summaryrefslogtreecommitdiff
path: root/src/soc
diff options
context:
space:
mode:
Diffstat (limited to 'src/soc')
-rw-r--r--src/soc/intel/baytrail/smihandler.c4
-rw-r--r--src/soc/intel/braswell/smihandler.c4
-rw-r--r--src/soc/intel/broadwell/smihandler.c8
-rw-r--r--src/soc/intel/common/block/smm/smihandler.c4
4 files changed, 20 insertions, 0 deletions
diff --git a/src/soc/intel/baytrail/smihandler.c b/src/soc/intel/baytrail/smihandler.c
index 6f3f07e73d..1810821ec8 100644
--- a/src/soc/intel/baytrail/smihandler.c
+++ b/src/soc/intel/baytrail/smihandler.c
@@ -321,6 +321,10 @@ static void southbridge_smi_apmc(void)
if (state) {
/* EBX in the state save contains the GNVS pointer */
gnvs = (struct global_nvs *)((uint32_t)state->rbx);
+ if (smm_points_to_smram(gnvs, sizeof(*gnvs))) {
+ printk(BIOS_ERR, "SMI#: ERROR: GNVS overlaps SMM\n");
+ return;
+ }
smm_initialized = 1;
printk(BIOS_DEBUG, "SMI#: Setting GNVS to %p\n", gnvs);
}
diff --git a/src/soc/intel/braswell/smihandler.c b/src/soc/intel/braswell/smihandler.c
index a2c26c119f..d2f73bf654 100644
--- a/src/soc/intel/braswell/smihandler.c
+++ b/src/soc/intel/braswell/smihandler.c
@@ -301,6 +301,10 @@ static void southbridge_smi_apmc(void)
if (state) {
/* EBX in the state save contains the GNVS pointer */
gnvs = (struct global_nvs *)((uint32_t)state->rbx);
+ if (smm_points_to_smram(gnvs, sizeof(*gnvs))) {
+ printk(BIOS_ERR, "SMI#: ERROR: GNVS overlaps SMM\n");
+ return;
+ }
smm_initialized = 1;
printk(BIOS_DEBUG, "SMI#: Setting GNVS to %p\n", gnvs);
}
diff --git a/src/soc/intel/broadwell/smihandler.c b/src/soc/intel/broadwell/smihandler.c
index 86be400e71..8dbb40f2b7 100644
--- a/src/soc/intel/broadwell/smihandler.c
+++ b/src/soc/intel/broadwell/smihandler.c
@@ -100,6 +100,10 @@ static void backlight_off(void)
reg_base = (void *)((uintptr_t)pci_read_config32(SA_DEV_IGD,
PCI_BASE_ADDRESS_0) & ~0xf);
+ /* Validate pointer before using it */
+ if (smm_points_to_smram(reg_base, PCH_PP_OFF_DELAYS + sizeof(uint32_t)))
+ return;
+
/* Check if backlight is enabled */
pp_ctrl = read32(reg_base + PCH_PP_CONTROL);
if (!(pp_ctrl & EDP_BLC_ENABLE))
@@ -341,6 +345,10 @@ static void southbridge_smi_apmc(void)
if (state) {
/* EBX in the state save contains the GNVS pointer */
gnvs = (struct global_nvs *)((u32)state->rbx);
+ if (smm_points_to_smram(gnvs, sizeof(*gnvs))) {
+ printk(BIOS_ERR, "SMI#: ERROR: GNVS overlaps SMM\n");
+ return;
+ }
smm_initialized = 1;
printk(BIOS_DEBUG, "SMI#: Setting GNVS to %p\n", gnvs);
}
diff --git a/src/soc/intel/common/block/smm/smihandler.c b/src/soc/intel/common/block/smm/smihandler.c
index 7bd17c3e78..4998532837 100644
--- a/src/soc/intel/common/block/smm/smihandler.c
+++ b/src/soc/intel/common/block/smm/smihandler.c
@@ -373,6 +373,10 @@ void smihandler_southbridge_apmc(
/* EBX in the state save contains the GNVS pointer */
uint32_t reg_ebx = save_state_ops->get_reg(state, RBX);
gnvs = (struct global_nvs *)(uintptr_t)reg_ebx;
+ if (smm_points_to_smram(gnvs, sizeof(*gnvs))) {
+ printk(BIOS_ERR, "SMI#: ERROR: GNVS overlaps SMM\n");
+ return;
+ }
smm_initialized = 1;
printk(BIOS_DEBUG, "SMI#: Setting GNVS to %p\n", gnvs);
}