From 9f0266c599d3a54c9a74d32063ac6723f3d147a6 Mon Sep 17 00:00:00 2001
From: Tim Wawrzynczak <twawrzynczak@chromium.org>
Date: Thu, 26 Aug 2021 09:17:53 -0600
Subject: soc/intel/cannonlake: Lock PAM registers in finalize

Use the support from the previous patch to have coreboot lock the PAM
registers instead of the FSP when the lockdown configuration is set to
coreboot.

Change-Id: I6ae22f9df4834508dfa304050fad44d45df45334
Signed-off-by: Tim Wawrzynczak <twawrzynczak@chromium.org>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/57184
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Furquan Shaikh <furquan@google.com>
---
 src/soc/intel/cannonlake/finalize.c   | 9 +++++++++
 src/soc/intel/cannonlake/fsp_params.c | 1 +
 2 files changed, 10 insertions(+)

(limited to 'src/soc/intel')

diff --git a/src/soc/intel/cannonlake/finalize.c b/src/soc/intel/cannonlake/finalize.c
index 8888315747..63749f92cf 100644
--- a/src/soc/intel/cannonlake/finalize.c
+++ b/src/soc/intel/cannonlake/finalize.c
@@ -10,8 +10,10 @@
 #include <intelblocks/lpc_lib.h>
 #include <intelblocks/pcr.h>
 #include <intelblocks/pmclib.h>
+#include <intelblocks/systemagent.h>
 #include <intelblocks/tco.h>
 #include <intelblocks/thermal.h>
+#include <intelpch/lockdown.h>
 #include <soc/p2sb.h>
 #include <soc/pci_devs.h>
 #include <soc/pcr_ids.h>
@@ -80,12 +82,19 @@ static void pch_finalize(void)
 
 }
 
+static void sa_finalize(void)
+{
+	if (get_lockdown_config() == CHIPSET_LOCKDOWN_COREBOOT)
+		sa_lock_pam();
+}
+
 static void soc_finalize(void *unused)
 {
 	printk(BIOS_DEBUG, "Finalizing chipset.\n");
 
 	pch_finalize();
 	apm_control(APM_CNT_FINALIZE);
+	sa_finalize();
 
 	/* Indicate finalize step with post code */
 	post_code(POST_OS_BOOT);
diff --git a/src/soc/intel/cannonlake/fsp_params.c b/src/soc/intel/cannonlake/fsp_params.c
index dd5f197a19..1ae27aefee 100644
--- a/src/soc/intel/cannonlake/fsp_params.c
+++ b/src/soc/intel/cannonlake/fsp_params.c
@@ -653,6 +653,7 @@ void platform_fsp_silicon_init_params_cb(FSPS_UPD *supd)
 	tconfig->PchLockDownBiosInterface = lockdown_by_fsp;
 	params->PchLockDownBiosLock = lockdown_by_fsp;
 	params->PchLockDownRtcMemoryLock = lockdown_by_fsp;
+	tconfig->SkipPamLock = !lockdown_by_fsp;
 #if CONFIG(SOC_INTEL_COMETLAKE)
 	/*
 	 * Making this config "0" means FSP won't set the FLOCKDN bit
-- 
cgit v1.2.3