GNUBoot
/
coreboot-kgpe-d16
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

sb/intel/common: Create a common PCH finalise implementation 

The common finalise code is used by bd82x6x, Lynx Point, and Ibex Peak.

Lynx Point now benefits from being able to write-protect the flash chip.

For Lynx Point, writing the SPI OPMENU now happens in ramstage, as done
in bd82x6x.

Tested on an ASRock H81M-HDS (Lynx Point). When write-protection is
configured, flashrom reports all flash regions as read-only, and does
not manage to alter the contents of the flash chip.

Also tested on an ASUS P8H61-M LX (Cougar Point). Everything seems to
work as before.

Change-Id: I781082b1ed507b00815d1e85aec3e56ae5a4bef2
Signed-off-by: Tristan Corrick <tristan@corrick.kiwi>
Reviewed-on: https://review.coreboot.org/c/29977
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Nico Huber <nico.h@gmx.de>
This commit is contained in:
Tristan Corrick 2018-11-30 22:53:50 +13:00 committed by Patrick Georgi
parent 32ceed8f26
commit 63626b1a4a
20 changed files with 115 additions and 141 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
src/mainboard/lenovo/x201/smihandler.c
View File

@ -20,6 +20,7 @@
#include <southbridge/intel/ibexpeak/nvs.h>
#include <southbridge/intel/ibexpeak/pch.h>
#include <southbridge/intel/ibexpeak/me.h>
#include <southbridge/intel/common/finalize.h>
#include <northbridge/intel/nehalem/nehalem.h>
#include <cpu/intel/model_2065x/model_2065x.h>
#include <ec/acpi/ec.h>

1
src/mainboard/packardbell/ms2290/smihandler.c
View File

@ -19,6 +19,7 @@
#include <southbridge/intel/ibexpeak/nvs.h>
#include <southbridge/intel/ibexpeak/pch.h>
#include <southbridge/intel/ibexpeak/me.h>
#include <southbridge/intel/common/finalize.h>
#include <northbridge/intel/nehalem/nehalem.h>
#include <cpu/intel/model_2065x/model_2065x.h>
#include <ec/acpi/ec.h>

40
src/southbridge/intel/bd82x6x/Kconfig
View File

@ -25,6 +25,7 @@ config SOUTH_BRIDGE_OPTIONS # dummy
def_bool y
select ACPI_INTEL_HARDWARE_SLEEP_VALUES
select SOUTHBRIDGE_INTEL_COMMON
select SOUTHBRIDGE_INTEL_COMMON_FINALIZE
select SOUTHBRIDGE_INTEL_COMMON_RCBA_PIRQ
select SOUTHBRIDGE_INTEL_COMMON_SMBUS
select SOUTHBRIDGE_INTEL_COMMON_SPI
@ -67,42 +68,3 @@ config HPET_MIN_TICKS
default 0x80
endif
if SOUTHBRIDGE_INTEL_BD82X6X || SOUTHBRIDGE_INTEL_C216 || SOUTHBRIDGE_INTEL_IBEXPEAK
choice
prompt "Flash locking during chipset lockdown"
default LOCK_SPI_FLASH_NONE
config LOCK_SPI_FLASH_NONE
bool "Don't lock flash sections"
config LOCK_SPI_FLASH_RO
bool "Write-protect all flash sections"
help
Select this if you want to write-protect the whole firmware flash
chip. The locking will take place during the chipset lockdown, which
is either triggered by coreboot (when INTEL_CHIPSET_LOCKDOWN is set)
or has to be triggered later (e.g. by the payload or the OS).
NOTE: If you trigger the chipset lockdown unconditionally,
you won't be able to write to the flash chip using the
internal programmer any more.
config LOCK_SPI_FLASH_NO_ACCESS
bool "Write-protect all flash sections and read-protect non-BIOS sections"
help
Select this if you want to protect the firmware flash against all
further accesses (with the exception of the memory mapped BIOS re-
gion which is always readable). The locking will take place during
the chipset lockdown, which is either triggered by coreboot (when
INTEL_CHIPSET_LOCKDOWN is set) or has to be triggered later (e.g.
by the payload or the OS).
NOTE: If you trigger the chipset lockdown unconditionally,
you won't be able to write to the flash chip using the
internal programmer any more.
endchoice
endif

2
src/southbridge/intel/bd82x6x/Makefile.inc
View File

@ -35,7 +35,7 @@ ramstage-y += watchdog.c
ramstage-$(CONFIG_ELOG) += elog.c
smm-$(CONFIG_HAVE_SMI_HANDLER) += smihandler.c me.c me_8.x.c finalize.c pch.c
smm-$(CONFIG_HAVE_SMI_HANDLER) += smihandler.c me.c me_8.x.c pch.c
romstage-y += early_smbus.c me_status.c
romstage-y += early_spi.c early_pch_common.c

4
src/southbridge/intel/bd82x6x/pch.h
View File

@ -56,10 +56,6 @@
#ifndef __ACPI__
#define DEBUG_PERIODIC_SMIS 0
#if defined(__SMM__) && !defined(__ASSEMBLER__)
void intel_pch_finalize_smm(void);
#endif
#if !defined(__ASSEMBLER__)
#if !defined(__PRE_RAM__)
#if !defined(__SIMPLE_DEVICE__)

1
src/southbridge/intel/bd82x6x/smihandler.c
View File

@ -32,6 +32,7 @@
#include <southbridge/intel/common/gpio.h>
#include <cpu/intel/model_206ax/model_206ax.h>
#include <southbridge/intel/common/pmutil.h>
#include <southbridge/intel/common/finalize.h>
static global_nvs_t *gnvs;
global_nvs_t *smm_get_gnvs(void)

42
src/southbridge/intel/common/Kconfig
View File

@ -33,6 +33,9 @@ config SOUTHBRIDGE_INTEL_COMMON_SMM
config SOUTHBRIDGE_INTEL_COMMON_ACPI_MADT
bool
config SOUTHBRIDGE_INTEL_COMMON_FINALIZE
bool
config INTEL_DESCRIPTOR_MODE_CAPABLE
def_bool n
help
@ -55,3 +58,42 @@ config INTEL_CHIPSET_LOCKDOWN
locked down on each normal boot path (done by either coreboot or payload)
and S3 resume (always done by coreboot). Select this to let coreboot
to do this on normal boot path.
if SOUTHBRIDGE_INTEL_COMMON_FINALIZE
choice
prompt "Flash locking during chipset lockdown"
default LOCK_SPI_FLASH_NONE
config LOCK_SPI_FLASH_NONE
bool "Don't lock flash sections"
config LOCK_SPI_FLASH_RO
bool "Write-protect all flash sections"
help
Select this if you want to write-protect the whole firmware flash
chip. The locking will take place during the chipset lockdown, which
is either triggered by coreboot (when INTEL_CHIPSET_LOCKDOWN is set)
or has to be triggered later (e.g. by the payload or the OS).
NOTE: If you trigger the chipset lockdown unconditionally,
you won't be able to write to the flash chip using the
internal programmer any more.
config LOCK_SPI_FLASH_NO_ACCESS
bool "Write-protect all flash sections and read-protect non-BIOS sections"
help
Select this if you want to protect the firmware flash against all
further accesses (with the exception of the memory mapped BIOS re-
gion which is always readable). The locking will take place during
the chipset lockdown, which is either triggered by coreboot (when
INTEL_CHIPSET_LOCKDOWN is set) or has to be triggered later (e.g.
by the payload or the OS).
NOTE: If you trigger the chipset lockdown unconditionally,
you won't be able to write to the flash chip using the
internal programmer any more.
endchoice
endif

2
src/southbridge/intel/common/Makefile.inc
View File

@ -54,6 +54,8 @@ smm-$(CONFIG_SOUTHBRIDGE_INTEL_COMMON_SMM) += pmutil.c smihandler.c
ramstage-$(CONFIG_SOUTHBRIDGE_INTEL_COMMON_ACPI_MADT) += madt.c
smm-$(CONFIG_SOUTHBRIDGE_INTEL_COMMON_FINALIZE) += finalize.c
romstage-y += rtc.c
ramstage-y += rtc.c
postcar-y += rtc.c

44
src/southbridge/intel/bd82x6x/finalize.c → src/southbridge/intel/common/finalize.c
View File

@ -15,24 +15,25 @@
*/
#include <arch/io.h>
#include <device/pci_ops.h>
#include <console/post_codes.h>
#include <cpu/x86/smm.h>
#include <device/pci_ops.h>
#include <southbridge/intel/common/pmbase.h>
#include <southbridge/intel/common/pmutil.h>
#include <southbridge/intel/common/rcba.h>
#include <spi-generic.h>
#include "chip.h"
#include "pch.h"
#include "finalize.h"
void intel_pch_finalize_smm(void)
{
const pci_devfn_t lpc_dev = PCI_DEV(0, 0x1f, 0);
if (IS_ENABLED(CONFIG_LOCK_SPI_FLASH_RO) ||
IS_ENABLED(CONFIG_LOCK_SPI_FLASH_NO_ACCESS)) {
/* Copy flash regions from FREG0-4 to PR0-4
and enable write protection bit31 */
int i;
u32 lockmask = (1 << 31);
u32 lockmask = 1UL << 31;
if (IS_ENABLED(CONFIG_LOCK_SPI_FLASH_NO_ACCESS))
lockmask |= (1 << 15);
lockmask |= 1 << 15;
for (i = 0; i < 20; i += 4)
RCBA32(0x3874 + i) = RCBA32(0x3854 + i) | lockmask;
}
@ -40,13 +41,12 @@ void intel_pch_finalize_smm(void)
/* Lock SPIBAR */
RCBA32_OR(0x3804, (1 << 15));
#if IS_ENABLED(CONFIG_SPI_FLASH_SMM)
/* Re-init SPI driver to handle locked BAR */
spi_init();
#endif
if (IS_ENABLED(CONFIG_SPI_FLASH_SMM))
/* Re-init SPI driver to handle locked BAR */
spi_init();
/* TCLOCKDN: TC Lockdown */
RCBA32_OR(0x0050, (1 << 31));
RCBA32_OR(0x0050, (1UL << 31));
/* BIOS Interface Lockdown */
RCBA32_OR(0x3410, (1 << 0));
@ -54,23 +54,23 @@ void intel_pch_finalize_smm(void)
/* Function Disable SUS Well Lockdown */
RCBA_AND_OR(8, 0x3420, ~0U, (1 << 7));
/* Global SMI Lock */
pci_or_config16(PCH_LPC_DEV, GEN_PMCON_1, 1 << 4);
pci_or_config16(lpc_dev, D31F0_GEN_PMCON_1, SMI_LOCK);
/* GEN_PMCON Lock */
pci_or_config8(PCH_LPC_DEV, GEN_PMCON_LOCK, (1 << 1) | (1 << 2));
pci_or_config8(lpc_dev, D31F0_GEN_PMCON_LOCK,
ACPI_BASE_LOCK | SLP_STR_POL_LOCK);
/* ETR3: CF9GR Lockdown */
pci_update_config32(PCH_LPC_DEV, ETR3, ~ETR3_CF9GR, ETR3_CF9LOCK);
pci_update_config32(lpc_dev, D31F0_ETR3, ~ETR3_CF9GR, ETR3_CF9LOCK);
if (IS_ENABLED(CONFIG_SOUTHBRIDGE_INTEL_LYNXPOINT))
/* PMSYNC */
RCBA32_OR(0x33c4, (1UL << 31));
/* R/WO registers */
RCBA32(0x21a4) = RCBA32(0x21a4);
pci_write_config32(PCI_DEV(0, 27, 0), 0x74,
pci_read_config32(PCI_DEV(0, 27, 0), 0x74));
/* TCO_Lock */
write_pmbase16(TCO1_CNT, read_pmbase16(TCO1_CNT) | TCO_LOCK);
/* Indicate finalize step with post code */
outb(POST_OS_BOOT, 0x80);
outb(POST_OS_BOOT, CONFIG_POST_IO_PORT);
}

22
src/southbridge/intel/common/finalize.h Normal file
View File

@ -0,0 +1,22 @@
/*
* This file is part of the coreboot project.
*
* Copyright (C) 2018 Tristan Corrick <tristan@corrick.kiwi>
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*/
#ifndef SOUTHBRIDGE_INTEL_COMMON_FINALIZE_H
#define SOUTHBRIDGE_INTEL_COMMON_FINALIZE_H
void intel_pch_finalize_smm(void);
#endif /* SOUTHBRIDGE_INTEL_COMMON_FINALIZE_H */

10
src/southbridge/intel/common/pmutil.h
View File

@ -20,10 +20,20 @@
#include <cpu/x86/smm.h>
#define D31F0_PMBASE 0x40
#define D31F0_GEN_PMCON_1 0xa0
#define SMI_LOCK (1 << 4)
#define D31F0_GEN_PMCON_2 0xa2
#define D31F0_GEN_PMCON_3 0xa4
#define RTC_BATTERY_DEAD (1 << 2)
#define RTC_POWER_FAILED (1 << 1)
#define SLEEP_AFTER_POWER_FAIL (1 << 0)
#define D31F0_GEN_PMCON_LOCK 0xa6
#define ACPI_BASE_LOCK (1 << 1)
#define SLP_STR_POL_LOCK (1 << 2)
#define D31F0_ETR3 0xac
#define ETR3_CWORWRE (1 << 18)
#define ETR3_CF9GR (1 << 20)
#define ETR3_CF9LOCK (1 << 31)
#define D31F0_GPIO_ROUT 0xb8
#define GPI_DISABLE 0x00
#define GPI_IS_SMI 0x01

1
src/southbridge/intel/ibexpeak/Kconfig
View File

@ -28,6 +28,7 @@ config SOUTH_BRIDGE_OPTIONS # dummy
select PCIEXP_ASPM
select PCIEXP_COMMON_CLOCK
select SOUTHBRIDGE_INTEL_COMMON
select SOUTHBRIDGE_INTEL_COMMON_FINALIZE
select SOUTHBRIDGE_INTEL_COMMON_RCBA_PIRQ
select SOUTHBRIDGE_INTEL_COMMON_SMBUS
select SOUTHBRIDGE_INTEL_COMMON_SPI

2
src/southbridge/intel/ibexpeak/Makefile.inc
View File

@ -37,7 +37,7 @@ ramstage-$(CONFIG_ELOG) += ../bd82x6x/elog.c
ramstage-y += madt.c
ramstage-y += smi.c
smm-y += smihandler.c me.c ../bd82x6x/me_8.x.c ../bd82x6x/finalize.c ../bd82x6x/pch.c
smm-y += smihandler.c me.c ../bd82x6x/me_8.x.c ../bd82x6x/pch.c
romstage-y += ../bd82x6x/early_usb.c early_smbus.c ../bd82x6x/early_me.c ../bd82x6x/me_status.c ../common/gpio.c early_thermal.c
romstage-y += ../bd82x6x/early_rcba.c

4
src/southbridge/intel/ibexpeak/pch.h
View File

@ -51,10 +51,6 @@
#ifndef __ACPI__
#define DEBUG_PERIODIC_SMIS 0
#if defined(__SMM__) && !defined(__ASSEMBLER__)
void intel_pch_finalize_smm(void);
#endif
#if !defined(__ASSEMBLER__)
#if !defined(__PRE_RAM__)
#if !defined(__SIMPLE_DEVICE__)

1
src/southbridge/intel/lynxpoint/Kconfig
View File

@ -25,6 +25,7 @@ config SOUTH_BRIDGE_OPTIONS # dummy
select SOUTHBRIDGE_INTEL_COMMON_SMBUS
select SOUTHBRIDGE_INTEL_COMMON_SPI
select SOUTHBRIDGE_INTEL_COMMON_ACPI_MADT
select SOUTHBRIDGE_INTEL_COMMON_FINALIZE
select IOAPIC
select HAVE_USBDEBUG_OPTIONS
select USE_WATCHDOG_ON_BOOT

2
src/southbridge/intel/lynxpoint/Makefile.inc
View File

@ -42,7 +42,7 @@ ramstage-y += acpi.c
ramstage-$(CONFIG_ELOG) += elog.c
ramstage-$(CONFIG_HAVE_SMI_HANDLER) += smi.c pmutil.c
smm-$(CONFIG_HAVE_SMI_HANDLER) += smihandler.c me_9.x.c finalize.c pch.c
smm-$(CONFIG_HAVE_SMI_HANDLER) += smihandler.c me_9.x.c pch.c
smm-$(CONFIG_HAVE_SMI_HANDLER) += pmutil.c usb_ehci.c usb_xhci.c
romstage-y += early_usb.c early_smbus.c early_me.c me_status.c early_pch.c

68
src/southbridge/intel/lynxpoint/finalize.c
View File

@ -1,68 +0,0 @@
/*
* This file is part of the coreboot project.
*
* Copyright (C) 2012 The Chromium OS Authors. All rights reserved.
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License as
* published by the Free Software Foundation; version 2 of
* the License.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*/
#include <arch/io.h>
#include <device/pci_ops.h>
#include <console/post_codes.h>
#include <spi-generic.h>
#include "me.h"
#include "pch.h"
void intel_pch_finalize_smm(void)
{
/* Lock down Management Engine */
intel_me_finalize_smm();
/* Set SPI opcode menu */
RCBA16(0x3894) = SPI_OPPREFIX;
RCBA16(0x3896) = SPI_OPTYPE;
RCBA32(0x3898) = SPI_OPMENU_LOWER;
RCBA32(0x389c) = SPI_OPMENU_UPPER;
/* Lock SPIBAR */
RCBA32_OR(0x3804, (1 << 15));
#if IS_ENABLED(CONFIG_SPI_FLASH_SMM)
/* Re-init SPI driver to handle locked BAR */
spi_init();
#endif
/* TCLOCKDN: TC Lockdown */
RCBA32_OR(0x0050, (1UL << 31));
/* BIOS Interface Lockdown */
RCBA32_OR(0x3410, (1 << 0));
/* Function Disable SUS Well Lockdown */
RCBA_AND_OR(8, 0x3420, ~0U, (1 << 7));
/* Global SMI Lock */
pci_or_config16(PCH_LPC_DEV, 0xa0, 1 << 4);
/* GEN_PMCON Lock */
pci_or_config8(PCH_LPC_DEV, 0xa6, (1 << 1) | (1 << 2));
/* PMSYNC */
RCBA32_OR(PMSYNC_CONFIG, (1UL << 31));
/* R/WO registers */
RCBA32(0x21a4) = RCBA32(0x21a4);
pci_write_config32(PCI_DEV(0, 27, 0), 0x74,
pci_read_config32(PCI_DEV(0, 27, 0), 0x74));
/* Indicate finalize step with post code */
outb(POST_OS_BOOT, 0x80);
}

5
src/southbridge/intel/lynxpoint/lpc.c
View File

@ -969,6 +969,11 @@ static unsigned long southbridge_write_acpi_tables(struct device *device,
static void lpc_final(struct device *dev)
{
RCBA16(0x3894) = SPI_OPPREFIX;
RCBA16(0x3896) = SPI_OPTYPE;
RCBA32(0x3898) = SPI_OPMENU_LOWER;
RCBA32(0x389c) = SPI_OPMENU_UPPER;
if (acpi_is_wakeup_s3() || IS_ENABLED(CONFIG_INTEL_CHIPSET_LOCKDOWN))
outb(APM_CNT_FINALIZE, APM_CNT);
}

1
src/southbridge/intel/lynxpoint/pch.h
View File

@ -92,7 +92,6 @@
#ifndef __ACPI__
#if defined(__SMM__) && !defined(__ASSEMBLER__)
void intel_pch_finalize_smm(void);
void usb_ehci_sleep_prepare(pci_devfn_t dev, u8 slp_typ);
void usb_ehci_disable(pci_devfn_t dev);
void usb_xhci_sleep_prepare(pci_devfn_t dev, u8 slp_typ);

3
src/southbridge/intel/lynxpoint/smihandler.c
View File

@ -25,8 +25,10 @@
#include <elog.h>
#include <halt.h>
#include <pc80/mc146818rtc.h>
#include <southbridge/intel/common/finalize.h>
#include <northbridge/intel/haswell/haswell.h>
#include <cpu/intel/haswell/haswell.h>
#include "me.h"
#include "pch.h"
#include "nvs.h"
@ -284,6 +286,7 @@ static void southbridge_smi_apmc(void)
return;
}
intel_me_finalize_smm();
intel_pch_finalize_smm();
intel_northbridge_haswell_finalize_smm();
intel_cpu_haswell_finalize_smm();