9 files changed, 12 insertions, 46 deletions
diff --git a/src/cpu/intel/model_2065x/model_2065x_init.c b/src/cpu/intel/model_2065x/model_2065x_init.c
index b4a91ea658..65b28c0a0e 100644
--- a/src/cpu/intel/model_2065x/model_2065x_init.c
+++ b/src/cpu/intel/model_2065x/model_2065x_init.c
@@ -216,11 +216,7 @@ static void model_2065x_init(struct device *cpu)
 	/* Set virtualization based on Kconfig option */
 	set_vmx_and_lock();
 
-	if (!intel_ht_sibling()) {
-		/* Lock AES-NI only if supported */
-		if (cpuid_ecx(1) & (1 << 25))
-			msr_set(MSR_FEATURE_CONFIG, BIT(0));
-	}
+	set_aesni_lock();
 
 	/* Configure Enhanced SpeedStep and Thermal Sensors */
 	configure_misc();
diff --git a/src/cpu/intel/model_206ax/model_206ax_init.c b/src/cpu/intel/model_206ax/model_206ax_init.c
index d23772a23f..5af5ff905e 100644
--- a/src/cpu/intel/model_206ax/model_206ax_init.c
+++ b/src/cpu/intel/model_206ax/model_206ax_init.c
@@ -470,11 +470,7 @@ static void model_206ax_init(struct device *cpu)
 	/* Thermal throttle activation offset */
 	configure_thermal_target();
 
-	if (!intel_ht_sibling()) {
-		/* Lock AES-NI only if supported */
-		if (cpuid_ecx(1) & (1 << 25))
-			msr_set(MSR_FEATURE_CONFIG, BIT(0));
-	}
+	set_aesni_lock();
 
 	/* Enable Direct Cache Access */
 	configure_dca_cap();
diff --git a/src/include/cpu/intel/msr.h b/src/include/cpu/intel/msr.h
index 0d11b5eece..51b73950d6 100644
--- a/src/include/cpu/intel/msr.h
+++ b/src/include/cpu/intel/msr.h
@@ -6,6 +6,7 @@
  */
 
 #define MSR_FEATURE_CONFIG	0x13c
+#define  AESNI_DISABLE		(1 << 1)
 #define  AESNI_LOCK		(1 << 0)
 
 #endif /* CPU_INTEL_MSR_H */
diff --git a/src/soc/intel/apollolake/cpu.c b/src/soc/intel/apollolake/cpu.c
index 72f983f3dd..0ae170b44d 100644
--- a/src/soc/intel/apollolake/cpu.c
+++ b/src/soc/intel/apollolake/cpu.c
@@ -9,6 +9,7 @@
 #include <cpu/x86/mp.h>
 #include <cpu/intel/microcode.h>
 #include <cpu/intel/turbo.h>
+#include <cpu/intel/common/common.h>
 #include <cpu/x86/msr.h>
 #include <cpu/x86/mtrr.h>
 #include <cpu/x86/smm.h>
@@ -43,12 +44,6 @@ static const struct reg_script core_msr_script[] = {
 #endif
 	/* Disable C1E */
 	REG_MSR_RMW(MSR_POWER_CTL, ~POWER_CTL_C1E_MASK, 0),
-	/*
-	 * Enable and Lock the Advanced Encryption Standard (AES-NI)
-	 * feature register
-	 */
-	REG_MSR_RMW(MSR_FEATURE_CONFIG, ~FEATURE_CONFIG_RESERVED_MASK,
-		FEATURE_CONFIG_LOCK),
 	REG_SCRIPT_END
 };
 
@@ -62,6 +57,9 @@ void soc_core_init(struct device *cpu)
 
 	/* Set core MSRs */
 	reg_script_run(core_msr_script);
+
+	set_aesni_lock();
+
 	/*
 	 * Enable ACPI PM timer emulation, which also lets microcode know
 	 * location of ACPI_BASE_ADDRESS. This also enables other features
diff --git a/src/soc/intel/common/block/cpu/cpulib.c b/src/soc/intel/common/block/cpu/cpulib.c
index 9092df1796..854da2ea1e 100644
--- a/src/soc/intel/common/block/cpu/cpulib.c
+++ b/src/soc/intel/common/block/cpu/cpulib.c
@@ -3,6 +3,7 @@
 #include <acpi/acpigen.h>
 #include <console/console.h>
 #include <cpu/intel/turbo.h>
+#include <cpu/intel/common/common.h>
 #include <cpu/x86/msr.h>
 #include <arch/cpu.h>
 #include <intelblocks/cpulib.h>
diff --git a/src/soc/intel/common/block/include/intelblocks/msr.h b/src/soc/intel/common/block/include/intelblocks/msr.h
index 2ef4561341..2e12bf071d 100644
--- a/src/soc/intel/common/block/include/intelblocks/msr.h
+++ b/src/soc/intel/common/block/include/intelblocks/msr.h
@@ -24,9 +24,6 @@
 #define  EMULATE_DELAY_OFFSET_VALUE	20
 #define  EMULATE_PM_TMR_EN	(1 << 16)
 #define  EMULATE_DELAY_VALUE	0x13
-#define MSR_FEATURE_CONFIG	0x13c
-#define  FEATURE_CONFIG_RESERVED_MASK	0x3ULL
-#define  FEATURE_CONFIG_LOCK	(1 << 0)
 #define SMM_MCA_CAP_MSR		0x17d
 #define  SMM_CPU_SVRSTR_BIT	57
 #define  SMM_CPU_SVRSTR_MASK	(1 << (SMM_CPU_SVRSTR_BIT - 32))
diff --git a/src/soc/intel/denverton_ns/Kconfig b/src/soc/intel/denverton_ns/Kconfig
index 798d473cad..89bbbb0c45 100644
--- a/src/soc/intel/denverton_ns/Kconfig
+++ b/src/soc/intel/denverton_ns/Kconfig
@@ -34,6 +34,7 @@ config CPU_SPECIFIC_OPTIONS
 	select TSC_SYNC_MFENCE
 	select UDELAY_TSC
 	select UDK_2015_BINDING
+	select CPU_INTEL_COMMON
 	select CPU_INTEL_FIRMWARE_INTERFACE_TABLE
 	select SUPPORT_CPU_UCODE_IN_CBFS
 
diff --git a/src/soc/intel/denverton_ns/cpu.c b/src/soc/intel/denverton_ns/cpu.c
index b1eda9b54d..7cee5be39d 100644
--- a/src/soc/intel/denverton_ns/cpu.c
+++ b/src/soc/intel/denverton_ns/cpu.c
@@ -9,6 +9,7 @@
 #include <cpu/intel/smm_reloc.h>
 #include <cpu/intel/em64t100_save_state.h>
 #include <cpu/intel/turbo.h>
+#include <cpu/intel/common/common.h>
 #include <device/device.h>
 #include <device/pci.h>
 #include <intelblocks/cpulib.h>
@@ -59,12 +60,7 @@ static void denverton_core_init(struct device *cpu)
 	msr.lo |= FAST_STRINGS_ENABLE_BIT;
 	wrmsr(IA32_MISC_ENABLE, msr);
 
-	/* Lock AES-NI only if supported */
-	if (cpuid_ecx(1) & (1 << 25)) {
-		msr = rdmsr(MSR_FEATURE_CONFIG);
-		msr.lo |= FEATURE_CONFIG_LOCK;		/* Lock AES-NI */
-		wrmsr(MSR_FEATURE_CONFIG, msr);
-	}
+	set_aesni_lock();
 
 	/* Enable Turbo */
 	enable_turbo();
diff --git a/src/soc/intel/skylake/cpu.c b/src/soc/intel/skylake/cpu.c
index 5ec002322b..e716c66620 100644
--- a/src/soc/intel/skylake/cpu.c
+++ b/src/soc/intel/skylake/cpu.c
@@ -186,25 +186,6 @@ static void enable_pm_timer_emulation(void)
 	wrmsr(MSR_EMULATE_PM_TIMER, msr);
 }
 
-/*
- * Lock AES-NI (MSR_FEATURE_CONFIG) to prevent unintended disabling
- * as suggested in Intel document 325384-070US.
- */
-static void cpu_lock_aesni(void)
-{
-	msr_t msr;
-
-	/* Only run once per core as specified in the MSR datasheet */
-	if (intel_ht_sibling())
-		return;
-
-	msr = rdmsr(MSR_FEATURE_CONFIG);
-	if ((msr.lo & 1) == 0) {
-		msr.lo |= 1;
-		wrmsr(MSR_FEATURE_CONFIG, msr);
-	}
-}
-
 /* All CPUs including BSP will run the following function. */
 void soc_core_init(struct device *cpu)
 {
@@ -227,8 +208,7 @@ void soc_core_init(struct device *cpu)
 	/* Configure Intel Speed Shift */
 	configure_isst();
 
-	/* Lock AES-NI MSR */
-	cpu_lock_aesni();
+	set_aesni_lock();
 
 	/* Enable ACPI Timer Emulation via MSR 0x121 */
 	enable_pm_timer_emulation();