Stm option

DasharoModulePkg/DasharoModulePkg.dec

@@ -89,6 +89,7 @@
   gDasharoSystemFeaturesTokenSpaceGuid.PcdShowMemorySpdProfileOption|FALSE|BOOLEAN|0x00000002F
   gDasharoSystemFeaturesTokenSpaceGuid.PcdShowMemoryIbeccOption|FALSE|BOOLEAN|0x000000030
   gDasharoSystemFeaturesTokenSpaceGuid.PcdFumAutoIpxeBoot|TRUE|BOOLEAN|0x000000031
+  gDasharoSystemFeaturesTokenSpaceGuid.PcdShowSecurityStmOption|FALSE|BOOLEAN|0x000000032
 
 [PcdsFixedAtBuild,PcdsPatchableInModule,PcdsDynamic,PcdsDynamicEx]
   ## Indicate whether the password is cleared.

DasharoModulePkg/Include/DasharoOptions.h

@@ -48,6 +48,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define DASHARO_VAR_USB_STACK                     L"UsbDriverStack"
 #define DASHARO_VAR_WATCHDOG                      L"WatchdogConfig"
 #define DASHARO_VAR_WATCHDOG_AVAILABLE            L"WatchdogAvailable"
+#define DASHARO_VAR_STM                           L"STM"
 
 // Other
 #define DASHARO_VAR_SMBIOS_UUID  L"Type1UUID"

DasharoModulePkg/Library/DasharoSystemFeaturesUiLib/DasharoSystemFeatures.c

@@ -207,6 +207,7 @@ DasharoSystemFeaturesUiLibConstructor (
   PRIVATE_DATA(ShowMemorySpdProfile) = FixedPcdGetBool(PcdShowMemorySpdProfileOption);
   PRIVATE_DATA(ShowMemoryIbecc) = FixedPcdGetBool(PcdShowMemoryIbeccOption);
   PRIVATE_DATA(HaveDiskCapsules) = FixedPcdGetBool(PcdCapsuleOnDiskSupport);
+  PRIVATE_DATA(SecurityMenuShowStm) = FixedPcdGetBool (PcdShowSecurityStmOption);
 
   // HAP is only available if descriptor is not locked
   VarSize = sizeof (DescriptorWriteable);
@@ -229,6 +230,7 @@ DasharoSystemFeaturesUiLibConstructor (
                                      FixedPcdGetBool (PcdSecurityShowCameraOption) ||
                                      FixedPcdGetBool (PcdShowLockBios) ||
                                      FixedPcdGetBool (PcdShowSmmBwp) ||
+                                     FixedPcdGetBool (PcdShowSecurityStmOption) ||
                                      FixedPcdGetBool (PcdShowFum);
 
   if (PRIVATE_DATA(ShowChipsetMenu))
@@ -307,6 +309,7 @@ DasharoSystemFeaturesUiLibConstructor (
   LOAD_VAR (DASHARO_VAR_HYPER_THREADING, HyperThreading);
   LOAD_VAR (DASHARO_VAR_USB_PORT_POWER, UsbPortPower);
   LOAD_VAR (DASHARO_VAR_DGPU_STATE, DGPUState);
+  LOAD_VAR (DASHARO_VAR_STM, StmEnable);
 
 #undef LOAD_VAR
 
@@ -567,6 +570,7 @@ DasharoSystemFeaturesRouteConfig (
       STORE_VAR_IF (DASHARO_VAR_IOMMU_CONFIG, IommuConfig, FixedPcdGetBool (PcdShowIommuOptions));
       STORE_VAR_IF (DASHARO_VAR_LOCK_BIOS, LockBios, FixedPcdGetBool (PcdShowLockBios));
       STORE_VAR_IF (DASHARO_VAR_SMM_BWP, SmmBwp, FixedPcdGetBool (PcdShowSmmBwp));
+      STORE_VAR_IF (DASHARO_VAR_STM, StmEnable, FixedPcdGetBool (PcdShowSecurityStmOption));
   }
 
   if (FixedPcdGetBool (PcdShowMemoryMenu)) {

DasharoModulePkg/Library/DasharoSystemFeaturesUiLib/DasharoSystemFeaturesHii.h

@@ -166,6 +166,7 @@ typedef struct {
   BOOLEAN  ShowMemorySpdProfile;
   BOOLEAN  ShowMemoryIbecc;
   BOOLEAN  HaveDiskCapsules;
+  BOOLEAN  SecurityMenuShowStm;
   // Feature data
   BOOLEAN                  LockBios;
   BOOLEAN                  SmmBwp;
@@ -203,6 +204,7 @@ typedef struct {
   UINT8                    UsbPortPower;
   UINT8                    DGPUState;
   BOOLEAN                  MemoryIbecc;
+  BOOLEAN                  StmEnable;
   // FIXME: Do not put anything after IBG_STATUS. There is something wrong
   // with alignments/accesses to this structure, which causes values
   // overwrites that are after IBG_STATUS in the DASHARO_FEATURES_DATA

DasharoModulePkg/Library/DasharoSystemFeaturesUiLib/DasharoSystemFeaturesStrings.uni

@@ -333,3 +333,7 @@
 #string STR_S_CRTM_STATUS_BTG     #language en-US "Boot Guard established"
 #string STR_S_CRTM_STATUS_TXT     #language en-US "Intel TXT Established"
 #string STR_S_CRTM_STATUS_BTG_TXT #language en-US "Boot Guard and TXT established"
+
+#string STR_STM_PROMPT            #language en-US "Enable SMI Transfer Monitor"
+#string STR_STM_HELP              #language en-US "Enables loading the SMI Transfer Monitor (STM) during boot to containerize SMI handlers when OS is running.\n\n"
+                                                  "STM requires support from operating system to be functional."

DasharoModulePkg/Library/DasharoSystemFeaturesUiLib/DasharoSystemFeaturesUiLib.inf

@@ -104,3 +104,4 @@
   gDasharoSystemFeaturesTokenSpaceGuid.PcdShowMemoryIbeccOption
   gDasharoSystemFeaturesTokenSpaceGuid.PcdFumAutoIpxeBoot
   gEfiMdeModulePkgTokenSpaceGuid.PcdCapsuleOnDiskSupport
+  gDasharoSystemFeaturesTokenSpaceGuid.PcdShowSecurityStmOption

DasharoModulePkg/Library/DasharoSystemFeaturesUiLib/DasharoSystemFeaturesVfr.vfr

@@ -149,6 +149,14 @@ formset
       endcheckbox;
     endif;
 
+    disableif ideqval FeaturesData.SecurityMenuShowStm == 0;
+      checkbox varid  = FeaturesData.StmEnable,
+               prompt = STRING_TOKEN(STR_STM_PROMPT),
+               help   = STRING_TOKEN(STR_STM_HELP),
+               flags  = RESET_REQUIRED,
+      endcheckbox;
+    endif;
+
     disableif ideqval FeaturesData.ShowFum == 0;
       subtitle text = STRING_TOKEN(STR_EMPTY_STRING);
       subtitle text = STRING_TOKEN(STR_EMPTY_STRING);

DasharoModulePkg/Library/DasharoVariablesLib/DasharoVariablesLib.c

@@ -76,6 +76,7 @@ STATIC CONST AUTO_VARIABLE mAutoCreatedVariables[] = {
   { DASHARO_VAR_FAST_BOOT,  FixedPcdGetBool (PcdFastBootFeatureEnabled) },
   { DASHARO_VAR_USB_PORT_POWER, FixedPcdGetBool (PcdShowPowerMenu) && FixedPcdGetBool (PcdPowerMenuShowUsbPowerOption) },
   { DASHARO_VAR_DGPU_STATE, FixedPcdGetBool (PcdShowPowerMenu) && FixedPcdGetBool (PcdPowerMenuShowDGPUPowerOption) },
+  { DASHARO_VAR_STM, FixedPcdGetBool (PcdShowSecurityMenu) && FixedPcdGetBool (PcdShowSecurityStmOption) },
 };
 
 /**
@@ -203,6 +204,9 @@ GetVariableInfo (
   } else if (StrCmp (VarName, DASHARO_VAR_DGPU_STATE) == 0) {
     Data.Uint8 = DASHARO_DGPU_ENABLED;
     Size = sizeof (Data.Uint8);
+  } else if (StrCmp (VarName, DASHARO_VAR_STM) == 0) {
+    Data.Boolean = FALSE;
+    Size = sizeof (Data.Boolean);
   } else {
     DEBUG ((EFI_D_ERROR, "%a(): Unknown variable: %s.\n", __FUNCTION__, VarName));
     ASSERT ((0 && "No default value set for a variable."));

DasharoModulePkg/Library/DasharoVariablesLib/DasharoVariablesLib.inf

@@ -90,3 +90,4 @@
   gEfiMdePkgTokenSpaceGuid.PcdFastBootFeatureEnabled
   gEfiMdePkgTokenSpaceGuid.PcdQuietBootFeatureEnabled
   gDasharoPayloadPkgTokenSpaceGuid.PcdLoadOptionRoms
+  gDasharoSystemFeaturesTokenSpaceGuid.PcdShowSecurityStmOption

DasharoPayloadPkg/BlSupportDxe/BlSupportDxe.c

@@ -101,6 +101,85 @@ ReserveResourceInGcd (
   return Status;
 }
 
+/**
+  Modifies the attributes to Runtime type for PCIe MMCONF memory region.
+
+  @retval EFI_SUCCESS           The attributes were set for the memory region.
+  @retval EFI_INVALID_PARAMETER Length is zero.
+  @retval EFI_NOT_FOUND         Length is zero.
+  @retval EFI_UNSUPPORTED       The processor does not support one or more bytes of the memory
+                                resource range specified by BaseAddress and Length.
+  @retval EFI_UNSUPPORTED       The bit mask of attributes is not support for the memory resource
+                                range specified by BaseAddress and Length.
+  @retval EFI_ACCESS_DEFINED    The attributes for the memory resource range specified by
+                                BaseAddress and Length cannot be modified.
+  @retval EFI_OUT_OF_RESOURCES  There are not enough system resources to modify the attributes of
+                                the memory resource range.
+  @retval EFI_NOT_AVAILABLE_YET The attributes cannot be set because CPU architectural protocol is
+                                not available yet.
+**/
+STATIC
+EFI_STATUS
+SetPcieMmconfMemoryAttributesRunTime (
+  VOID
+  )
+{
+  EFI_STATUS                       Status;
+  EFI_GCD_MEMORY_SPACE_DESCRIPTOR  Descriptor;
+  EFI_HOB_GUID_TYPE                *GuidHob;
+  ACPI_BOARD_INFO                  *AcpiBoardInfo;
+
+  GuidHob = GetFirstGuidHob (&gUefiAcpiBoardInfoGuid);
+  if (GuidHob == NULL) {
+    return EFI_NOT_FOUND;
+  }
+  AcpiBoardInfo = (ACPI_BOARD_INFO *)GET_GUID_HOB_DATA (GuidHob);
+
+  Status = gDS->GetMemorySpaceDescriptor (AcpiBoardInfo->PcieBaseAddress, &Descriptor);
+  if (EFI_ERROR (Status)) {
+    DEBUG ((DEBUG_INFO, "%a: GetMemorySpaceDescriptor failed\n", __func__));
+    return Status;
+  }
+
+  if (Descriptor.GcdMemoryType == EfiGcdMemoryTypeNonExistent) {
+    Status = gDS->AddMemorySpace (
+                    EfiGcdMemoryTypeMemoryMappedIo,
+                    AcpiBoardInfo->PcieBaseAddress,
+                    AcpiBoardInfo->PcieBaseSize,
+                    EFI_MEMORY_UC | EFI_MEMORY_RUNTIME
+                    );
+    if (EFI_ERROR (Status)) {
+      DEBUG ((DEBUG_INFO, "%a: AddMemorySpace failed\n", __func__));
+      return Status;
+    }
+
+    Status = gDS->SetMemorySpaceAttributes (
+                    AcpiBoardInfo->PcieBaseAddress,
+                    AcpiBoardInfo->PcieBaseSize,
+                    EFI_MEMORY_RUNTIME
+                    );
+    if (EFI_ERROR (Status)) {
+      DEBUG ((DEBUG_INFO, "%a:%d SetMemorySpaceAttributes failed\n", __func__, __LINE__));
+      return Status;
+    }
+  } else if (!(Descriptor.Attributes & EFI_MEMORY_RUNTIME)) {
+    Status = gDS->SetMemorySpaceAttributes (
+                    AcpiBoardInfo->PcieBaseAddress,
+                    AcpiBoardInfo->PcieBaseSize,
+                    Descriptor.Attributes | EFI_MEMORY_RUNTIME
+                    );
+
+    if (EFI_ERROR (Status)) {
+      DEBUG ((DEBUG_INFO, "%a:%d SetMemorySpaceAttributes failed\n", __func__, __LINE__));
+      return Status;
+    }
+  } else {
+    DEBUG ((DEBUG_INFO, "%a: PCIe MMCONF memory space with runtime attribute already exists\n", __func__));
+  }
+
+  return EFI_SUCCESS;
+}
+
 EFI_STATUS
 EFIAPI
 BlDxeInstallSMBIOStables(
@@ -243,6 +322,9 @@ BlDxeEntryPoint (
   Status = ReserveResourceInGcd (TRUE, EfiGcdMemoryTypeMemoryMappedIo, 0xFED00000, SIZE_1KB, 0, ImageHandle); // HPET
   ASSERT_EFI_ERROR (Status);
 
+  Status = SetPcieMmconfMemoryAttributesRunTime ();
+  ASSERT_EFI_ERROR (Status);
+
   //
   // Find the system table information guid hob
   //

DasharoPayloadPkg/BlSupportPei/BlSupportPei.c

@@ -872,22 +872,9 @@ BlPeiEntryPoint (
     ASSERT (NewAcpiBoardInfo != NULL);
     CopyMem (NewAcpiBoardInfo, &AcpiBoardInfo, sizeof (ACPI_BOARD_INFO));
     DEBUG ((DEBUG_INFO, "Create acpi board info guid hob\n"));
-  }
 
-  //
-  // Reserve MMCONF range
-  //
-  BuildResourceDescriptorHob (
-    EFI_RESOURCE_MEMORY_RESERVED,
-    (
-    EFI_RESOURCE_ATTRIBUTE_PRESENT |
-    EFI_RESOURCE_ATTRIBUTE_INITIALIZED |
-    EFI_RESOURCE_ATTRIBUTE_TESTED |
-    EFI_RESOURCE_ATTRIBUTE_UNCACHEABLE
-    ),
-    AcpiBoardInfo.PcieBaseAddress,
-    AcpiBoardInfo.PcieBaseSize
-    );
+    BuildMemoryMappedIoRangeHob (AcpiBoardInfo.PcieBaseAddress, AcpiBoardInfo.PcieBaseSize);
+  }
 
   // Build SEC Performance Data Hob
   Status =   ParseTimestampTable(&Performance);
@@ -897,6 +884,14 @@ BlPeiEntryPoint (
     DEBUG ((DEBUG_ERROR, "Error when parsing timestamp info, Status = %r\n", Status));
   }
 
+  //
+  // Parse the misc info provided by bootloader
+  //
+  Status = ParseMiscInfo ();
+  if (EFI_ERROR (Status)) {
+    DEBUG ((DEBUG_ERROR, "Error when parsing misc info, Status = %r\n", Status));
+  }
+
   //
   // Parse platform specific information.
   //
@@ -926,6 +921,7 @@ BlPeiEntryPoint (
     ASSERT_EFI_ERROR (Status);
   }
 
+
   //
   // Mask off all legacy 8259 interrupt sources
   //

DasharoPayloadPkg/DasharoPayloadPkg.dec

@@ -37,6 +37,11 @@
   ## GUID used for ApuConfigurationUi FormSet guid and related variables.
   gApuConfigurationFormsetGuid = {0x6f4e051b, 0x1c10, 0x422a, {0x98, 0xcf, 0x96, 0x2e, 0x78, 0x36, 0x5c, 0x74} }
 
+  # SMMSTORE for coreboot and EDK-2
+  gEficorebootNvDataGuid = { 0xceae4c1d, 0x335b, 0x4685, { 0xa4, 0xa0, 0xfc, 0x4a, 0x94, 0xee, 0xa0, 0x85 } }
+
+  # Bootloader option menu
+  gEfiCfrSetupMenuFormGuid = { 0xfbc3b1de, 0xd17c, 0x44de, { 0x98, 0x47, 0x2b, 0xbf, 0x9e, 0xfd, 0xbd, 0x8e } }
 
 [Ppis]
   gEfiPayLoadHobBasePpiGuid = { 0xdbe23aa1, 0xa342, 0x4b97, {0x85, 0xb6, 0xb2, 0x26, 0xf1, 0x61, 0x73, 0x89} }

DasharoPayloadPkg/DasharoPayloadPkg.dsc

@@ -362,6 +362,7 @@
   CbfsLib|DasharoPayloadPkg/Library/CbfsLib/CbfsLib.inf
   EfiVarsLib|DasharoPayloadPkg/Library/EfiVarsLib/EfiVarsLib.inf
   CmosOptionsLib|DasharoPayloadPkg/Library/CmosOptionsLib/CmosOptionsLib.inf
+  CfrHelpersLib|UefiPayloadPkg/Library/CfrHelpersLib/CfrHelpersLib.inf
 
   DebugLib|MdePkg/Library/BaseDebugLibSerialPort/BaseDebugLibSerialPort.inf
   LockBoxLib|MdeModulePkg/Library/LockBoxNullLib/LockBoxNullLib.inf
@@ -850,6 +851,7 @@ OrderedCollectionLib|MdePkg/Library/BaseOrderedCollectionRedBlackTreeLib/BaseOrd
   MdeModulePkg/Universal/DriverHealthManagerDxe/DriverHealthManagerDxe.inf
   MdeModulePkg/Universal/BdsDxe/BdsDxe.inf
   MdeModulePkg/Logo/LogoDxe.inf
+  UefiPayloadPkg/CfrSetupMenuDxe/CfrSetupMenuDxe.inf
   MdeModulePkg/Application/UiApp/UiApp.inf {
     <LibraryClasses>
       NULL|MdeModulePkg/Library/DeviceManagerUiLib/DeviceManagerUiLib.inf

DasharoPayloadPkg/DasharoPayloadPkg.fdf

@@ -117,6 +117,7 @@ INF MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf
 INF UefiCpuPkg/CpuDxe/CpuDxe.inf
 INF MdeModulePkg/Universal/DriverHealthManagerDxe/DriverHealthManagerDxe.inf
 INF MdeModulePkg/Universal/BdsDxe/BdsDxe.inf
+INF UefiPayloadPkg/CfrSetupMenuDxe/CfrSetupMenuDxe.inf
 INF MdeModulePkg/Application/UiApp/UiApp.inf
 INF MdeModulePkg/Application/BootManagerMenuApp/BootManagerMenuApp.inf
 !if $(RAM_DISK_ENABLE) == TRUE

DasharoPayloadPkg/Include/Coreboot.h

@@ -782,6 +782,15 @@ struct cb_range {
 
 #define CB_TAG_FW_INFO  0x0045
 
+#define CB_TAG_CFR_ROOT  0x0047
+struct cb_cfr {
+  UINT32 tag;
+  UINT32 size;
+  UINT32 version;
+  UINT32 checksum;  /* Of the following data only; excludes these 3 fields */
+  /* CFR_FORM forms[] */
+};
+
 #define CB_TAG_RB_INFO  0x0048
 
 /*

DasharoPayloadPkg/Include/Library/BlParseLib.h

@@ -307,4 +307,20 @@ ParseRootBridgeInfo (
   VOID
   );
 
+/**
+  Parse and handle the misc info provided by bootloader
+
+  @retval RETURN_SUCCESS               The misc information was parsed successfully.
+  @retval RETURN_INCOMPATIBLE_VERSION  The provided CFR data does not match the expected version.
+  @retval RETURN_CRC_ERROR             The calculated checksum does not match the supplied one.
+  @retval RETURN_NOT_FOUND             Could not find required misc info.
+  @retval RETURN_OUT_OF_RESOURCES      Insufficant memory space.
+
+**/
+RETURN_STATUS
+EFIAPI
+ParseMiscInfo (
+  VOID
+  );
+
 #endif