soc/intel/denverton_ns: Implement AES-NI Lock

Change-Id: I6cf3484e46eebd3dc753d0903ea8555712b99b7e
Signed-off-by: Julien Viard de Galbert <jviarddegalbert@online.net>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/25440
Reviewed-by: Angel Pons <th3fanbus@gmail.com>
Reviewed-by: Steve Mooney
Reviewed-by: David Guckian
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>

src/soc/intel/denverton_ns/cpu.c

@@ -74,6 +74,13 @@ static void denverton_core_init(struct device *cpu)
 	msr.lo |= FAST_STRINGS_ENABLE_BIT;
 	wrmsr(IA32_MISC_ENABLE, msr);
 
+	/* Lock AES-NI only if supported */
+	if (cpuid_ecx(1) & (1 << 25)) {
+		msr = rdmsr(MSR_FEATURE_CONFIG);
+		msr.lo |= FEATURE_CONFIG_LOCK;		/* Lock AES-NI */
+		wrmsr(MSR_FEATURE_CONFIG, msr);
+	}
+
 	/* Enable Turbo */
 	enable_turbo();
 

src/soc/intel/denverton_ns/include/soc/msr.h

@@ -23,6 +23,8 @@
 #define MSR_PKG_CST_CONFIG_CONTROL 0xe2
 #define MSR_PMG_IO_CAPTURE_BASE 0xe4
 #define MSR_FEATURE_CONFIG 0x13c
+#define   FEATURE_CONFIG_RESERVED_MASK	0x3ULL
+#define   FEATURE_CONFIG_LOCK	(1 << 0)
 #define IA32_MCG_CAP			0x179
 #define  IA32_MCG_CAP_COUNT_MASK	0xff
 #define  IA32_MCG_CAP_CTL_P_BIT		8