Hello Iru Cai,
I'd like you to do a code review. Please visit
https://review.coreboot.org/c/coreboot/+/45577
to review the following change.
Change subject: Documentation: Introduce HP Sure Start and the method to bypass it
......................................................................
Documentation: Introduce HP Sure Start and the method to bypass it
Change-Id: Id198afdaa13b4c361e1b77a56d5a2436ed1c4c86
Signed-off-by: Iru Cai <mytbk920423(a)gmail.com>
---
A Documentation/mainboard/hp/hp_sure_start.md
M Documentation/mainboard/index.md
2 files changed, 58 insertions(+), 0 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/77/45577/1
diff --git a/Documentation/mainboard/hp/hp_sure_start.md b/Documentation/mainboard/hp/hp_sure_start.md
new file mode 100644
index 0000000..d1f3f67
--- /dev/null
+++ b/Documentation/mainboard/hp/hp_sure_start.md
@@ -0,0 +1,57 @@
+# HP Sure Start
+
+According to the [HP Sure Start Technical Whitepaper], HP Sure Start is a chipset
+and processor independent firmware intrusion detection and automatic repair system.
+It is implemented in HP notebooks since 2013, and desktops since 2015.
+
+This document talks about some mechanism of HP Sure Start on some machines, and
+the method to bypass it.
+
+## Laptops with SMSC MEC1322 embedded controller
+
+Haswell EliteBook, ZBook and ProBook 600 series use SMSC MEC1322 embedded controller.
+The EC firmware implements HP Sure Start. A Haswell EliteBook has two flash chips.
+According to the strings in the EC firmware, the 16MB flash chip that stores the
+BIOS firmware is called the *system flash*, and the 2MB flash chip that stores part
+of the system flash content is called the *private flash*.
+
+The private flash is connected to the EC, and is not accessible by the OS.
+It contains the following:
+
+- HP Sure Start policy header (starting with the string "POLI")
+- A copy of the Intel Flash Descriptor
+- A copy of the GbE firmware
+- Machine Unique Data (MUD)
+- Hashes of the IFD, GbE firmware and MUD, the hash algorithm is unknown
+- A copy of the bootblock, UEFI PEI stage, and microcode
+
+If the IFD of the system flash does not match the hash in the private flash, for example,
+modifying the IFD with ``ifdtool -u`` or ``me_cleaner -S``, the EC will recover the IFD.
+
+If the content of the private flash is lost. The EC firmware will still copy the IFD,
+bootblock and PEI to the private flash. However, the IFD is not protected after that.
+
+HP Sure Start also verifies bootblock, PEI, and microcode without using the private flash.
+EC firmware reads them from an absolute address of the system flash chip, which is
+hardcoded in the EC firmware. It looks like this verification is done with a digital
+signature. If the PEI volume is modified, EC firmware will recover it using the copy
+in the private flash. If the private flash has no valid copies of the PEI volume, and
+the PEI volume is modified, the machine will refuse to boot with the CapsLock LED blinking.
+
+## Bypassing HP Sure Start
+
+First search the mainboard for the flash chips. If there are two flash chips,
+the smaller one may be the private flash.
+
+For Intel boards, try to modify the IFD with ``ifdtool -u``, power on and shut down
+the machine, then read the flash again. If the IFD is not modified, it is likely to
+be recovered from the private flash. Find the private flash and erase it, then the IFD
+can be modified.
+
+To bypass the bootblock and PEI verification, we can modify the IFD to make the
+BIOS region not overlap with the protected region. Since the EC firmware is usually
+located at the high address of the flash chip (and in the protected region),
+we can leave it untouched, and do not need to extract the EC firmware to put it in
+the coreboot image.
+
+[HP Sure Start Technical Whitepaper]: http://h10032.www1.hp.com/ctg/Manual/c05163901
diff --git a/Documentation/mainboard/index.md b/Documentation/mainboard/index.md
index 0eefee8..335eae2 100644
--- a/Documentation/mainboard/index.md
+++ b/Documentation/mainboard/index.md
@@ -61,6 +61,7 @@
### EliteBook series
- [HP Laptops with KBC1126 EC](hp/hp_kbc1126_laptops.md)
+- [HP Sure Start](hp/hp_sure_start.md)
- [EliteBook 2560p](hp/2560p.md)
- [EliteBook 8760w](hp/8760w.md)
--
To view, visit https://review.coreboot.org/c/coreboot/+/45577
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: Id198afdaa13b4c361e1b77a56d5a2436ed1c4c86
Gerrit-Change-Number: 45577
Gerrit-PatchSet: 1
Gerrit-Owner: Iru Cai (vimacs) <mytbk920423(a)gmail.com>
Gerrit-Reviewer: Iru Cai <mytbk920423(a)gmail.com>
Gerrit-MessageType: newchange
Arthur Heymans has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/45814 )
Change subject: mb/emulation/q35: Define pm_acpi_smi_cmd_port
......................................................................
mb/emulation/q35: Define pm_acpi_smi_cmd_port
The X86 Qemu targets use the AMD64 SMM save state, but unlike
most AMD CPU's the PM ACPI SMI port is not configurable and uses
the Intel default APM_CNT, 0xb2 port.
This will be used by the common save state handler.
Change-Id: Ifee9476f628a2df710fb4340ce6a19b008df1033
Signed-off-by: Arthur Heymans <arthur(a)aheymans.xyz>
---
M src/mainboard/emulation/qemu-q35/Makefile.inc
A src/mainboard/emulation/qemu-q35/smi.c
2 files changed, 11 insertions(+), 0 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/14/45814/1
diff --git a/src/mainboard/emulation/qemu-q35/Makefile.inc b/src/mainboard/emulation/qemu-q35/Makefile.inc
index e142d4d..59c61c4 100644
--- a/src/mainboard/emulation/qemu-q35/Makefile.inc
+++ b/src/mainboard/emulation/qemu-q35/Makefile.inc
@@ -14,3 +14,5 @@
verstage-$(CONFIG_CHROMEOS) += chromeos.c
verstage-$(CONFIG_CHROMEOS) += ../qemu-i440fx/fw_cfg.c
ramstage-$(CONFIG_CHROMEOS) += chromeos.c
+
+smm-$(CONFIG_HAVE_SMI_HANDLER) += smi.c
\ No newline at end of file
diff --git a/src/mainboard/emulation/qemu-q35/smi.c b/src/mainboard/emulation/qemu-q35/smi.c
new file mode 100644
index 0000000..5d8d482
--- /dev/null
+++ b/src/mainboard/emulation/qemu-q35/smi.c
@@ -0,0 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+
+#include <cpu/x86/smm.h>
+
+/* The X86 qemu target uses AMD64 save states but the APM port is not configurable. */
+uint16_t pm_acpi_smi_cmd_port(void)
+{
+ return APM_CNT;
+}
--
To view, visit https://review.coreboot.org/c/coreboot/+/45814
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: Ifee9476f628a2df710fb4340ce6a19b008df1033
Gerrit-Change-Number: 45814
Gerrit-PatchSet: 1
Gerrit-Owner: Arthur Heymans <arthur(a)aheymans.xyz>
Gerrit-Reviewer: Martin Roth <martinroth(a)google.com>
Gerrit-Reviewer: Patrick Georgi <pgeorgi(a)google.com>
Gerrit-MessageType: newchange
Arthur Heymans has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/45813 )
Change subject: soc/amd/*/smi.h: Move the pm_acpi_smi_cmd_port function declaration
......................................................................
soc/amd/*/smi.h: Move the pm_acpi_smi_cmd_port function declaration
This prototype will be used outside of soc/amd.
Change-Id: Icc69cf8a910764b27edf64f0f527b8f6a9013121
Signed-off-by: Arthur Heymans <arthur(a)aheymans.xyz>
---
M src/include/cpu/x86/smm.h
M src/soc/amd/picasso/include/soc/smi.h
M src/soc/amd/picasso/smi_util.c
M src/soc/amd/stoneyridge/include/soc/smi.h
M src/soc/amd/stoneyridge/smi_util.c
5 files changed, 5 insertions(+), 2 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/13/45813/1
diff --git a/src/include/cpu/x86/smm.h b/src/include/cpu/x86/smm.h
index 1073d03..6cf6f82 100644
--- a/src/include/cpu/x86/smm.h
+++ b/src/include/cpu/x86/smm.h
@@ -197,5 +197,8 @@
/* Return the SMM save state revision. The revision can be fetched from the smm savestate
which is always at the same offset downward from the top of the save state. */
uint32_t smm_revision(void);
+/* Returns the PM ACPI SMI port. On Intel systems this typically not configurable (APM_CNT, 0xb2).
+ On AMD systems it is sometimes configurable. */
+uint16_t pm_acpi_smi_cmd_port(void);
#endif /* CPU_X86_SMM_H */
diff --git a/src/soc/amd/picasso/include/soc/smi.h b/src/soc/amd/picasso/include/soc/smi.h
index a629fc5..ee47676 100644
--- a/src/soc/amd/picasso/include/soc/smi.h
+++ b/src/soc/amd/picasso/include/soc/smi.h
@@ -213,7 +213,6 @@
uint8_t level; /* Edge or Level, smi_sci_dir */
};
-uint16_t pm_acpi_smi_cmd_port(void);
void configure_smi(uint8_t smi_num, uint8_t mode);
void configure_gevent_smi(uint8_t gevent, uint8_t mode, uint8_t level);
void configure_scimap(const struct sci_source *sci);
diff --git a/src/soc/amd/picasso/smi_util.c b/src/soc/amd/picasso/smi_util.c
index 2c5085b..2fbc8e2 100644
--- a/src/soc/amd/picasso/smi_util.c
+++ b/src/soc/amd/picasso/smi_util.c
@@ -5,6 +5,7 @@
*/
#include <console/console.h>
+#include <cpu/x86/smm.h>
#include <soc/southbridge.h>
#include <soc/smi.h>
#include <amdblocks/acpimmio.h>
diff --git a/src/soc/amd/stoneyridge/include/soc/smi.h b/src/soc/amd/stoneyridge/include/soc/smi.h
index f7cacea..15bba0f 100644
--- a/src/soc/amd/stoneyridge/include/soc/smi.h
+++ b/src/soc/amd/stoneyridge/include/soc/smi.h
@@ -211,7 +211,6 @@
uint8_t level; /* Edge or Level, smi_sci_dir */
};
-uint16_t pm_acpi_smi_cmd_port(void);
void configure_smi(uint8_t smi_num, uint8_t mode);
void configure_gevent_smi(uint8_t gevent, uint8_t mode, uint8_t level);
void configure_scimap(const struct sci_source *sci);
diff --git a/src/soc/amd/stoneyridge/smi_util.c b/src/soc/amd/stoneyridge/smi_util.c
index 2c5085b..2fbc8e2 100644
--- a/src/soc/amd/stoneyridge/smi_util.c
+++ b/src/soc/amd/stoneyridge/smi_util.c
@@ -5,6 +5,7 @@
*/
#include <console/console.h>
+#include <cpu/x86/smm.h>
#include <soc/southbridge.h>
#include <soc/smi.h>
#include <amdblocks/acpimmio.h>
--
To view, visit https://review.coreboot.org/c/coreboot/+/45813
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: Icc69cf8a910764b27edf64f0f527b8f6a9013121
Gerrit-Change-Number: 45813
Gerrit-PatchSet: 1
Gerrit-Owner: Arthur Heymans <arthur(a)aheymans.xyz>
Gerrit-MessageType: newchange
Arthur Heymans has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/44322 )
Change subject: cpu/x86/smm/smm.ld: Assert that CONFIG_MAX_CPUS <= 4
......................................................................
cpu/x86/smm/smm.ld: Assert that CONFIG_MAX_CPUS <= 4
The SMM_ASEG code only supports up to 4 CPUs, so assert this at
buildtime.
Change-Id: I8ec803cd1b76f17f4dccd5c573179d542d54c277
Signed-off-by: Arthur Heymans <arthur(a)aheymans.xyz>
---
M src/cpu/x86/smm/smm.ld
1 file changed, 3 insertions(+), 0 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/22/44322/1
diff --git a/src/cpu/x86/smm/smm.ld b/src/cpu/x86/smm/smm.ld
index af5968d..2f46975 100644
--- a/src/cpu/x86/smm/smm.ld
+++ b/src/cpu/x86/smm/smm.ld
@@ -2,6 +2,9 @@
/* Maximum number of CPUs/cores */
CPUS = 4;
+
+_ = ASSERT(CPUS > CONFIG_MAX_CPUS, "The ASEG SMM code only supports up to 4 CPUS");
+
ENTRY(smm_handler_start);
SECTIONS
--
To view, visit https://review.coreboot.org/c/coreboot/+/44322
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I8ec803cd1b76f17f4dccd5c573179d542d54c277
Gerrit-Change-Number: 44322
Gerrit-PatchSet: 1
Gerrit-Owner: Arthur Heymans <arthur(a)aheymans.xyz>
Gerrit-Reviewer: Julius Werner <jwerner(a)chromium.org>
Gerrit-MessageType: newchange
Arthur Heymans has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/45471 )
Change subject: cpu/x86/smm/smihandler.c: Simplify smm revision handling
......................................................................
cpu/x86/smm/smihandler.c: Simplify smm revision handling
The ASEG smihandler bails out if an unsupported SMM save state
revision is detected. Now we have code to find the SMM save state
depending on the SMM save state revision so reuse this to do the same.
This also increases the loglevel when bailing out of SMM due to
unsupported SMM save state revision from BIOS_DEBUG to BIOS_WARNING,
given that the system likely still boots but won't have a functioning
smihandler.
Change-Id: I57198f0c85c0f7a1fa363d3bd236c3d41b68d2f0
Signed-off-by: Arthur Heymans <arthur(a)aheymans.xyz>
---
M src/cpu/x86/smm/smihandler.c
1 file changed, 3 insertions(+), 50 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/71/45471/1
diff --git a/src/cpu/x86/smm/smihandler.c b/src/cpu/x86/smm/smihandler.c
index 077fa8d..dea4cf3 100644
--- a/src/cpu/x86/smm/smihandler.c
+++ b/src/cpu/x86/smm/smihandler.c
@@ -14,23 +14,6 @@
#include <spi-generic.h>
#endif
-typedef enum {
- AMD64,
- EM64T100,
- EM64T101,
- LEGACY
-} save_state_type_t;
-
-typedef struct {
- save_state_type_t type;
- union {
- amd64_smm_state_save_area_t *amd64_state_save;
- em64t100_smm_state_save_area_t *em64t100_state_save;
- em64t101_smm_state_save_area_t *em64t101_state_save;
- legacy_smm_state_save_area_t *legacy_state_save;
- };
-} smm_state_save_area_t;
-
static int do_driver_init = 1;
typedef enum { SMI_LOCKED, SMI_UNLOCKED } smi_semaphore;
@@ -162,9 +145,6 @@
void smi_handler(void)
{
unsigned int node;
- const uint32_t smm_rev = smm_revision();
- smm_state_save_area_t state_save;
- u32 smm_base = SMM_BASE; /* ASEG */
/* Are we ok to execute the handler? */
if (!smi_obtain_lock()) {
@@ -190,36 +170,9 @@
printk(BIOS_SPEW, "\nSMI# #%d\n", node);
- switch (smm_rev) {
- case 0x00030002:
- case 0x00030007:
- state_save.type = LEGACY;
- state_save.legacy_state_save =
- smm_save_state(smm_base,
- SMM_LEGACY_ARCH_OFFSET, node);
- break;
- case 0x00030100:
- state_save.type = EM64T100;
- state_save.em64t100_state_save =
- smm_save_state(smm_base,
- SMM_EM64T100_ARCH_OFFSET, node);
- break;
- case 0x00030101: /* SandyBridge, IvyBridge, and Haswell */
- state_save.type = EM64T101;
- state_save.em64t101_state_save =
- smm_save_state(smm_base,
- SMM_EM64T101_ARCH_OFFSET, node);
- break;
- case 0x00020064:
- case 0x00030064:
- state_save.type = AMD64;
- state_save.amd64_state_save =
- smm_save_state(smm_base,
- SMM_AMD64_ARCH_OFFSET, node);
- break;
- default:
- printk(BIOS_DEBUG, "smm_revision: 0x%08x\n", smm_rev);
- printk(BIOS_DEBUG, "SMI# not supported on your CPU\n");
+ if (smm_get_save_state(node) == NULL) {
+ printk(BIOS_WARNING, "smm_revision: 0x%08x\n", smm_revision());
+ printk(BIOS_WARNING, "SMI# not supported on your CPU\n");
/* Don't release lock, so no further SMI will happen,
* if we don't handle it anyways.
*/
--
To view, visit https://review.coreboot.org/c/coreboot/+/45471
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I57198f0c85c0f7a1fa363d3bd236c3d41b68d2f0
Gerrit-Change-Number: 45471
Gerrit-PatchSet: 1
Gerrit-Owner: Arthur Heymans <arthur(a)aheymans.xyz>
Gerrit-MessageType: newchange