From 3fda3c2f8d61e7b5d23534ecdcb580005dff6292 Mon Sep 17 00:00:00 2001 From: Martin Roth Date: Thu, 9 Jul 2015 21:02:26 -0600 Subject: [PATCH] Move final Intel chipsets with ME to intel/common/firmware This switches the final 4 Intel platforms that use ME firmware from using code specific to the platform to the common IFD Kconfig and Makefile. braswell, broadwell, bd82x6x (cougar point & panther point) and ibexpeak Change-Id: Id3bec6dbe2e1a8a90f51d9378150dbb44258b596 Signed-off-by: Martin Roth Reviewed-on: http://review.coreboot.org/10876 Tested-by: build bot (Jenkins) Reviewed-by: Patrick Georgi Reviewed-by: Stefan Reinauer Reviewed-by: Paul Menzel --- src/soc/intel/braswell/Kconfig | 68 +--------------- src/soc/intel/braswell/Makefile.inc | 51 +----------- src/soc/intel/broadwell/Kconfig | 69 +--------------- src/soc/intel/broadwell/Makefile.inc | 46 +---------- src/southbridge/intel/bd82x6x/Kconfig | 88 +-------------------- src/southbridge/intel/bd82x6x/Makefile.inc | 53 +------------ src/southbridge/intel/ibexpeak/Kconfig | 63 +-------------- src/southbridge/intel/ibexpeak/Makefile.inc | 51 +----------- 8 files changed, 16 insertions(+), 473 deletions(-) diff --git a/src/soc/intel/braswell/Kconfig b/src/soc/intel/braswell/Kconfig index ab99a08724..043dc1a43a 100644 --- a/src/soc/intel/braswell/Kconfig +++ b/src/soc/intel/braswell/Kconfig @@ -47,6 +47,7 @@ config CPU_SPECIFIC_OPTIONS select TSC_SYNC_MFENCE select UDELAY_TSC select USE_GENERIC_FSP_CAR_INC + select HAVE_INTEL_FIRMWARE config BOOTBLOCK_CPU_INIT string @@ -116,19 +117,6 @@ config RESET_ON_INVALID_RAMSTAGE_CACHE the system will reset otherwise the ramstage will be reloaded from cbfs. -config LOCK_MANAGEMENT_ENGINE - bool "Lock Management Engine section" - default n - help - The Intel Management Engine supports preventing write accesses - from the host to the Management Engine section in the firmware - descriptor. If the ME section is locked, it can only be overwritten - with an external SPI flash programmer. You will want this if you - want to increase security of your ROM image once you are sure - that the ME firmware is no longer going to change. - - If unsure, say N. - config ENABLE_BUILTIN_COM1 bool "Enable builtin COM1 Serial Port" default n @@ -138,66 +126,18 @@ config ENABLE_BUILTIN_COM1 the debug console. config HAVE_IFD_BIN - bool - default y + def_bool y config BUILD_WITH_FAKE_IFD - bool "Build with a fake IFD" - default y if !HAVE_IFD_BIN - help - If you don't have an Intel Firmware Descriptor (ifd.bin) for your - board, you can select this option and coreboot will build without it. - Though, the resulting coreboot.rom will not contain all parts required - to get coreboot running on your board. You can however write only the - BIOS section to your board's flash ROM and keep the other sections - untouched. Unfortunately the current version of flashrom doesn't - support this yet. But there is a patch pending [1]. - - WARNING: Never write a complete coreboot.rom to your flash ROM if it - was built with a fake IFD. It just won't work. - - [1] http://www.flashrom.org/pipermail/flashrom/2013-June/011083.html + def_bool !HAVE_IFD_BIN config HAVE_ME_BIN - bool "Add Intel Management Engine firmware" - default y - help - The Intel processor in the selected system requires a special firmware - for an integrated controller called Management Engine (ME). The ME - firmware might be provided in coreboot's 3rdparty/blobs repository. If - not and if you don't have the firmware elsewhere, you can still - build coreboot without it. In this case however, you'll have to make - sure that you don't overwrite your ME firmware on your flash ROM. + def_bool y config IED_REGION_SIZE hex default 0x400000 -config IFD_BIN_PATH - string "Path to intel firmware descriptor" - depends on !BUILD_WITH_FAKE_IFD - default "3rdparty/blobs/mainboard/$(MAINBOARDDIR)/descriptor.bin" - -config IFD_BIOS_SECTION - depends on BUILD_WITH_FAKE_IFD - string - default "" - -config IFD_ME_SECTION - depends on BUILD_WITH_FAKE_IFD - string - default "" - -config IFD_PLATFORM_SECTION - depends on BUILD_WITH_FAKE_IFD - string - default "" - -config ME_BIN_PATH - string "Path to management engine firmware" - depends on HAVE_ME_BIN - default "3rdparty/blobs/mainboard/$(MAINBOARDDIR)/me.bin" - config CHIPSET_BOOTBLOCK_INCLUDE string default "soc/intel/braswell/bootblock/timestamp.inc" diff --git a/src/soc/intel/braswell/Makefile.inc b/src/soc/intel/braswell/Makefile.inc index fae97b8219..eda9f76119 100644 --- a/src/soc/intel/braswell/Makefile.inc +++ b/src/soc/intel/braswell/Makefile.inc @@ -8,6 +8,7 @@ subdirs-y += ../../../cpu/x86/smm subdirs-y += ../../../cpu/x86/tsc subdirs-y += ../../../cpu/intel/microcode subdirs-y += ../../../cpu/intel/turbo +subdirs-y += ../../../southbridge/intel/common/firmware romstage-y += gpio_support.c romstage-y += iosf.c @@ -56,54 +57,4 @@ CPPFLAGS_common += -I$(src)/soc/intel/braswell/include CPPFLAGS_common += -I3rdparty/blobs/mainboard/$(CONFIG_MAINBOARD_DIR) -# Run an intermediate step when producing coreboot.rom -# that adds additional components to the final firmware -# image outside of CBFS -INTERMEDIATE := pch_add_me - -ifeq ($(CONFIG_BUILD_WITH_FAKE_IFD),y) -IFD_BIN_PATH := $(objgenerated)/ifdfake.bin -IFD_SECTIONS := $(addprefix -b ,$(CONFIG_IFD_BIOS_SECTION:"%"=%)) \ - $(addprefix -m ,$(CONFIG_IFD_ME_SECTION:"%"=%)) \ - $(addprefix -p ,$(CONFIG_IFD_PLATFORM_SECTION:"%"=%)) -else -IFD_BIN_PATH := $(CONFIG_IFD_BIN_PATH) -endif - -pch_add_me: $(obj)/coreboot.pre $(IFDTOOL) $(IFDFAKE) -ifeq ($(CONFIG_BUILD_WITH_FAKE_IFD),y) - printf "\n** WARNING **\n" - printf "Coreboot will be built with a fake Intel Firmware Descriptor (IFD).\n" - printf "Never write a complete coreboot.rom with a fake IFD to your board's\n" - printf "flash ROM! Make sure that you only write valid flash regions.\n\n" - printf " IFDFAKE Building a fake Intel Firmware Descriptor\n" - $(IFDFAKE) $(IFD_SECTIONS) $(IFD_BIN_PATH) -endif - printf " DD Adding Intel Firmware Descriptor\n" - printf "CONFIG_IFD_BIN_PATH: $(CONFIG_IFD_BIN_PATH)\n" - printf "IFD_BIN_PATH: $(IFD_BIN_PATH)\n" - dd if=$(IFD_BIN_PATH) \ - of=$(obj)/coreboot.pre conv=notrunc >/dev/null 2>&1 - printf "CONFIG_HAVE_ME_BIN: $(CONFIG_HAVE_ME_BIN)\n" -ifeq ($(CONFIG_HAVE_ME_BIN),y) - printf " IFDTOOL me.bin -> coreboot.pre\n" - printf "CONFIG_ME_BIN_PATH: $(CONFIG_ME_BIN_PATH)\n" - $(objutil)/ifdtool/ifdtool \ - -i ME:$(CONFIG_ME_BIN_PATH) \ - $(obj)/coreboot.pre - mv $(obj)/coreboot.pre.new $(obj)/coreboot.pre -endif - -ifeq ($(CONFIG_LOCK_MANAGEMENT_ENGINE),y) - printf " IFDTOOL Locking Management Engine\n" - $(objutil)/ifdtool/ifdtool -l $(obj)/coreboot.pre - mv $(obj)/coreboot.pre.new $(obj)/coreboot.pre -else - printf " IFDTOOL Unlocking Management Engine\n" - $(objutil)/ifdtool/ifdtool -u $(obj)/coreboot.pre - mv $(obj)/coreboot.pre.new $(obj)/coreboot.pre -endif - -PHONY += pch_add_me - endif diff --git a/src/soc/intel/broadwell/Kconfig b/src/soc/intel/broadwell/Kconfig index c2db2a1e52..e01d5598ec 100644 --- a/src/soc/intel/broadwell/Kconfig +++ b/src/soc/intel/broadwell/Kconfig @@ -41,6 +41,7 @@ config CPU_SPECIFIC_OPTIONS select TSC_SYNC_MFENCE select UDELAY_TSC select SOC_INTEL_COMMON + select HAVE_INTEL_FIRMWARE config BOOTBLOCK_CPU_INIT string @@ -203,74 +204,10 @@ config REFCODE_BLOB_FILE endif # HAVE_REFCODE_BLOB config HAVE_ME_BIN - bool "Add Intel Management Engine firmware" - default y - help - The Intel processor in the selected system requires a special firmware - for an integrated controller called Management Engine (ME). The ME - firmware might be provided in coreboot's 3rdparty/blobs repository. If - not and if you don't have the firmware elsewhere, you can still - build coreboot without it. In this case however, you'll have to make - sure that you don't overwrite your ME firmware on your flash ROM. - -config ME_BIN_PATH - string "Path to management engine firmware" - depends on HAVE_ME_BIN - default "3rdparty/blobs/mainboard/$(MAINBOARDDIR)/me.bin" - -config HAVE_IFD_BIN - bool "Use Intel Firmware Descriptor from existing binary" - default n + def_bool y config BUILD_WITH_FAKE_IFD - bool "Build with a fake IFD" - default y if !HAVE_IFD_BIN - help - If you don't have an Intel Firmware Descriptor (ifd.bin) for your - board, you can select this option and coreboot will build without it. - Though, the resulting coreboot.rom will not contain all parts required - to get coreboot running on your board. You can however write only the - BIOS section to your board's flash ROM and keep the other sections - untouched. Unfortunately the current version of flashrom doesn't - support this yet. But there is a patch pending [1]. - - WARNING: Never write a complete coreboot.rom to your flash ROM if it - was built with a fake IFD. It just won't work. - - [1] http://www.flashrom.org/pipermail/flashrom/2013-June/011083.html - -config IFD_BIOS_SECTION - depends on BUILD_WITH_FAKE_IFD - string - default "" - -config IFD_ME_SECTION - depends on BUILD_WITH_FAKE_IFD - string - default "" - -config IFD_PLATFORM_SECTION - depends on BUILD_WITH_FAKE_IFD - string - default "" - -config IFD_BIN_PATH - string "Path to intel firmware descriptor" - depends on !BUILD_WITH_FAKE_IFD - default "3rdparty/blobs/mainboard/$(MAINBOARDDIR)/descriptor.bin" - -config LOCK_MANAGEMENT_ENGINE - bool "Lock Management Engine section" - default n - help - The Intel Management Engine supports preventing write accesses - from the host to the Management Engine section in the firmware - descriptor. If the ME section is locked, it can only be overwritten - with an external SPI flash programmer. You will want this if you - want to increase security of your ROM image once you are sure - that the ME firmware is no longer going to change. - - If unsure, say N. + def_bool !HAVE_IFD_BIN config CHIPSET_BOOTBLOCK_INCLUDE string diff --git a/src/soc/intel/broadwell/Makefile.inc b/src/soc/intel/broadwell/Makefile.inc index ca295fc0d0..183c40fac4 100644 --- a/src/soc/intel/broadwell/Makefile.inc +++ b/src/soc/intel/broadwell/Makefile.inc @@ -8,6 +8,7 @@ subdirs-y += ../../../cpu/x86/smm subdirs-y += ../../../cpu/x86/tsc subdirs-y += ../../../cpu/intel/microcode subdirs-y += ../../../cpu/intel/turbo +subdirs-y += ../../../southbridge/intel/common/firmware ramstage-y += acpi.c ramstage-y += adsp.c @@ -75,51 +76,6 @@ endif CPPFLAGS_common += -Isrc/soc/intel/broadwell/include -# Run an intermediate step when producing coreboot.rom -# that adds additional components to the final firmware -# image outside of CBFS -INTERMEDIATE := broadwell_add_me - -ifeq ($(CONFIG_BUILD_WITH_FAKE_IFD),y) -IFD_BIN_PATH := $(objgenerated)/ifdfake.bin -IFD_SECTIONS := $(addprefix -b ,$(CONFIG_IFD_BIOS_SECTION:"%"=%)) \ - $(addprefix -m ,$(CONFIG_IFD_ME_SECTION:"%"=%)) \ - $(addprefix -p ,$(CONFIG_IFD_PLATFORM_SECTION:"%"=%)) -else -IFD_BIN_PATH := $(CONFIG_IFD_BIN_PATH) -endif - -broadwell_add_me: $(obj)/coreboot.pre $(IFDTOOL) $(IFDFAKE) -ifeq ($(CONFIG_BUILD_WITH_FAKE_IFD),y) - printf "\n** WARNING **\n" - printf "Coreboot will be built with a fake Intel Firmware Descriptor (IFD).\n" - printf "Never write a complete coreboot.rom with a fake IFD to your board's\n" - printf "flash ROM! Make sure that you only write valid flash regions.\n\n" - printf " IFDFAKE Building a fake Intel Firmware Descriptor\n" - $(IFDFAKE) $(IFD_SECTIONS) $(IFD_BIN_PATH) -endif - printf " DD Adding Intel Firmware Descriptor\n" - dd if=$(IFD_BIN_PATH) \ - of=$(obj)/coreboot.pre conv=notrunc >/dev/null 2>&1 -ifeq ($(CONFIG_HAVE_ME_BIN),y) - printf " IFDTOOL me.bin -> coreboot.pre\n" - $(objutil)/ifdtool/ifdtool \ - -i ME:$(CONFIG_ME_BIN_PATH) \ - $(obj)/coreboot.pre - mv $(obj)/coreboot.pre.new $(obj)/coreboot.pre -ifeq ($(CONFIG_LOCK_MANAGEMENT_ENGINE),y) - printf " IFDTOOL Locking Management Engine\n" - $(objutil)/ifdtool/ifdtool -l $(obj)/coreboot.pre - mv $(obj)/coreboot.pre.new $(obj)/coreboot.pre -else - printf " IFDTOOL Unlocking Management Engine\n" - $(objutil)/ifdtool/ifdtool -u $(obj)/coreboot.pre - mv $(obj)/coreboot.pre.new $(obj)/coreboot.pre -endif -endif - -PHONY += broadwell_add_me - # If an MRC file is an ELF file determine the entry address and first loadable # section offset in the file. Subtract the offset from the entry address to # determine the final location. diff --git a/src/southbridge/intel/bd82x6x/Kconfig b/src/southbridge/intel/bd82x6x/Kconfig index 3a68fec841..9bdeefac3b 100644 --- a/src/southbridge/intel/bd82x6x/Kconfig +++ b/src/southbridge/intel/bd82x6x/Kconfig @@ -38,6 +38,7 @@ config SOUTH_BRIDGE_OPTIONS # dummy select SPI_FLASH select COMMON_FADT select ACPI_SATA_GENERATOR + select HAVE_INTEL_FIRMWARE config EHCI_BAR hex @@ -63,93 +64,10 @@ config HPET_MIN_TICKS default 0x80 config HAVE_IFD_BIN - bool - default y + def_bool y config BUILD_WITH_FAKE_IFD - bool "Build with a fake IFD" - default y if !HAVE_IFD_BIN - help - If you don't have an Intel Firmware Descriptor (ifd.bin) for your - board, you can select this option and coreboot will build without it. - Though, the resulting coreboot.rom will not contain all parts required - to get coreboot running on your board. You can however write only the - BIOS section to your board's flash ROM and keep the other sections - untouched. Unfortunately the current version of flashrom doesn't - support this yet. But there is a patch pending [1]. - - WARNING: Never write a complete coreboot.rom to your flash ROM if it - was built with a fake IFD. It just won't work. - - [1] http://www.flashrom.org/pipermail/flashrom/2013-June/011083.html - -config IFD_BIOS_SECTION - depends on BUILD_WITH_FAKE_IFD - string - default "" - -config IFD_ME_SECTION - depends on BUILD_WITH_FAKE_IFD - string - default "" - -config IFD_GBE_SECTION - depends on BUILD_WITH_FAKE_IFD - string - default "" - -config IFD_PLATFORM_SECTION - depends on BUILD_WITH_FAKE_IFD - string - default "" - -config IFD_BIN_PATH - string "Path to intel firmware descriptor" - depends on !BUILD_WITH_FAKE_IFD - default "3rdparty/blobs/mainboard/$(MAINBOARDDIR)/descriptor.bin" - -config HAVE_GBE_BIN - bool "Add gigabit ethernet firmware" - default n - help - The integrated gigabit ethernet controller needs a firmware file. - Select this if you are going to use the PCH integrated controller - and have the firmware. - -config GBE_BIN_PATH - string "Path to gigabit ethernet firmware" - depends on HAVE_GBE_BIN - default "3rdparty/blobs/mainboard/$(MAINBOARDDIR)/gbe.bin" - -config HAVE_ME_BIN - bool "Add Intel Management Engine firmware" - default y - help - The Intel processor in the selected system requires a special firmware - for an integrated controller called Management Engine (ME). The ME - firmware might be provided in coreboot's 3rdparty/blobs repository. If - not and if you don't have the firmware elsewhere, you can still - build coreboot without it. In this case however, you'll have to make - sure that you don't overwrite your ME firmware on your flash ROM. - -config ME_BIN_PATH - string "Path to management engine firmware" - depends on HAVE_ME_BIN - default "3rdparty/blobs/mainboard/$(MAINBOARDDIR)/me.bin" - -config LOCK_MANAGEMENT_ENGINE - bool "Lock Management Engine section" - depends on !BUILD_WITH_FAKE_IFD - default n - help - The Intel Management Engine supports preventing write accesses - from the host to the Management Engine section in the firmware - descriptor. If the ME section is locked, it can only be overwritten - with an external SPI flash programmer. You will want this if you - want to increase security of your ROM image once you are sure - that the ME firmware is no longer going to change. - - If unsure, say N. + def_bool !HAVE_IFD_BIN endif diff --git a/src/southbridge/intel/bd82x6x/Makefile.inc b/src/southbridge/intel/bd82x6x/Makefile.inc index a7b509c20d..9214450702 100644 --- a/src/southbridge/intel/bd82x6x/Makefile.inc +++ b/src/southbridge/intel/bd82x6x/Makefile.inc @@ -19,10 +19,7 @@ ifeq ($(CONFIG_SOUTHBRIDGE_INTEL_C216)$(CONFIG_SOUTHBRIDGE_INTEL_BD82X6X),y) -# Run an intermediate step when producing coreboot.rom -# that adds additional components to the final firmware -# image outside of CBFS -INTERMEDIATE+=bd82x6x_add_me +subdirs-y += ../common/firmware ramstage-y += pch.c ramstage-y += azalia.c @@ -62,52 +59,4 @@ romstage-$(CONFIG_NORTHBRIDGE_INTEL_SANDYBRIDGE_NATIVE) += early_thermal.c early ramstage-y += madt.c -ifeq ($(CONFIG_BUILD_WITH_FAKE_IFD),y) -IFD_BIN_PATH := $(objgenerated)/ifdfake.bin -IFD_SECTIONS := $(addprefix -b ,$(CONFIG_IFD_BIOS_SECTION:"%"=%)) \ - $(addprefix -m ,$(CONFIG_IFD_ME_SECTION:"%"=%)) \ - $(addprefix -g ,$(CONFIG_IFD_GBE_SECTION:"%"=%)) \ - $(addprefix -p ,$(CONFIG_IFD_PLATFORM_SECTION:"%"=%)) -else -IFD_BIN_PATH := $(CONFIG_IFD_BIN_PATH) -endif - -bd82x6x_add_me: $(obj)/coreboot.pre $(IFDTOOL) $(IFDFAKE) -ifeq ($(CONFIG_BUILD_WITH_FAKE_IFD),y) - printf "\n** WARNING **\n" - printf "Coreboot will be built with a fake Intel Firmware Descriptor (IFD).\n" - printf "Never write a complete coreboot.rom with a fake IFD to your board's\n" - printf "flash ROM! Make sure that you only write valid flash regions.\n\n" - printf " IFDFAKE Building a fake Intel Firmware Descriptor\n" - $(IFDFAKE) $(IFD_SECTIONS) $(IFD_BIN_PATH) -endif - printf " DD Adding Intel Firmware Descriptor\n" - dd if=$(IFD_BIN_PATH) \ - of=$(obj)/coreboot.pre conv=notrunc >/dev/null 2>&1 -ifeq ($(CONFIG_HAVE_ME_BIN),y) - printf " IFDTOOL me.bin -> coreboot.pre\n" - $(objutil)/ifdtool/ifdtool \ - -i ME:$(CONFIG_ME_BIN_PATH) \ - $(obj)/coreboot.pre - mv $(obj)/coreboot.pre.new $(obj)/coreboot.pre -endif -ifeq ($(CONFIG_HAVE_GBE_BIN),y) - printf " IFDTOOL gbe.bin -> coreboot.pre\n" - $(objutil)/ifdtool/ifdtool \ - -i GbE:$(CONFIG_GBE_BIN_PATH) \ - $(obj)/coreboot.pre - mv $(obj)/coreboot.pre.new $(obj)/coreboot.pre -endif -ifeq ($(CONFIG_LOCK_MANAGEMENT_ENGINE),y) - printf " IFDTOOL Locking Management Engine\n" - $(objutil)/ifdtool/ifdtool -l $(obj)/coreboot.pre - mv $(obj)/coreboot.pre.new $(obj)/coreboot.pre -else ifneq ($(CONFIG_BUILD_WITH_FAKE_IFD),y) - printf " IFDTOOL Unlocking Management Engine\n" - $(objutil)/ifdtool/ifdtool -u $(obj)/coreboot.pre - mv $(obj)/coreboot.pre.new $(obj)/coreboot.pre -endif - -PHONY += bd82x6x_add_me - endif diff --git a/src/southbridge/intel/ibexpeak/Kconfig b/src/southbridge/intel/ibexpeak/Kconfig index f31f83c1a5..a2c51536ec 100644 --- a/src/southbridge/intel/ibexpeak/Kconfig +++ b/src/southbridge/intel/ibexpeak/Kconfig @@ -36,6 +36,7 @@ config SOUTH_BRIDGE_OPTIONS # dummy select HAVE_USBDEBUG_OPTIONS select COMMON_FADT select ACPI_SATA_GENERATOR + select HAVE_INTEL_FIRMWARE config EHCI_BAR hex @@ -57,70 +58,10 @@ config SERIRQ_CONTINUOUS_MODE operated in continuous mode. config BUILD_WITH_FAKE_IFD - bool "Build with a fake IFD" - default y if !HAVE_IFD_BIN - help - If you don't have an Intel Firmware Descriptor (ifd.bin) for your - board, you can select this option and coreboot will build without it. - Though, the resulting coreboot.rom will not contain all parts required - to get coreboot running on your board. You can however write only the - BIOS section to your board's flash ROM and keep the other sections - untouched. Unfortunately the current version of flashrom doesn't - support this yet. But there is a patch pending [1]. - - WARNING: Never write a complete coreboot.rom to your flash ROM if it - was built with a fake IFD. It just won't work. - - [1] http://www.flashrom.org/pipermail/flashrom/2013-June/011083.html - - -config IFD_BIOS_SECTION - depends on BUILD_WITH_FAKE_IFD - string - default "" - -config IFD_ME_SECTION - depends on BUILD_WITH_FAKE_IFD - string - default "" - -config IFD_BIN_PATH - string "Path to intel firmware descriptor" - depends on !BUILD_WITH_FAKE_IFD - default "3rdparty/blobs/mainboard/$(MAINBOARDDIR)/descriptor.bin" - - -config HAVE_ME_BIN - bool "Add Intel Management Engine firmware" - default n - help - The Intel processor in the selected system requires a special firmware - for an integrated controller called Management Engine (ME). The ME - firmware might be provided in coreboot's 3rdparty/blobs repository. If - not and if you don't have the firmware elsewhere, you can still - build coreboot without it. In this case however, you'll have to make - sure that you don't overwrite your ME firmware on your flash ROM. - -config ME_BIN_PATH - string "Path to management engine firmware" - depends on HAVE_ME_BIN - default "3rdparty/blobs/mainboard/$(MAINBOARDDIR)/me.bin" + def_bool !HAVE_IFD_BIN config HPET_MIN_TICKS hex default 0x80 -config LOCK_MANAGEMENT_ENGINE - bool "Lock Management Engine section" - default n - help - The Intel Management Engine supports preventing write accesses - from the host to the Management Engine section in the firmware - descriptor. If the ME section is locked, it can only be overwritten - with an external SPI flash programmer. You will want this if you - want to increase security of your ROM image once you are sure - that the ME firmware is no longer going to change. - - If unsure, say N. - endif diff --git a/src/southbridge/intel/ibexpeak/Makefile.inc b/src/southbridge/intel/ibexpeak/Makefile.inc index 06c585367d..57c498d2f9 100644 --- a/src/southbridge/intel/ibexpeak/Makefile.inc +++ b/src/southbridge/intel/ibexpeak/Makefile.inc @@ -19,10 +19,7 @@ ifeq ($(CONFIG_SOUTHBRIDGE_INTEL_IBEXPEAK),y) -# Run an intermediate step when producing coreboot.rom -# that adds additional components to the final firmware -# image outside of CBFS -INTERMEDIATE+=bd82x6x_add_me +subdirs-y += ../common/firmware ramstage-y += ../bd82x6x/pch.c ramstage-y += azalia.c @@ -57,50 +54,4 @@ romstage-y += ../bd82x6x/early_rcba.c romstage-$(CONFIG_SOUTHBRIDGE_INTEL_BD82X6X) += ../bd82x6x/early_spi.c romstage-$(CONFIG_SOUTHBRIDGE_INTEL_C216) += ../bd82x6x/early_spi.c -ifeq ($(CONFIG_BUILD_WITH_FAKE_IFD),y) -IFD_BIN_PATH := $(objgenerated)/ifdfake.bin -IFD_SECTIONS := $(addprefix -b ,$(CONFIG_IFD_BIOS_SECTION:"%"=%)) \ - $(addprefix -m ,$(CONFIG_IFD_ME_SECTION:"%"=%)) \ - $(addprefix -g ,$(CONFIG_IFD_GBE_SECTION:"%"=%)) \ - $(addprefix -p ,$(CONFIG_IFD_PLATFORM_SECTION:"%"=%)) -else -IFD_BIN_PATH := $(CONFIG_IFD_BIN_PATH) -endif - -bd82x6x_add_me: $(obj)/coreboot.pre $(IFDTOOL) $(IFDFAKE) -ifeq ($(CONFIG_BUILD_WITH_FAKE_IFD),y) - printf "\n** WARNING **\n" - printf "Coreboot will be built with a fake Intel Firmware Descriptor (IFD).\n" - printf "Never write a complete coreboot.rom with a fake IFD to your board's\n" - printf "flash ROM! Make sure that you only write valid flash regions.\n\n" - printf " IFDFAKE Building a fake Intel Firmware Descriptor\n" - $(IFDFAKE) $(IFD_SECTIONS) $(IFD_BIN_PATH) -endif - printf " DD Adding Intel Firmware Descriptor\n" - dd if=$(IFD_BIN_PATH) \ - of=$(obj)/coreboot.pre conv=notrunc >/dev/null 2>&1 -ifeq ($(CONFIG_HAVE_ME_BIN),y) - printf " IFDTOOL me.bin -> coreboot.pre\n" - $(objutil)/ifdtool/ifdtool \ - -i ME:$(CONFIG_ME_BIN_PATH) \ - $(obj)/coreboot.pre - mv $(obj)/coreboot.pre.new $(obj)/coreboot.pre -else - printf "\n** WARNING **\n" - printf "Coreboot will be built without Management Engine firmware.\n" - printf "Never write a complete coreboot.rom without ME to your board's\n" - printf "flash ROM! Make sure that you only write valid flash regions.\n\n" -endif -ifeq ($(CONFIG_LOCK_MANAGEMENT_ENGINE),y) - printf " IFDTOOL Locking Management Engine\n" - $(objutil)/ifdtool/ifdtool -l $(obj)/coreboot.pre - mv $(obj)/coreboot.pre.new $(obj)/coreboot.pre -else ifneq ($(CONFIG_BUILD_WITH_FAKE_IFD),y) - printf " IFDTOOL Unlocking Management Engine\n" - $(objutil)/ifdtool/ifdtool -u $(obj)/coreboot.pre - mv $(obj)/coreboot.pre.new $(obj)/coreboot.pre -endif - -PHONY += bd82x6x_add_me - endif