soc/intel/skylake: Skip Spi Flash Lockdown from FSP

coreboot was setting SPI FPR register to protect the
mrc_cache data range stored in flash. This programming was being done
after FSP Notify 1.
But, FSP was locking the SPI by setting FLOCKDN Bit during Notify
phase 1, due to which coreboot was unable to protect that range.

As solution, FSP introduced a new UPD SpiFlashCfgLockDown to skip
the lockdown of flash on interest of bootloader. Set that UPD to 0
to skip the lockdown of FAST_SPI flash from FSP.

The same is being done from coreboot after end of Post at finalize.c
file.

BUG=b:63049493
BRANCH=none
TEST=FPR can be set properly to protect the mrc_cache range. The
issue reported in the bug doesn't come when both software and
hardware WP is enabled with this patch.

Change-Id: I3ffca2f1b05ab2e4ef631275ef7c3a6e23e393aa
Signed-off-by: Barnali Sarkar <barnali.sarkar@intel.com>
Reviewed-on: https://review.coreboot.org/20645
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Furquan Shaikh <furquan@google.com>
Reviewed-by: Aaron Durbin <adurbin@chromium.org>

src/soc/intel/skylake/chip.h

@@ -487,6 +487,14 @@ struct soc_intel_skylake_config {
 	 * 0b - Disabled
 	 */
 	u8 eist_enable;
+	/*
+	 * Skip Spi Flash Lockdown from inside FSP.
+	 * Making this config "0" means FSP won't set the FLOCKDN bit of
+	 * SPIBAR + 0x04 (i.e., Bit 15 of BIOS_HSFSTS_CTL).
+	 * So, it becomes coreboot's responsibility to set this bit before
+	 * end of POST for security concerns.
+	 */
+	u8 SpiFlashCfgLockDown;
 };
 
 typedef struct soc_intel_skylake_config config_t;

src/soc/intel/skylake/chip_fsp20.c

@@ -239,6 +239,15 @@ void platform_fsp_silicon_init_params_cb(FSPS_UPD *supd)
 	dev = dev_find_slot(0, PCH_DEVFN_SPI);
 	params->ShowSpiController = dev->enabled;
 
+	/*
+	 * Skip Spi Flash Lockdown from inside FSP.
+	 * Making this config "0" means FSP won't set the FLOCKDN bit of
+	 * SPIBAR + 0x04 (i.e., Bit 15 of BIOS_HSFSTS_CTL).
+	 * So, it becomes coreboot's responsibility to set this bit before
+	 * end of POST for security concerns.
+	 */
+	params->SpiFlashCfgLockDown = config->SpiFlashCfgLockDown;
+
 	/*
 	 * Send VR specific mailbox commands:
 	 * 000b - no VR specific command sent