sb/intel/common: Create a common PCH finalise implementation

The common finalise code is used by bd82x6x, Lynx Point, and Ibex Peak.

Lynx Point now benefits from being able to write-protect the flash chip.

For Lynx Point, writing the SPI OPMENU now happens in ramstage, as done
in bd82x6x.

Tested on an ASRock H81M-HDS (Lynx Point). When write-protection is
configured, flashrom reports all flash regions as read-only, and does
not manage to alter the contents of the flash chip.

Also tested on an ASUS P8H61-M LX (Cougar Point). Everything seems to
work as before.

Change-Id: I781082b1ed507b00815d1e85aec3e56ae5a4bef2
Signed-off-by: Tristan Corrick <tristan@corrick.kiwi>
Reviewed-on: https://review.coreboot.org/c/29977
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Nico Huber <nico.h@gmx.de>

20 files changed, 115 insertions, 141 deletions

diff --git a/src/mainboard/lenovo/x201/smihandler.c b/src/mainboard/lenovo/x201/smihandler.c
index fbbec09adc..10ca4d438b 100644
--- a/src/mainboard/lenovo/x201/smihandler.c
+++ b/src/mainboard/lenovo/x201/smihandler.c
@@ -20,6 +20,7 @@
 #include <southbridge/intel/ibexpeak/nvs.h>
 #include <southbridge/intel/ibexpeak/pch.h>
 #include <southbridge/intel/ibexpeak/me.h>
+#include <southbridge/intel/common/finalize.h>
 #include <northbridge/intel/nehalem/nehalem.h>
 #include <cpu/intel/model_2065x/model_2065x.h>
 #include <ec/acpi/ec.h>
diff --git a/src/mainboard/packardbell/ms2290/smihandler.c b/src/mainboard/packardbell/ms2290/smihandler.c
index 926650a358..e0f16f3236 100644
--- a/src/mainboard/packardbell/ms2290/smihandler.c
+++ b/src/mainboard/packardbell/ms2290/smihandler.c
@@ -19,6 +19,7 @@
 #include <southbridge/intel/ibexpeak/nvs.h>
 #include <southbridge/intel/ibexpeak/pch.h>
 #include <southbridge/intel/ibexpeak/me.h>
+#include <southbridge/intel/common/finalize.h>
 #include <northbridge/intel/nehalem/nehalem.h>
 #include <cpu/intel/model_2065x/model_2065x.h>
 #include <ec/acpi/ec.h>
diff --git a/src/southbridge/intel/bd82x6x/Kconfig b/src/southbridge/intel/bd82x6x/Kconfig
index d906ea7f25..1396a6395b 100644
--- a/src/southbridge/intel/bd82x6x/Kconfig
+++ b/src/southbridge/intel/bd82x6x/Kconfig
@@ -25,6 +25,7 @@ config SOUTH_BRIDGE_OPTIONS # dummy
 	def_bool y
 	select ACPI_INTEL_HARDWARE_SLEEP_VALUES
 	select SOUTHBRIDGE_INTEL_COMMON
+	select SOUTHBRIDGE_INTEL_COMMON_FINALIZE
 	select SOUTHBRIDGE_INTEL_COMMON_RCBA_PIRQ
 	select SOUTHBRIDGE_INTEL_COMMON_SMBUS
 	select SOUTHBRIDGE_INTEL_COMMON_SPI
@@ -67,42 +68,3 @@ config HPET_MIN_TICKS
 	default 0x80
 
 endif
-
-if SOUTHBRIDGE_INTEL_BD82X6X || SOUTHBRIDGE_INTEL_C216 || SOUTHBRIDGE_INTEL_IBEXPEAK
-
-choice
-	prompt "Flash locking during chipset lockdown"
-	default LOCK_SPI_FLASH_NONE
-
-config LOCK_SPI_FLASH_NONE
-	bool "Don't lock flash sections"
-
-config LOCK_SPI_FLASH_RO
-	bool "Write-protect all flash sections"
-	help
-	  Select this if you want to write-protect the whole firmware flash
-	  chip. The locking will take place during the chipset lockdown, which
-	  is either triggered by coreboot (when INTEL_CHIPSET_LOCKDOWN is set)
-	  or has to be triggered later (e.g. by the payload or the OS).
-
-	        NOTE: If you trigger the chipset lockdown unconditionally,
-	        you won't be able to write to the flash chip using the
-	        internal programmer any more.
-
-config LOCK_SPI_FLASH_NO_ACCESS
-	bool "Write-protect all flash sections and read-protect non-BIOS sections"
-	help
-	  Select this if you want to protect the firmware flash against all
-	  further accesses (with the exception of the memory mapped BIOS re-
-	  gion which is always readable). The locking will take place during
-	  the chipset lockdown, which is either triggered by coreboot (when
-	  INTEL_CHIPSET_LOCKDOWN is set) or has to be triggered later (e.g.
-	  by the payload or the OS).
-
-	        NOTE: If you trigger the chipset lockdown unconditionally,
-	        you won't be able to write to the flash chip using the
-	        internal programmer any more.
-
-endchoice
-
-endif
diff --git a/src/southbridge/intel/bd82x6x/Makefile.inc b/src/southbridge/intel/bd82x6x/Makefile.inc
index c00b2c4263..24d7e2d24e 100644
--- a/src/southbridge/intel/bd82x6x/Makefile.inc
+++ b/src/southbridge/intel/bd82x6x/Makefile.inc
@@ -35,7 +35,7 @@ ramstage-y += watchdog.c
 
 ramstage-$(CONFIG_ELOG) += elog.c
 
-smm-$(CONFIG_HAVE_SMI_HANDLER) += smihandler.c me.c me_8.x.c finalize.c pch.c
+smm-$(CONFIG_HAVE_SMI_HANDLER) += smihandler.c me.c me_8.x.c pch.c
 
 romstage-y += early_smbus.c me_status.c
 romstage-y += early_spi.c early_pch_common.c
diff --git a/src/southbridge/intel/bd82x6x/pch.h b/src/southbridge/intel/bd82x6x/pch.h
index bb0d5c4a95..280ac7d6ef 100644
--- a/src/southbridge/intel/bd82x6x/pch.h
+++ b/src/southbridge/intel/bd82x6x/pch.h
@@ -56,10 +56,6 @@
 #ifndef __ACPI__
 #define DEBUG_PERIODIC_SMIS 0
 
-#if defined(__SMM__) && !defined(__ASSEMBLER__)
-void intel_pch_finalize_smm(void);
-#endif
-
 #if !defined(__ASSEMBLER__)
 #if !defined(__PRE_RAM__)
 #if !defined(__SIMPLE_DEVICE__)
diff --git a/src/southbridge/intel/bd82x6x/smihandler.c b/src/southbridge/intel/bd82x6x/smihandler.c
index 03d26876df..6291867e3f 100644
--- a/src/southbridge/intel/bd82x6x/smihandler.c
+++ b/src/southbridge/intel/bd82x6x/smihandler.c
@@ -32,6 +32,7 @@
 #include <southbridge/intel/common/gpio.h>
 #include <cpu/intel/model_206ax/model_206ax.h>
 #include <southbridge/intel/common/pmutil.h>
+#include <southbridge/intel/common/finalize.h>
 
 static global_nvs_t *gnvs;
 global_nvs_t *smm_get_gnvs(void)
diff --git a/src/southbridge/intel/common/Kconfig b/src/southbridge/intel/common/Kconfig
index 957faa5184..ba53f68423 100644
--- a/src/southbridge/intel/common/Kconfig
+++ b/src/southbridge/intel/common/Kconfig
@@ -33,6 +33,9 @@ config SOUTHBRIDGE_INTEL_COMMON_SMM
 config SOUTHBRIDGE_INTEL_COMMON_ACPI_MADT
 	bool
 
+config SOUTHBRIDGE_INTEL_COMMON_FINALIZE
+	bool
+
 config INTEL_DESCRIPTOR_MODE_CAPABLE
 	def_bool n
 	help
@@ -55,3 +58,42 @@ config INTEL_CHIPSET_LOCKDOWN
 	  locked down on each normal boot path (done by either coreboot or payload)
 	  and S3 resume (always done by coreboot). Select this to let coreboot
 	  to do this on normal boot path.
+
+if SOUTHBRIDGE_INTEL_COMMON_FINALIZE
+
+choice
+	prompt "Flash locking during chipset lockdown"
+	default LOCK_SPI_FLASH_NONE
+
+config LOCK_SPI_FLASH_NONE
+	bool "Don't lock flash sections"
+
+config LOCK_SPI_FLASH_RO
+	bool "Write-protect all flash sections"
+	help
+	  Select this if you want to write-protect the whole firmware flash
+	  chip. The locking will take place during the chipset lockdown, which
+	  is either triggered by coreboot (when INTEL_CHIPSET_LOCKDOWN is set)
+	  or has to be triggered later (e.g. by the payload or the OS).
+
+	        NOTE: If you trigger the chipset lockdown unconditionally,
+	        you won't be able to write to the flash chip using the
+	        internal programmer any more.
+
+config LOCK_SPI_FLASH_NO_ACCESS
+	bool "Write-protect all flash sections and read-protect non-BIOS sections"
+	help
+	  Select this if you want to protect the firmware flash against all
+	  further accesses (with the exception of the memory mapped BIOS re-
+	  gion which is always readable). The locking will take place during
+	  the chipset lockdown, which is either triggered by coreboot (when
+	  INTEL_CHIPSET_LOCKDOWN is set) or has to be triggered later (e.g.
+	  by the payload or the OS).
+
+	        NOTE: If you trigger the chipset lockdown unconditionally,
+	        you won't be able to write to the flash chip using the
+	        internal programmer any more.
+
+endchoice
+
+endif
diff --git a/src/southbridge/intel/common/Makefile.inc b/src/southbridge/intel/common/Makefile.inc
index b87354c5e8..1a509b16a4 100644
--- a/src/southbridge/intel/common/Makefile.inc
+++ b/src/southbridge/intel/common/Makefile.inc
@@ -54,6 +54,8 @@ smm-$(CONFIG_SOUTHBRIDGE_INTEL_COMMON_SMM) += pmutil.c smihandler.c
 
 ramstage-$(CONFIG_SOUTHBRIDGE_INTEL_COMMON_ACPI_MADT) += madt.c
 
+smm-$(CONFIG_SOUTHBRIDGE_INTEL_COMMON_FINALIZE) += finalize.c
+
 romstage-y += rtc.c
 ramstage-y += rtc.c
 postcar-y += rtc.c
diff --git a/src/southbridge/intel/bd82x6x/finalize.c b/src/southbridge/intel/common/finalize.c
index a08535e979..f1c33b9b06 100644
--- a/src/southbridge/intel/bd82x6x/finalize.c
+++ b/src/southbridge/intel/common/finalize.c
@@ -15,24 +15,25 @@
  */
 
 #include <arch/io.h>
-#include <device/pci_ops.h>
 #include <console/post_codes.h>
-#include <cpu/x86/smm.h>
+#include <device/pci_ops.h>
 #include <southbridge/intel/common/pmbase.h>
+#include <southbridge/intel/common/pmutil.h>
+#include <southbridge/intel/common/rcba.h>
 #include <spi-generic.h>
-#include "chip.h"
-#include "pch.h"
+
+#include "finalize.h"
 
 void intel_pch_finalize_smm(void)
 {
+	const pci_devfn_t lpc_dev = PCI_DEV(0, 0x1f, 0);
+
 	if (IS_ENABLED(CONFIG_LOCK_SPI_FLASH_RO) ||
 	    IS_ENABLED(CONFIG_LOCK_SPI_FLASH_NO_ACCESS)) {
-		/* Copy flash regions from FREG0-4 to PR0-4
-		   and enable write protection bit31 */
 		int i;
-		u32 lockmask = (1 << 31);
+		u32 lockmask = 1UL << 31;
 		if (IS_ENABLED(CONFIG_LOCK_SPI_FLASH_NO_ACCESS))
-			lockmask |= (1 << 15);
+			lockmask |= 1 << 15;
 		for (i = 0; i < 20; i += 4)
 			RCBA32(0x3874 + i) = RCBA32(0x3854 + i) | lockmask;
 	}
@@ -40,13 +41,12 @@ void intel_pch_finalize_smm(void)
 	/* Lock SPIBAR */
 	RCBA32_OR(0x3804, (1 << 15));
 
-#if IS_ENABLED(CONFIG_SPI_FLASH_SMM)
-	/* Re-init SPI driver to handle locked BAR */
-	spi_init();
-#endif
+	if (IS_ENABLED(CONFIG_SPI_FLASH_SMM))
+		/* Re-init SPI driver to handle locked BAR */
+		spi_init();
 
 	/* TCLOCKDN: TC Lockdown */
-	RCBA32_OR(0x0050, (1 << 31));
+	RCBA32_OR(0x0050, (1UL << 31));
 
 	/* BIOS Interface Lockdown */
 	RCBA32_OR(0x3410, (1 << 0));
@@ -54,23 +54,23 @@ void intel_pch_finalize_smm(void)
 	/* Function Disable SUS Well Lockdown */
 	RCBA_AND_OR(8, 0x3420, ~0U, (1 << 7));
 
-	/* Global SMI Lock */
-	pci_or_config16(PCH_LPC_DEV, GEN_PMCON_1, 1 << 4);
+	pci_or_config16(lpc_dev, D31F0_GEN_PMCON_1, SMI_LOCK);
+
+	pci_or_config8(lpc_dev, D31F0_GEN_PMCON_LOCK,
+		       ACPI_BASE_LOCK | SLP_STR_POL_LOCK);
 
-	/* GEN_PMCON Lock */
-	pci_or_config8(PCH_LPC_DEV, GEN_PMCON_LOCK, (1 << 1) | (1 << 2));
+	pci_update_config32(lpc_dev, D31F0_ETR3, ~ETR3_CF9GR, ETR3_CF9LOCK);
 
-	/* ETR3: CF9GR Lockdown */
-	pci_update_config32(PCH_LPC_DEV, ETR3, ~ETR3_CF9GR, ETR3_CF9LOCK);
+	if (IS_ENABLED(CONFIG_SOUTHBRIDGE_INTEL_LYNXPOINT))
+		/* PMSYNC */
+		RCBA32_OR(0x33c4, (1UL << 31));
 
 	/* R/WO registers */
 	RCBA32(0x21a4) = RCBA32(0x21a4);
 	pci_write_config32(PCI_DEV(0, 27, 0), 0x74,
 		    pci_read_config32(PCI_DEV(0, 27, 0), 0x74));
 
-	/* TCO_Lock */
 	write_pmbase16(TCO1_CNT, read_pmbase16(TCO1_CNT) | TCO_LOCK);
 
-	/* Indicate finalize step with post code */
-	outb(POST_OS_BOOT, 0x80);
+	outb(POST_OS_BOOT, CONFIG_POST_IO_PORT);
 }
diff --git a/src/southbridge/intel/common/finalize.h b/src/southbridge/intel/common/finalize.h
new file mode 100644
index 0000000000..4a8cbc0413
--- /dev/null
+++ b/src/southbridge/intel/common/finalize.h
@@ -0,0 +1,22 @@
+/*
+ * This file is part of the coreboot project.
+ *
+ * Copyright (C) 2018 Tristan Corrick <tristan@corrick.kiwi>
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#ifndef SOUTHBRIDGE_INTEL_COMMON_FINALIZE_H
+#define SOUTHBRIDGE_INTEL_COMMON_FINALIZE_H
+
+void intel_pch_finalize_smm(void);
+
+#endif /* SOUTHBRIDGE_INTEL_COMMON_FINALIZE_H */
diff --git a/src/southbridge/intel/common/pmutil.h b/src/southbridge/intel/common/pmutil.h
index 2e761ccef2..47813f7d02 100644
--- a/src/southbridge/intel/common/pmutil.h
+++ b/src/southbridge/intel/common/pmutil.h
@@ -20,10 +20,20 @@
 #include <cpu/x86/smm.h>
 
 #define D31F0_PMBASE		0x40
+#define D31F0_GEN_PMCON_1	0xa0
+#define   SMI_LOCK		(1 << 4)
+#define D31F0_GEN_PMCON_2	0xa2
 #define D31F0_GEN_PMCON_3	0xa4
 #define   RTC_BATTERY_DEAD		(1 << 2)
 #define   RTC_POWER_FAILED		(1 << 1)
 #define   SLEEP_AFTER_POWER_FAIL	(1 << 0)
+#define D31F0_GEN_PMCON_LOCK	0xa6
+#define   ACPI_BASE_LOCK	(1 << 1)
+#define   SLP_STR_POL_LOCK	(1 << 2)
+#define D31F0_ETR3		0xac
+#define   ETR3_CWORWRE		(1 << 18)
+#define   ETR3_CF9GR		(1 << 20)
+#define   ETR3_CF9LOCK		(1 << 31)
 #define D31F0_GPIO_ROUT		0xb8
 #define  GPI_DISABLE		0x00
 #define  GPI_IS_SMI		0x01
diff --git a/src/southbridge/intel/ibexpeak/Kconfig b/src/southbridge/intel/ibexpeak/Kconfig
index fe6526dc88..7e2254e4d1 100644
--- a/src/southbridge/intel/ibexpeak/Kconfig
+++ b/src/southbridge/intel/ibexpeak/Kconfig
@@ -28,6 +28,7 @@ config SOUTH_BRIDGE_OPTIONS # dummy
 	select PCIEXP_ASPM
 	select PCIEXP_COMMON_CLOCK
 	select SOUTHBRIDGE_INTEL_COMMON
+	select SOUTHBRIDGE_INTEL_COMMON_FINALIZE
 	select SOUTHBRIDGE_INTEL_COMMON_RCBA_PIRQ
 	select SOUTHBRIDGE_INTEL_COMMON_SMBUS
 	select SOUTHBRIDGE_INTEL_COMMON_SPI
diff --git a/src/southbridge/intel/ibexpeak/Makefile.inc b/src/southbridge/intel/ibexpeak/Makefile.inc
index 906652d565..5c890300a4 100644
--- a/src/southbridge/intel/ibexpeak/Makefile.inc
+++ b/src/southbridge/intel/ibexpeak/Makefile.inc
@@ -37,7 +37,7 @@ ramstage-$(CONFIG_ELOG) += ../bd82x6x/elog.c
 ramstage-y += madt.c
 
 ramstage-y += smi.c
-smm-y += smihandler.c me.c ../bd82x6x/me_8.x.c ../bd82x6x/finalize.c ../bd82x6x/pch.c
+smm-y += smihandler.c me.c ../bd82x6x/me_8.x.c ../bd82x6x/pch.c
 
 romstage-y += ../bd82x6x/early_usb.c early_smbus.c ../bd82x6x/early_me.c ../bd82x6x/me_status.c ../common/gpio.c early_thermal.c
 romstage-y += ../bd82x6x/early_rcba.c
diff --git a/src/southbridge/intel/ibexpeak/pch.h b/src/southbridge/intel/ibexpeak/pch.h
index 55478b908c..35bf0caced 100644
--- a/src/southbridge/intel/ibexpeak/pch.h
+++ b/src/southbridge/intel/ibexpeak/pch.h
@@ -51,10 +51,6 @@
 #ifndef __ACPI__
 #define DEBUG_PERIODIC_SMIS 0
 
-#if defined(__SMM__) && !defined(__ASSEMBLER__)
-void intel_pch_finalize_smm(void);
-#endif
-
 #if !defined(__ASSEMBLER__)
 #if !defined(__PRE_RAM__)
 #if !defined(__SIMPLE_DEVICE__)
diff --git a/src/southbridge/intel/lynxpoint/Kconfig b/src/southbridge/intel/lynxpoint/Kconfig
index 5b06c4ba8e..b331ba1c77 100644
--- a/src/southbridge/intel/lynxpoint/Kconfig
+++ b/src/southbridge/intel/lynxpoint/Kconfig
@@ -25,6 +25,7 @@ config SOUTH_BRIDGE_OPTIONS # dummy
 	select SOUTHBRIDGE_INTEL_COMMON_SMBUS
 	select SOUTHBRIDGE_INTEL_COMMON_SPI
 	select SOUTHBRIDGE_INTEL_COMMON_ACPI_MADT
+	select SOUTHBRIDGE_INTEL_COMMON_FINALIZE
 	select IOAPIC
 	select HAVE_USBDEBUG_OPTIONS
 	select USE_WATCHDOG_ON_BOOT
diff --git a/src/southbridge/intel/lynxpoint/Makefile.inc b/src/southbridge/intel/lynxpoint/Makefile.inc
index db3454691f..c2a49fdea6 100644
--- a/src/southbridge/intel/lynxpoint/Makefile.inc
+++ b/src/southbridge/intel/lynxpoint/Makefile.inc
@@ -42,7 +42,7 @@ ramstage-y += acpi.c
 ramstage-$(CONFIG_ELOG) += elog.c
 
 ramstage-$(CONFIG_HAVE_SMI_HANDLER) += smi.c pmutil.c
-smm-$(CONFIG_HAVE_SMI_HANDLER) += smihandler.c me_9.x.c finalize.c pch.c
+smm-$(CONFIG_HAVE_SMI_HANDLER) += smihandler.c me_9.x.c pch.c
 smm-$(CONFIG_HAVE_SMI_HANDLER) += pmutil.c usb_ehci.c usb_xhci.c
 
 romstage-y += early_usb.c early_smbus.c early_me.c me_status.c early_pch.c
diff --git a/src/southbridge/intel/lynxpoint/finalize.c b/src/southbridge/intel/lynxpoint/finalize.c
deleted file mode 100644
index 590a24513a..0000000000
--- a/src/southbridge/intel/lynxpoint/finalize.c
+++ /dev/null
@@ -1,68 +0,0 @@
-/*
- * This file is part of the coreboot project.
- *
- * Copyright (C) 2012 The Chromium OS Authors. All rights reserved.
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License as
- * published by the Free Software Foundation; version 2 of
- * the License.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- */
-
-#include <arch/io.h>
-#include <device/pci_ops.h>
-#include <console/post_codes.h>
-#include <spi-generic.h>
-#include "me.h"
-#include "pch.h"
-
-void intel_pch_finalize_smm(void)
-{
-	/* Lock down Management Engine */
-	intel_me_finalize_smm();
-
-	/* Set SPI opcode menu */
-	RCBA16(0x3894) = SPI_OPPREFIX;
-	RCBA16(0x3896) = SPI_OPTYPE;
-	RCBA32(0x3898) = SPI_OPMENU_LOWER;
-	RCBA32(0x389c) = SPI_OPMENU_UPPER;
-
-	/* Lock SPIBAR */
-	RCBA32_OR(0x3804, (1 << 15));
-
-#if IS_ENABLED(CONFIG_SPI_FLASH_SMM)
-	/* Re-init SPI driver to handle locked BAR */
-	spi_init();
-#endif
-
-	/* TCLOCKDN: TC Lockdown */
-	RCBA32_OR(0x0050, (1UL << 31));
-
-	/* BIOS Interface Lockdown */
-	RCBA32_OR(0x3410, (1 << 0));
-
-	/* Function Disable SUS Well Lockdown */
-	RCBA_AND_OR(8, 0x3420, ~0U, (1 << 7));
-
-	/* Global SMI Lock */
-	pci_or_config16(PCH_LPC_DEV, 0xa0, 1 << 4);
-
-	/* GEN_PMCON Lock */
-	pci_or_config8(PCH_LPC_DEV, 0xa6, (1 << 1) | (1 << 2));
-
-	/* PMSYNC */
-	RCBA32_OR(PMSYNC_CONFIG, (1UL << 31));
-
-	/* R/WO registers */
-	RCBA32(0x21a4) = RCBA32(0x21a4);
-	pci_write_config32(PCI_DEV(0, 27, 0), 0x74,
-		    pci_read_config32(PCI_DEV(0, 27, 0), 0x74));
-
-	/* Indicate finalize step with post code */
-	outb(POST_OS_BOOT, 0x80);
-}
diff --git a/src/southbridge/intel/lynxpoint/lpc.c b/src/southbridge/intel/lynxpoint/lpc.c
index 437db812af..d914636703 100644
--- a/src/southbridge/intel/lynxpoint/lpc.c
+++ b/src/southbridge/intel/lynxpoint/lpc.c
@@ -969,6 +969,11 @@ static unsigned long southbridge_write_acpi_tables(struct device *device,
 
 static void lpc_final(struct device *dev)
 {
+	RCBA16(0x3894) = SPI_OPPREFIX;
+	RCBA16(0x3896) = SPI_OPTYPE;
+	RCBA32(0x3898) = SPI_OPMENU_LOWER;
+	RCBA32(0x389c) = SPI_OPMENU_UPPER;
+
 	if (acpi_is_wakeup_s3() || IS_ENABLED(CONFIG_INTEL_CHIPSET_LOCKDOWN))
 		outb(APM_CNT_FINALIZE, APM_CNT);
 }
diff --git a/src/southbridge/intel/lynxpoint/pch.h b/src/southbridge/intel/lynxpoint/pch.h
index a02be811f6..a28d703130 100644
--- a/src/southbridge/intel/lynxpoint/pch.h
+++ b/src/southbridge/intel/lynxpoint/pch.h
@@ -92,7 +92,6 @@
 #ifndef __ACPI__
 
 #if defined(__SMM__) && !defined(__ASSEMBLER__)
-void intel_pch_finalize_smm(void);
 void usb_ehci_sleep_prepare(pci_devfn_t dev, u8 slp_typ);
 void usb_ehci_disable(pci_devfn_t dev);
 void usb_xhci_sleep_prepare(pci_devfn_t dev, u8 slp_typ);
diff --git a/src/southbridge/intel/lynxpoint/smihandler.c b/src/southbridge/intel/lynxpoint/smihandler.c
index 12e5ea2eb6..a3965d0578 100644
--- a/src/southbridge/intel/lynxpoint/smihandler.c
+++ b/src/southbridge/intel/lynxpoint/smihandler.c
@@ -25,8 +25,10 @@
 #include <elog.h>
 #include <halt.h>
 #include <pc80/mc146818rtc.h>
+#include <southbridge/intel/common/finalize.h>
 #include <northbridge/intel/haswell/haswell.h>
 #include <cpu/intel/haswell/haswell.h>
+#include "me.h"
 #include "pch.h"
 
 #include "nvs.h"
@@ -284,6 +286,7 @@ static void southbridge_smi_apmc(void)
 			return;
 		}
 
+		intel_me_finalize_smm();
 		intel_pch_finalize_smm();
 		intel_northbridge_haswell_finalize_smm();
 		intel_cpu_haswell_finalize_smm();