Michał Żygowski has submitted this change. ( https://review.coreboot.org/c/coreboot/+/59515 )
Change subject: security/intel/txt: Remove unused region device ......................................................................
security/intel/txt: Remove unused region device
Region device is no longer used to locate BIOS ACM. Use new CBFS API to map and unmap the file. Using rdev_munmap on the uninitialized region device variable causes the platform to jump to a random address.
TEST=Dell OptiPlex 9010 does not raise #UD exception when Intel TXT is enabled, ACM SCHECK is successful
Signed-off-by: Michał Żygowski michal.zygowski@3mdeb.com Change-Id: I98afba35403d5d2cd9eeb7df6d1ca0171894e9d4 Reviewed-on: https://review.coreboot.org/c/coreboot/+/59515 Tested-by: build bot (Jenkins) no-reply@coreboot.org Reviewed-by: Arthur Heymans arthur@aheymans.xyz Reviewed-by: Angel Pons th3fanbus@gmail.com Reviewed-by: Patrick Rudolph siro@das-labor.org --- M src/security/intel/txt/common.c 1 file changed, 6 insertions(+), 8 deletions(-)
Approvals: build bot (Jenkins): Verified Patrick Rudolph: Looks good to me, approved Arthur Heymans: Looks good to me, approved Angel Pons: Looks good to me, but someone else must approve
diff --git a/src/security/intel/txt/common.c b/src/security/intel/txt/common.c index 7e6c55c..accdf3c 100644 --- a/src/security/intel/txt/common.c +++ b/src/security/intel/txt/common.c @@ -230,11 +230,11 @@ * Prepare to run the BIOS ACM: mmap it from the CBFS and verify that it * can be launched. Returns pointer to ACM on success, NULL on failure. */ -static void *intel_txt_prepare_bios_acm(struct region_device *acm, size_t *acm_len) +static void *intel_txt_prepare_bios_acm(size_t *acm_len) { void *acm_data = NULL;
- if (!acm || !acm_len) + if (!acm_len) return NULL;
acm_data = cbfs_map(CONFIG_INTEL_TXT_CBFS_BIOS_ACM, acm_len); @@ -307,10 +307,9 @@ /* Returns on failure, resets the computer on success */ void intel_txt_run_sclean(void) { - struct region_device acm; size_t acm_len;
- void *acm_data = intel_txt_prepare_bios_acm(&acm, &acm_len); + void *acm_data = intel_txt_prepare_bios_acm(&acm_len);
if (!acm_data) return; @@ -338,7 +337,7 @@ */ printk(BIOS_CRIT, "TEE-TXT: getsec_sclean could not launch the BIOS ACM.\n");
- rdev_munmap(&acm, acm_data); + cbfs_unmap(acm_data); }
/* @@ -348,10 +347,9 @@ */ int intel_txt_run_bios_acm(const u8 input_params) { - struct region_device acm; size_t acm_len;
- void *acm_data = intel_txt_prepare_bios_acm(&acm, &acm_len); + void *acm_data = intel_txt_prepare_bios_acm(&acm_len);
if (!acm_data) return -1; @@ -359,7 +357,7 @@ /* Call into assembly which invokes the referenced ACM */ getsec_enteraccs(input_params, (uintptr_t)acm_data, acm_len);
- rdev_munmap(&acm, acm_data); + cbfs_unmap(acm_data);
const uint64_t acm_status = read64((void *)TXT_SPAD); if (acm_status & ACMERROR_TXT_VALID) {
5 is the latest approved patch-set. No files were changed between the latest approved patch-set and the submitted one.