3 files changed, 37 insertions, 0 deletions
diff --git a/src/cpu/intel/common/common.h b/src/cpu/intel/common/common.h
index df14668095..aaeca1da10 100644
--- a/src/cpu/intel/common/common.h
+++ b/src/cpu/intel/common/common.h
@@ -27,4 +27,10 @@ bool intel_ht_supported(void);
  */
 bool intel_ht_sibling(void);
 
+/*
+ * Lock AES-NI feature (MSR_FEATURE_CONFIG) to prevent unintended disabling
+ * as suggested in Intel document 325384-070US.
+ */
+void set_aesni_lock(void);
+
 #endif
diff --git a/src/cpu/intel/common/common_init.c b/src/cpu/intel/common/common_init.c
index 3e5b578d22..e532c975cb 100644
--- a/src/cpu/intel/common/common_init.c
+++ b/src/cpu/intel/common/common_init.c
@@ -3,6 +3,7 @@
 #include <acpi/acpigen.h>
 #include <arch/cpu.h>
 #include <console/console.h>
+#include <cpu/intel/msr.h>
 #include <cpu/x86/msr.h>
 #include "common.h"
 
@@ -264,3 +265,22 @@ void cpu_init_cppc_config(struct cppc_config *config, u32 version)
 		config->regs[CPPC_AUTO_SELECT] = msr;
 	}
 }
+
+/*
+ * Lock AES-NI feature (MSR_FEATURE_CONFIG) to prevent unintended disabling
+ * as suggested in Intel document 325384-070US.
+ */
+void set_aesni_lock(void)
+{
+	msr_t msr;
+
+	/* Only run once per core as specified in the MSR datasheet */
+	if (intel_ht_sibling())
+		return;
+
+	msr = rdmsr(MSR_FEATURE_CONFIG);
+	if ((msr.lo & 1) == 0) {
+		msr.lo |= 1;
+		wrmsr(MSR_FEATURE_CONFIG, msr);
+	}
+}
diff --git a/src/include/cpu/intel/msr.h b/src/include/cpu/intel/msr.h
new file mode 100644
index 0000000000..73dd32091b
--- /dev/null
+++ b/src/include/cpu/intel/msr.h
@@ -0,0 +1,11 @@
+#ifndef CPU_INTEL_MSR_H
+#define CPU_INTEL_MSR_H
+
+/*
+ * Common MSRs for Intel CPUs
+ */
+
+#define MSR_FEATURE_CONFIG	0x13c
+#define  AESNI_LOCK_BIT		0
+
+#endif /* CPU_INTEL_MSR_H */