd@chromium.org&gt;
Reviewed-by: Julius Werner &lt;jwerner@chromium.org&gt;
Reviewed-by: Samuel Holland &lt;samuel@sholland.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
</entry>
<entry>
<title>firmware: google: memconsole: Use devm_memremap()</title>
<updated>2019-05-24T18:55:04+00:00</updated>
<author>
<name>Stephen Boyd</name>
<email>swboyd@chromium.org</email>
</author>
<published>2019-05-10T21:24:53+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=b0503584a82814c05951b792d0177e052da2db6f'/>
<id>urn:sha1:b0503584a82814c05951b792d0177e052da2db6f</id>
<content type='text'>
Use the devm version of memremap so that we can delete the unmapping
code in driver remove, but more importantly so that we can unmap this
memory region if memconsole_sysfs_init() errors out for some reason.

Cc: Wei-Ning Huang &lt;wnhuang@chromium.org&gt;
Cc: Julius Werner &lt;jwerner@chromium.org&gt;
Cc: Brian Norris &lt;briannorris@chromium.org&gt;
Cc: Samuel Holland &lt;samuel@sholland.org&gt;
Cc: Guenter Roeck &lt;groeck@chromium.org&gt;
Signed-off-by: Stephen Boyd &lt;swboyd@chromium.org&gt;
Reviewed-by: Julius Werner &lt;jwerner@chromium.org&gt;
Reviewed-by: Samuel Holland &lt;samuel@sholland.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
</entry>
<entry>
<title>firmware: google: Add a module_coreboot_driver() macro and use it</title>
<updated>2019-05-24T18:55:04+00:00</updated>
<author>
<name>Stephen Boyd</name>
<email>swboyd@chromium.org</email>
</author>
<published>2019-05-10T18:01:47+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=354635039d935dba16ba35054b27dd6671fd3d14'/>
<id>urn:sha1:354635039d935dba16ba35054b27dd6671fd3d14</id>
<content type='text'>
Remove some boiler plate code we have in three drivers with a single
line each time. This also gets us a free assignment of the driver .owner
field, making these drivers work better as modules.

Cc: Wei-Ning Huang &lt;wnhuang@chromium.org&gt;
Cc: Julius Werner &lt;jwerner@chromium.org&gt;
Cc: Brian Norris &lt;briannorris@chromium.org&gt;
Cc: Samuel Holland &lt;samuel@sholland.org&gt;
Cc: Guenter Roeck &lt;groeck@chromium.org&gt;
Signed-off-by: Stephen Boyd &lt;swboyd@chromium.org&gt;
Reviewed-by: Julius Werner &lt;jwerner@chromium.org&gt;
Reviewed-by: Samuel Holland &lt;samuel@sholland.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
</entry>
<entry>
<title>firmware: memconsole: Probe via coreboot bus</title>
<updated>2018-04-23T11:37:19+00:00</updated>
<author>
<name>Samuel Holland</name>
<email>samuel@sholland.org</email>
</author>
<published>2018-01-25T01:41:17+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=294b2a9087666e31307a7a6c8da62b14442a6ef2'/>
<id>urn:sha1:294b2a9087666e31307a7a6c8da62b14442a6ef2</id>
<content type='text'>
Remove the ad-hoc coreboot table search. Now the driver will only be
probed when the necessary coreboot table entry has already been found.

Signed-off-by: Samuel Holland &lt;samuel@sholland.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
</entry>
<entry>
<title>firmware: google: memconsole: Prevent overrun attack on coreboot console</title>
<updated>2017-05-25T13:35:19+00:00</updated>
<author>
<name>Julius Werner</name>
<email>jwerner@chromium.org</email>
</author>
<published>2017-05-23T23:48:17+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=40fbb23881291bb57e4e25e859de8e2287426dac'/>
<id>urn:sha1:40fbb23881291bb57e4e25e859de8e2287426dac</id>
<content type='text'>
The recent coreboot memory console update (firmware: google: memconsole:
Adapt to new coreboot ring buffer format) introduced a small security
issue in the driver: The new driver implementation parses the memory
console structure again on every access. This is intentional so that
additional lines added concurrently by runtime firmware can be read out.

However, if an attacker can write to the structure, they could increase
the size value to a point where the driver would read potentially
sensitive memory areas from outside the original console buffer during
the next access. This can be done through /dev/mem, since the console
buffer usually resides in firmware-reserved memory that is not covered
by STRICT_DEVMEM.

This patch resolves that problem by reading the buffer's size value only
once during boot (where we can still trust the structure). Other parts
of the structure can still be modified at runtime, but the driver's
bounds checks make sure that it will never read outside the buffer.

Fixes: a5061d028 ("firmware: google: memconsole: Adapt to new coreboot ring buffer format")
Signed-off-by: Julius Werner &lt;jwerner@chromium.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
</entry>
</feed>
