GNUBoot/coreboot-kgpe-d16
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
coreboot-kgpe-d16/src/soc/intel/xeon_sp/lockdown.c

53 lines
1.3 KiB
C
Raw Normal View History

soc/intel/xeon_sp: Add PCH lockdown Add SOC_INTEL_COMMON_PCH_LOCKDOWN and PMC_GLOBAL_RESET_ENABLE_LOCK to meet device security requirements. LOCKDOWN has dependencies on SOC_INTEL_COMMON_PCH_BASE and several other common block devices. Add COMMON_PCH_BASE and COMMON_PCH_SERVER to pick up LOCKDOWN and the dependencies. COMMON_PCH_SERVER adds the following common devices that were not previously included by XEON_SP: SOC_INTEL_COMMON_BLOCK_CHIP_CONFIG SOC_INTEL_COMMON_BLOCK_CSE SOC_INTEL_COMMON_BLOCK_GPIO_ITSS_POL_CFG SOC_INTEL_COMMON_BLOCK_ITSS SOC_INTEL_COMMON_PCH_LOCKDOWN SOC_INTEL_COMMON_BLOCK_SATA SOC_INTEL_COMMON_BLOCK_SMBUS SOC_INTEL_COMMON_BLOCK_XHCI Change-Id: Iab97123e487f4f13f874f364a9c51723d234d4f0 Signed-off-by: Marc Jones <marcjones@sysproconsulting.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/49849 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Jay Talbott <JayTalbott@sysproconsulting.com> Reviewed-by: Stefan Reinauer <stefan.reinauer@coreboot.org>
2021-01-21 18:53:47 +01:00
/* SPDX-License-Identifier: GPL-2.0-only */
#include <device/mmio.h>
soc/intel/xeon_sp: Set SATA REGLOCKs Set the SATA and SSATA REGLOCK as indicated by the Intel documentation. Change-Id: I90e6d0e3b5a38bcd5392e26cbbb6dc4aa6a8304b Signed-off-by: Marc Jones <marcjones@sysproconsulting.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/52162 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Jay Talbott <JayTalbott@sysproconsulting.com> Reviewed-by: Stefan Reinauer <stefan.reinauer@coreboot.org> Reviewed-by: Angel Pons <th3fanbus@gmail.com>
2021-04-06 22:29:37 +02:00
#include <device/pci.h>
soc/intel/xeon_sp: Add PCH lockdown Add SOC_INTEL_COMMON_PCH_LOCKDOWN and PMC_GLOBAL_RESET_ENABLE_LOCK to meet device security requirements. LOCKDOWN has dependencies on SOC_INTEL_COMMON_PCH_BASE and several other common block devices. Add COMMON_PCH_BASE and COMMON_PCH_SERVER to pick up LOCKDOWN and the dependencies. COMMON_PCH_SERVER adds the following common devices that were not previously included by XEON_SP: SOC_INTEL_COMMON_BLOCK_CHIP_CONFIG SOC_INTEL_COMMON_BLOCK_CSE SOC_INTEL_COMMON_BLOCK_GPIO_ITSS_POL_CFG SOC_INTEL_COMMON_BLOCK_ITSS SOC_INTEL_COMMON_PCH_LOCKDOWN SOC_INTEL_COMMON_BLOCK_SATA SOC_INTEL_COMMON_BLOCK_SMBUS SOC_INTEL_COMMON_BLOCK_XHCI Change-Id: Iab97123e487f4f13f874f364a9c51723d234d4f0 Signed-off-by: Marc Jones <marcjones@sysproconsulting.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/49849 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Jay Talbott <JayTalbott@sysproconsulting.com> Reviewed-by: Stefan Reinauer <stefan.reinauer@coreboot.org>
2021-01-21 18:53:47 +01:00
#include <intelblocks/cfg.h>
#include <intelblocks/lpc_lib.h>
#include <intelblocks/pmclib.h>
#include <intelpch/lockdown.h>
soc/intel/xeon_sp: Set SATA REGLOCKs Set the SATA and SSATA REGLOCK as indicated by the Intel documentation. Change-Id: I90e6d0e3b5a38bcd5392e26cbbb6dc4aa6a8304b Signed-off-by: Marc Jones <marcjones@sysproconsulting.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/52162 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Jay Talbott <JayTalbott@sysproconsulting.com> Reviewed-by: Stefan Reinauer <stefan.reinauer@coreboot.org> Reviewed-by: Angel Pons <th3fanbus@gmail.com>
2021-04-06 22:29:37 +02:00
#include <soc/pci_devs.h>
soc/intel/xeon_sp: Add PCH lockdown Add SOC_INTEL_COMMON_PCH_LOCKDOWN and PMC_GLOBAL_RESET_ENABLE_LOCK to meet device security requirements. LOCKDOWN has dependencies on SOC_INTEL_COMMON_PCH_BASE and several other common block devices. Add COMMON_PCH_BASE and COMMON_PCH_SERVER to pick up LOCKDOWN and the dependencies. COMMON_PCH_SERVER adds the following common devices that were not previously included by XEON_SP: SOC_INTEL_COMMON_BLOCK_CHIP_CONFIG SOC_INTEL_COMMON_BLOCK_CSE SOC_INTEL_COMMON_BLOCK_GPIO_ITSS_POL_CFG SOC_INTEL_COMMON_BLOCK_ITSS SOC_INTEL_COMMON_PCH_LOCKDOWN SOC_INTEL_COMMON_BLOCK_SATA SOC_INTEL_COMMON_BLOCK_SMBUS SOC_INTEL_COMMON_BLOCK_XHCI Change-Id: Iab97123e487f4f13f874f364a9c51723d234d4f0 Signed-off-by: Marc Jones <marcjones@sysproconsulting.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/49849 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Jay Talbott <JayTalbott@sysproconsulting.com> Reviewed-by: Stefan Reinauer <stefan.reinauer@coreboot.org>
2021-01-21 18:53:47 +01:00
#include <soc/pm.h>
static void lpc_lockdown_config(int chipset_lockdown)
{
/* Set BIOS Interface Lock, BIOS Lock */
if (chipset_lockdown == CHIPSET_LOCKDOWN_COREBOOT) {
lpc_set_bios_interface_lock_down();
lpc_set_lock_enable();
}
}
soc/intel/xeon_sp: Set SMI lock Prevent writes to Global SMI enable as recommended by the BWG. Change-Id: I7824464e53a2ca1e860c1aa40d8a7d26e948c418 Signed-off-by: Marc Jones <marcjones@sysproconsulting.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/51226 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Jay Talbott <JayTalbott@sysproconsulting.com> Reviewed-by: Stefan Reinauer <stefan.reinauer@coreboot.org>
2021-03-02 23:16:25 +01:00
static void pmc_lockdown_config(int chipset_lockdown)
soc/intel/xeon_sp: Add PCH lockdown Add SOC_INTEL_COMMON_PCH_LOCKDOWN and PMC_GLOBAL_RESET_ENABLE_LOCK to meet device security requirements. LOCKDOWN has dependencies on SOC_INTEL_COMMON_PCH_BASE and several other common block devices. Add COMMON_PCH_BASE and COMMON_PCH_SERVER to pick up LOCKDOWN and the dependencies. COMMON_PCH_SERVER adds the following common devices that were not previously included by XEON_SP: SOC_INTEL_COMMON_BLOCK_CHIP_CONFIG SOC_INTEL_COMMON_BLOCK_CSE SOC_INTEL_COMMON_BLOCK_GPIO_ITSS_POL_CFG SOC_INTEL_COMMON_BLOCK_ITSS SOC_INTEL_COMMON_PCH_LOCKDOWN SOC_INTEL_COMMON_BLOCK_SATA SOC_INTEL_COMMON_BLOCK_SMBUS SOC_INTEL_COMMON_BLOCK_XHCI Change-Id: Iab97123e487f4f13f874f364a9c51723d234d4f0 Signed-off-by: Marc Jones <marcjones@sysproconsulting.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/49849 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Jay Talbott <JayTalbott@sysproconsulting.com> Reviewed-by: Stefan Reinauer <stefan.reinauer@coreboot.org>
2021-01-21 18:53:47 +01:00
{
uint8_t *pmcbase;
u32 pmsyncreg;
/* PMSYNC */
pmcbase = pmc_mmio_regs();
pmsyncreg = read32(pmcbase + PMSYNC_TPR_CFG);
pmsyncreg |= PMSYNC_LOCK;
write32(pmcbase + PMSYNC_TPR_CFG, pmsyncreg);
/* Make sure payload/OS can't trigger global reset */
pmc_global_reset_disable_and_lock();
soc/intel/xeon_sp: Set SATA REGLOCKs Set the SATA and SSATA REGLOCK as indicated by the Intel documentation. Change-Id: I90e6d0e3b5a38bcd5392e26cbbb6dc4aa6a8304b Signed-off-by: Marc Jones <marcjones@sysproconsulting.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/52162 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Jay Talbott <JayTalbott@sysproconsulting.com> Reviewed-by: Stefan Reinauer <stefan.reinauer@coreboot.org> Reviewed-by: Angel Pons <th3fanbus@gmail.com>
2021-04-06 22:29:37 +02:00
/* Lock PMC stretch policy */
pci_or_config32(PCH_DEV_PMC, GEN_PMCON_B, SLP_STR_POL_LOCK);
}
static void sata_lockdown_config(int chipset_lockdown)
{
if (chipset_lockdown == CHIPSET_LOCKDOWN_COREBOOT) {
pci_or_config32(PCH_DEV_SATA, SATAGC, SATAGC_REGLOCK);
pci_or_config32(PCH_DEV_SSATA, SATAGC, SATAGC_REGLOCK);
}
soc/intel/xeon_sp: Add PCH lockdown Add SOC_INTEL_COMMON_PCH_LOCKDOWN and PMC_GLOBAL_RESET_ENABLE_LOCK to meet device security requirements. LOCKDOWN has dependencies on SOC_INTEL_COMMON_PCH_BASE and several other common block devices. Add COMMON_PCH_BASE and COMMON_PCH_SERVER to pick up LOCKDOWN and the dependencies. COMMON_PCH_SERVER adds the following common devices that were not previously included by XEON_SP: SOC_INTEL_COMMON_BLOCK_CHIP_CONFIG SOC_INTEL_COMMON_BLOCK_CSE SOC_INTEL_COMMON_BLOCK_GPIO_ITSS_POL_CFG SOC_INTEL_COMMON_BLOCK_ITSS SOC_INTEL_COMMON_PCH_LOCKDOWN SOC_INTEL_COMMON_BLOCK_SATA SOC_INTEL_COMMON_BLOCK_SMBUS SOC_INTEL_COMMON_BLOCK_XHCI Change-Id: Iab97123e487f4f13f874f364a9c51723d234d4f0 Signed-off-by: Marc Jones <marcjones@sysproconsulting.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/49849 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Jay Talbott <JayTalbott@sysproconsulting.com> Reviewed-by: Stefan Reinauer <stefan.reinauer@coreboot.org>
2021-01-21 18:53:47 +01:00
}
void soc_lockdown_config(int chipset_lockdown)
{
lpc_lockdown_config(chipset_lockdown);
soc/intel/xeon_sp: Set SMI lock Prevent writes to Global SMI enable as recommended by the BWG. Change-Id: I7824464e53a2ca1e860c1aa40d8a7d26e948c418 Signed-off-by: Marc Jones <marcjones@sysproconsulting.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/51226 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Jay Talbott <JayTalbott@sysproconsulting.com> Reviewed-by: Stefan Reinauer <stefan.reinauer@coreboot.org>
2021-03-02 23:16:25 +01:00
pmc_lockdown_config(chipset_lockdown);
soc/intel/xeon_sp: Set SATA REGLOCKs Set the SATA and SSATA REGLOCK as indicated by the Intel documentation. Change-Id: I90e6d0e3b5a38bcd5392e26cbbb6dc4aa6a8304b Signed-off-by: Marc Jones <marcjones@sysproconsulting.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/52162 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Jay Talbott <JayTalbott@sysproconsulting.com> Reviewed-by: Stefan Reinauer <stefan.reinauer@coreboot.org> Reviewed-by: Angel Pons <th3fanbus@gmail.com>
2021-04-06 22:29:37 +02:00
sata_lockdown_config(chipset_lockdown);
soc/intel/xeon_sp: Add PCH lockdown Add SOC_INTEL_COMMON_PCH_LOCKDOWN and PMC_GLOBAL_RESET_ENABLE_LOCK to meet device security requirements. LOCKDOWN has dependencies on SOC_INTEL_COMMON_PCH_BASE and several other common block devices. Add COMMON_PCH_BASE and COMMON_PCH_SERVER to pick up LOCKDOWN and the dependencies. COMMON_PCH_SERVER adds the following common devices that were not previously included by XEON_SP: SOC_INTEL_COMMON_BLOCK_CHIP_CONFIG SOC_INTEL_COMMON_BLOCK_CSE SOC_INTEL_COMMON_BLOCK_GPIO_ITSS_POL_CFG SOC_INTEL_COMMON_BLOCK_ITSS SOC_INTEL_COMMON_PCH_LOCKDOWN SOC_INTEL_COMMON_BLOCK_SATA SOC_INTEL_COMMON_BLOCK_SMBUS SOC_INTEL_COMMON_BLOCK_XHCI Change-Id: Iab97123e487f4f13f874f364a9c51723d234d4f0 Signed-off-by: Marc Jones <marcjones@sysproconsulting.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/49849 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Jay Talbott <JayTalbott@sysproconsulting.com> Reviewed-by: Stefan Reinauer <stefan.reinauer@coreboot.org>
2021-01-21 18:53:47 +01:00
}
Reference in a new issue Copy permalink