[coreboot-gerrit] Change in coreboot[master]: sb/intel/{bd82x6x, ibexpeak}: Fix out of bounds access in intel_me_sta...

[Nicola Corna (Code Review)]

Nicola Corna has uploaded this change for review. ( https://review.coreboot.org/26601


Change subject: sb/intel/{bd82x6x,ibexpeak}: Fix out of bounds access in intel_me_status()
......................................................................

sb/intel/{bd82x6x,ibexpeak}: Fix out of bounds access in intel_me_status()

On Ibex Peak (and maybe also on other platforms), when the AltMeDisable
bit is set (-S or -s option of me_cleaner), the ME PCI device disappears
from the bus and its configuration space is all ones.

This causes a freeze in intel_me_status(), as coreboot tries to access
an out of bounds array element.

Change-Id: I957abebe1db15ec2c9a2b439f0103106bfa56b33
Signed-off-by: Nicola Corna <nicola at corna.info>
---
M src/southbridge/intel/bd82x6x/me_status.c
1 file changed, 9 insertions(+), 0 deletions(-)



  git pull ssh://review.coreboot.org:29418/coreboot refs/changes/01/26601/1

diff --git a/src/southbridge/intel/bd82x6x/me_status.c b/src/southbridge/intel/bd82x6x/me_status.c
index b202376..4b353c8 100644
--- a/src/southbridge/intel/bd82x6x/me_status.c
+++ b/src/southbridge/intel/bd82x6x/me_status.c
@@ -142,6 +142,15 @@
 void intel_me_status(struct me_hfs *hfs, struct me_gmes *gmes)
 {
 #if (CONFIG_DEFAULT_CONSOLE_LOGLEVEL >= BIOS_DEBUG)
+	/* On Ibex Peak (and maybe also on other platforms), when Intel ME is
+	 * disabled by the AltMeDisable bit, the corresponding PCI device disappears
+	 * from the bus and its configuration space is all ones.
+	 */
+	if (*((u32 *)hfs) == 0xffffffff || *((u32 *)gmes) == 0xffffffff) {
+		printk(BIOS_DEBUG, "Missing Intel ME PCI device.\n");
+		return;
+	}
+
 	/* Check Current States */
 	printk(BIOS_DEBUG, "ME: FW Partition Table      : %s\n",
 	       hfs->fpt_bad ? "BAD" : "OK");

-- 
To view, visit https://review.coreboot.org/26601
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings

Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-MessageType: newchange
Gerrit-Change-Id: I957abebe1db15ec2c9a2b439f0103106bfa56b33
Gerrit-Change-Number: 26601
Gerrit-PatchSet: 1
Gerrit-Owner: Nicola Corna <nicola at corna.info>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.coreboot.org/pipermail/coreboot-gerrit/attachments/20180528/18305c47/attachment.html>