Subrata Banik has uploaded this change for review. ( https://review.coreboot.org/22870
Change subject: soc/intel/cannonlake: Add SoC API to make use SMM common code
......................................................................
soc/intel/cannonlake: Add SoC API to make use SMM common code
Add SoC API to detect any illegal access to write into the
BIOS located in the FWH.
Change-Id: If526cbae9afee47fa272bdf74e04416aff100e88
Signed-off-by: Subrata Banik <subrata.banik(a)intel.com>
---
M src/soc/intel/cannonlake/cpu.c
M src/soc/intel/cannonlake/pmc.c
M src/soc/intel/cannonlake/smihandler.c
3 files changed, 32 insertions(+), 2 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/70/22870/1
diff --git a/src/soc/intel/cannonlake/cpu.c b/src/soc/intel/cannonlake/cpu.c
index 2dffccb..728ab9c 100644
--- a/src/soc/intel/cannonlake/cpu.c
+++ b/src/soc/intel/cannonlake/cpu.c
@@ -26,6 +26,7 @@
#include <soc/cpu.h>
#include <soc/msr.h>
#include <soc/pci_devs.h>
+#include <soc/pm.h>
#include <soc/smm.h>
static void soc_fsp_load(void)
@@ -216,7 +217,7 @@
* Now that all APs have been relocated as well as the BSP let SMIs
* start flowing.
*/
- smm_southbridge_enable();
+ smm_southbridge_enable(PWRBTN_EN | GBL_EN);
/* Lock down the SMRAM space. */
smm_lock();
diff --git a/src/soc/intel/cannonlake/pmc.c b/src/soc/intel/cannonlake/pmc.c
index a6ad0ad..92f45a8 100644
--- a/src/soc/intel/cannonlake/pmc.c
+++ b/src/soc/intel/cannonlake/pmc.c
@@ -51,7 +51,7 @@
* Set PMC register to know which state system should be after
* power reapplied
*/
-void pmc_soc_restore_power_failiure(void)
+void pmc_soc_restore_power_failure(void)
{
pmc_set_afterg3(CONFIG_MAINBOARD_POWER_ON_AFTER_POWER_FAIL);
}
diff --git a/src/soc/intel/cannonlake/smihandler.c b/src/soc/intel/cannonlake/smihandler.c
index 0653e9f..6c5e923 100644
--- a/src/soc/intel/cannonlake/smihandler.c
+++ b/src/soc/intel/cannonlake/smihandler.c
@@ -15,6 +15,8 @@
* GNU General Public License for more details.
*/
+#include <console/console.h>
+#include <intelblocks/fast_spi.h>
#include <intelblocks/smihandler.h>
#include <soc/pm.h>
@@ -23,6 +25,33 @@
return &em64t101_smm_ops;
}
+void smihandler_check_illegal_access(uint32_t tco_sts)
+{
+ if (tco_sts & (1 << 8)) { /* BIOSWR */
+ if (IS_ENABLED(CONFIG_SPI_FLASH_SMM)) {
+ if (fast_spi_wpd_status()) {
+ /*
+ * BWE is RW, so the SMI was caused by a
+ * write to BWE, not by a write to the BIOS
+ *
+ * This is the place where we notice someone
+ * is trying to tinker with the BIOS. We are
+ * trying to be nice and just ignore it. A more
+ * resolute answer would be to power down the
+ * box.
+ */
+ printk(BIOS_DEBUG, "Switching back to RO\n");
+ fast_spi_enable_wp();
+ } /* No else for now? */
+ }
+ }
+}
+
+/* SMI handlers that should be serviced in SCI mode too. */
+uint32_t smi_handler_sci_mask =
+ SMI_HANDLER_SCI_EN(APM_STS_BIT) |
+ SMI_HANDLER_SCI_EN(SMI_ON_SLP_EN_STS_BIT);
+
const smi_handler_t southbridge_smi[SMI_STS_BITS] = {
[SMI_ON_SLP_EN_STS_BIT] = smihandler_southbridge_sleep,
[APM_STS_BIT] = smihandler_southbridge_apmc,
--
To view, visit https://review.coreboot.org/22870
To unsubscribe, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-MessageType: newchange
Gerrit-Change-Id: If526cbae9afee47fa272bdf74e04416aff100e88
Gerrit-Change-Number: 22870
Gerrit-PatchSet: 1
Gerrit-Owner: Subrata Banik <subrata.banik(a)intel.com>
Subrata Banik has uploaded this change for review. ( https://review.coreboot.org/22869
Change subject: soc/intel/common: Add missing SoC common function into SMM library
......................................................................
soc/intel/common: Add missing SoC common function into SMM library
Modify SMM common code in order to accommodate Skylake SOC code.
Change-Id: Ie9f90df3336c1278b73284815b5197400512c1d2
Signed-off-by: Subrata Banik <subrata.banik(a)intel.com>
---
M src/soc/intel/common/block/include/intelblocks/smihandler.h
M src/soc/intel/common/block/include/intelblocks/smm.h
M src/soc/intel/common/block/smm/smihandler.c
M src/soc/intel/common/block/smm/smm.c
4 files changed, 45 insertions(+), 6 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/69/22869/1
diff --git a/src/soc/intel/common/block/include/intelblocks/smihandler.h b/src/soc/intel/common/block/include/intelblocks/smihandler.h
index 5df5552..cab8a1e 100644
--- a/src/soc/intel/common/block/include/intelblocks/smihandler.h
+++ b/src/soc/intel/common/block/include/intelblocks/smihandler.h
@@ -60,6 +60,11 @@
*/
extern const smi_handler_t southbridge_smi[32];
+#define SMI_HANDLER_SCI_EN(__bit) (1 << (__bit))
+
+/* SMI handlers that should be serviced in SCI mode too. */
+extern uint32_t smi_handler_sci_mask;
+
/*
* This function should be implemented in SOC specific code to handle
* the SMI event on SLP_EN. The default functionality is provided in
@@ -145,6 +150,12 @@
int smihandler_disable_busmaster(device_t dev);
/*
+ * SoC needs to implement the mechanism to know if an illegal attempt
+ * has been made to write to the BIOS area.
+ */
+void smihandler_check_illegal_access(uint32_t tco_sts);
+
+/*
* Returns gnvs pointer within SMM context
*/
struct global_nvs_t *smm_get_gnvs(void);
diff --git a/src/soc/intel/common/block/include/intelblocks/smm.h b/src/soc/intel/common/block/include/intelblocks/smm.h
index 84f34a5..54f9005 100644
--- a/src/soc/intel/common/block/include/intelblocks/smm.h
+++ b/src/soc/intel/common/block/include/intelblocks/smm.h
@@ -29,7 +29,7 @@
* SMIs.
*/
void smm_southbridge_clear_state(void);
-void smm_southbridge_enable(void);
+void smm_southbridge_enable(uint16_t events);
/* API to get SMM region start and size based on Host Bridge register */
void smm_region_info(void **start, size_t *size);
diff --git a/src/soc/intel/common/block/smm/smihandler.c b/src/soc/intel/common/block/smm/smihandler.c
index 7821dba..c01ed4f 100644
--- a/src/soc/intel/common/block/smm/smihandler.c
+++ b/src/soc/intel/common/block/smm/smihandler.c
@@ -21,6 +21,7 @@
#include <cpu/x86/smm.h>
#include <device/pci_def.h>
#include <elog.h>
+#include <intelblocks/fast_spi.h>
#include <intelblocks/pmclib.h>
#include <intelblocks/smihandler.h>
#include <intelblocks/uart.h>
@@ -38,6 +39,15 @@
__attribute__((weak)) int smihandler_disable_busmaster(device_t dev)
{
return 1;
+}
+
+/*
+ * SoC needs to implement the mechanism to know if an illegal attempt
+ * has been made to write to the BIOS area.
+ */
+__attribute__((weak)) void smihandler_check_illegal_access(uint32_t tco_sts)
+{
+ return;
}
static void *find_save_state(const struct smm_save_state_ops *save_state_ops,
@@ -175,6 +185,8 @@
/* Disable all GPE */
pmc_disable_all_gpe();
+ /* Set which state system will be after power reapplied */
+ pmc_soc_restore_power_failure();
/* also iterates over all bridges on bus 0 */
busmaster_disable_on_bus(0);
break;
@@ -201,8 +213,7 @@
* the line above. However, if we entered sleep state S1 and wake
* up again, we will continue to execute code in this function.
*/
- reg32 = inl(ACPI_BASE_ADDRESS + PM1_CNT);
- if (reg32 & SCI_EN) {
+ if (pmc_read_pm1_control() & SCI_EN) {
/* The OS is not an ACPI OS, so we set the state to S0 */
pmc_disable_pm1_control(SLP_EN | SLP_TYP);
}
@@ -240,6 +251,9 @@
}
finalize_done = 1;
+ if (IS_ENABLED(CONFIG_SPI_FLASH_SMM))
+ /* Re-init SPI driver to handle locked BAR */
+ fast_spi_init();
}
void smihandler_southbridge_apmc(
@@ -308,12 +322,13 @@
const struct smm_save_state_ops *save_state_ops)
{
uint16_t pm1_sts = pmc_clear_pm1_status();
+ u16 pm1_en = pmc_read_pm1_enable();
/*
* While OSPM is not active, poweroff immediately
* on a power button event.
*/
- if (pm1_sts & PWRBTN_STS) {
+ if ((pm1_sts & PWRBTN_STS) && (pm1_en & PWRBTN_EN)) {
/* power button pressed */
if (IS_ENABLED(CONFIG_ELOG_GSMI))
elog_add_event(ELOG_TYPE_POWER_BUTTON);
@@ -336,6 +351,8 @@
/* Any TCO event? */
if (!tco_sts)
return;
+
+ smihandler_check_illegal_access(tco_sts);
if (tco_sts & TCO_TIMEOUT) { /* TIMEOUT */
/* Handle TCO timeout */
@@ -391,6 +408,17 @@
*/
smi_sts = pmc_clear_smi_status();
+ /*
+ * In SCI mode, execute only those SMI handlers that have
+ * declared themselves as available for service in that mode
+ * using smi_handler_sci_mask.
+ */
+ if (pmc_read_pm1_control() & SCI_EN)
+ smi_sts &= smi_handler_sci_mask;
+
+ if (!smi_sts)
+ return;
+
save_state_ops = get_smm_save_state_ops();
/* Call SMI sub handler for each of the status bits */
diff --git a/src/soc/intel/common/block/smm/smm.c b/src/soc/intel/common/block/smm/smm.c
index d5f42a7..feb6ad0 100644
--- a/src/soc/intel/common/block/smm/smm.c
+++ b/src/soc/intel/common/block/smm/smm.c
@@ -38,11 +38,11 @@
pmc_clear_all_gpe_status();
}
-void smm_southbridge_enable(void)
+void smm_southbridge_enable(uint16_t events)
{
printk(BIOS_DEBUG, "Enabling SMIs.\n");
/* Configure events */
- pmc_enable_pm1(PWRBTN_EN | GBL_EN);
+ pmc_enable_pm1(events);
pmc_disable_std_gpe(PME_B0_EN);
/*
--
To view, visit https://review.coreboot.org/22869
To unsubscribe, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-MessageType: newchange
Gerrit-Change-Id: Ie9f90df3336c1278b73284815b5197400512c1d2
Gerrit-Change-Number: 22869
Gerrit-PatchSet: 1
Gerrit-Owner: Subrata Banik <subrata.banik(a)intel.com>
Subrata Banik has uploaded this change for review. ( https://review.coreboot.org/22868
Change subject: soc/intel/skylake: Enable power button SMI when jumping to payload
......................................................................
soc/intel/skylake: Enable power button SMI when jumping to payload
Instead of enabling power button SMI unconditionally, add a boot state
handler to enable power button SMI just before jumping to
payload.
Change-Id: Ia4fe2694006baf24ed475c85aaffa6a0d2a6031d
Signed-off-by: Furquan Shaikh <furquan(a)chromium.org>
Signed-off-by: Subrata Banik <subrata.banik(a)intel.com>
---
M src/soc/intel/skylake/pmc.c
M src/soc/intel/skylake/smi.c
2 files changed, 16 insertions(+), 15 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/68/22868/1
diff --git a/src/soc/intel/skylake/pmc.c b/src/soc/intel/skylake/pmc.c
index ff84690..fe78bf7 100644
--- a/src/soc/intel/skylake/pmc.c
+++ b/src/soc/intel/skylake/pmc.c
@@ -15,6 +15,7 @@
* GNU General Public License for more details.
*/
+#include <bootstate.h>
#include <chip.h>
#include <console/console.h>
#include <device/device.h>
@@ -197,4 +198,19 @@
CONFIG_MAINBOARD_POWER_ON_AFTER_POWER_FAIL);
}
+static void pm1_enable_pwrbtn_smi(void *unused)
+{
+ /*
+ * Enable power button SMI only before jumping to payload. This ensures
+ * that:
+ * 1. Power button SMI is enabled only after coreboot is done.
+ * 2. On resume path, power button SMI is not enabled and thus avoids
+ * any shutdowns because of power button presses due to power button
+ * press in resume path.
+ */
+ pmc_update_pm1_enable(PWRBTN_EN);
+}
+
+BOOT_STATE_INIT_ENTRY(BS_PAYLOAD_LOAD, BS_ON_EXIT, pm1_enable_pwrbtn_smi, NULL);
+
#endif
diff --git a/src/soc/intel/skylake/smi.c b/src/soc/intel/skylake/smi.c
index f11a9d8..67c3bb8 100644
--- a/src/soc/intel/skylake/smi.c
+++ b/src/soc/intel/skylake/smi.c
@@ -90,18 +90,3 @@
"d" (APM_CNT)
);
}
-
-static void pm1_enable_pwrbtn_smi(void *unused)
-{
- /*
- * Enable power button SMI only before jumping to payload. This ensures
- * that:
- * 1. Power button SMI is enabled only after coreboot is done.
- * 2. On resume path, power button SMI is not enabled and thus avoids
- * any shutdowns because of power button presses due to power button
- * press in resume path.
- */
- pmc_update_pm1_enable(PWRBTN_EN);
-}
-
-BOOT_STATE_INIT_ENTRY(BS_PAYLOAD_LOAD, BS_ON_EXIT, pm1_enable_pwrbtn_smi, NULL);
--
To view, visit https://review.coreboot.org/22868
To unsubscribe, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-MessageType: newchange
Gerrit-Change-Id: Ia4fe2694006baf24ed475c85aaffa6a0d2a6031d
Gerrit-Change-Number: 22868
Gerrit-PatchSet: 1
Gerrit-Owner: Subrata Banik <subrata.banik(a)intel.com>
Hello build bot (Jenkins),
I'd like you to reexamine a change. Please visit
https://review.coreboot.org/22867
to look at the new patch set (#3).
Change subject: security/tpm: Add TPM measurement code
......................................................................
security/tpm: Add TPM measurement code
* Adapt TSS hash_complete function
* Add TCPA ACPI log functionality in TSS
* Add TSPI functions for measuring and hashing data
* Fix small coding style issues
Change-Id: I0a52494f647d21e2587231af26ed13d62b3a72f5
Signed-off-by: Philipp Deppenwiese <zaolin(a)das-labor.org>
---
M src/security/tpm/tspi.h
M src/security/tpm/tspi/tspi.c
M src/security/tpm/tss.h
M src/security/tpm/tss/tcg-1.2/tss.c
M src/security/tpm/tss/tcg-1.2/tss_structures.h
M src/security/tpm/tss/tcg-2.0/tss.c
6 files changed, 196 insertions(+), 18 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/67/22867/3
--
To view, visit https://review.coreboot.org/22867
To unsubscribe, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I0a52494f647d21e2587231af26ed13d62b3a72f5
Gerrit-Change-Number: 22867
Gerrit-PatchSet: 3
Gerrit-Owner: Philipp Deppenwiese <zaolin.daisuki(a)gmail.com>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>