util/bucts: Add tool to manipulate BUC.TS bit on Intel targets

The purpose of this tool is to manipulate and get information about the
`Back Up Control, Top Swap` mechanism present on most Intel Southbridges.

This tool is initially written by Peter Stuge.

This tool makes it possible to have a backup mechanism for the
bootblock by using the southbridges Back Up Control Top Swap.

Sometimes it is also possible to circumvent vendor write protection mechanisms
in order to flash coreboot. An example of where this would be useful would be
the Lenovo Thinkpad X60 and T60.

Change-Id: I12cc2e91396f096fc979e23848e1929cb6c44fc5
Signed-off-by: Arthur Heymans <arthur@aheymans.xyz>
Reviewed-on: https://review.coreboot.org/18224
Reviewed-by: Patrick Georgi <pgeorgi@google.com>
Reviewed-by: Felix Held <felix-coreboot@felixheld.de>
Reviewed-by: Paul Menzel <paulepanter@users.sourceforge.net>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>

1 files changed, 52 insertions, 0 deletions

diff --git a/util/bucts/readme.md b/util/bucts/readme.md
new file mode 100644
index 0000000000..1bf9beebc8
--- /dev/null
+++ b/util/bucts/readme.md
@@ -0,0 +1,52 @@
+# What is bucts?
+Many Intel southbridges provide a mechanism called Back Up Control Top Swap (`BUC.TS`).
+This functionality allows to have the southbridge fetch the reset vector or
+the beginning of the bootblock at a 64K/128/256K offset from the usual top of flash.
+
+This can be useful in different ways:
+- Have a backup bootblock in case of bootblock hacking;
+- Some vendor BIOS only write protect their bootblock so this tool makes it
+  possible to circumvent this protection to allow flashing and booting coreboot.
+
+The BUC.TS status is stored in a nvram bit. To clear it one has to remove the RTC battery.
+
+# Operation Description
+First compile bucts by running make:
+
+	$ make
+
+Then you can view the current system settings:
+
+	$ ./bucts --print
+
+To flip the decode address of the bootblock, by setting `BUC.TS` to 1:
+
+	$ ./bucts --set
+
+To set the behavior the regular mapping, by setting `BUC.TS` to 0
+
+	$ ./bucts --unset
+
+
+# Details
+Example Bootblock size of 64KB (this is only configurable to be something else
+like 128 or 256K on PCH Intel targets).
+
+<pre>
+    +-------------+ -> 0x200000         +-------------+ -> 0xFFFFFFFF       +-------------+ -> 0xFFFFFFFF
+    |             |                     |             |                     |             |
+    | bootblock_0 |                     | bootblock_0 |                     | bootblock_1 |
+    |             |                     |             |                     |             |
+    +-------------+ -> 0x1F0000         +-------------+ -> 0xFFFF0000       +-------------+ -> 0xFFFF0000
+    |             |                     |             |                     |             |
+    | bootblock_1 |                     | bootblock_1 |                     | bootblock_0 |
+    |             |                     |             |                     |             |
+    +-------------+ -> 0x1E0000         +-------------+ -> 0xFFFE0000       +-------------+ -> 0xFFFE0000
+    |             |                     |             |                     |             |
+    |             |                     |             |                     |             |
+    Z             Z                     Z             Z                     Z             Z
+    Z             Z                     Z             Z                     Z             Z
+    |             |                     |             |                     |             |
+    |             |                     |             |                     |             |
+    FLASH (2M)                          Memory Map BUC.TS=0               Memory Map BUC.TS=1
+</pre>