blob: eec3beb01b437c02f0f1bd87882a7e45ae6eee03 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
|
/* SPDX-License-Identifier: GPL-2.0-only */
#include <bootstate.h>
#include <intelblocks/cfg.h>
#include <intelblocks/fast_spi.h>
#include <intelblocks/lpc_lib.h>
#include <intelblocks/pcr.h>
#include <intelblocks/systemagent.h>
#include <intelpch/lockdown.h>
#include <intelblocks/gpmr.h>
#include <soc/pci_devs.h>
#include <soc/pcr_ids.h>
#include <soc/soc_chip.h>
/*
* This function will get lockdown config specific to soc.
*
* Return values:
* 0 = CHIPSET_LOCKDOWN_COREBOOT = Use coreboot to lockdown IPs
* 1 = CHIPSET_LOCKDOWN_FSP = use FSP's lockdown functionality to lockdown IPs
*/
int get_lockdown_config(void)
{
const struct soc_intel_common_config *common_config;
common_config = chip_get_common_soc_structure();
return common_config->chipset_lockdown;
}
static void gpmr_lockdown_cfg(void)
{
if (!CONFIG(SOC_INTEL_COMMON_BLOCK_GPMR))
return;
/*
* GCS reg
*
* When set, prevents GCS.BBS from being changed
* GCS.BBS: (Boot BIOS Strap) This field determines the destination
* of accesses to the BIOS memory range.
* Bits Description
* "0b": SPI
* "1b": LPC/eSPI
*/
gpmr_or32(GPMR_GCS, GPMR_GCS_BILD);
/*
* Set Secure Register Lock (SRL) bit in DMI control register to lock
* DMI configuration and bypass when IOC instead of DMI
*/
if (!CONFIG(SOC_INTEL_COMMON_BLOCK_IOC))
gpmr_or32(GPMR_DMICTL, GPMR_DMICTL_SRLOCK);
}
static void fast_spi_lockdown_cfg(int chipset_lockdown)
{
if (!CONFIG(SOC_INTEL_COMMON_BLOCK_FAST_SPI))
return;
/* Set FAST_SPI opcode menu */
fast_spi_set_opcode_menu();
/* Discrete Lock Flash PR registers */
fast_spi_pr_dlock();
/* Check if SPI transaction is pending */
fast_spi_cycle_in_progress();
/* Clear any outstanding status bits like AEL, FCERR, FDONE, SAF etc. */
fast_spi_clear_outstanding_status();
/* Lock FAST_SPIBAR */
fast_spi_lock_bar();
/* Set Vendor Component Lock (VCL) */
fast_spi_vscc0_lock();
/* Set BIOS Interface Lock, BIOS Lock */
if (chipset_lockdown == CHIPSET_LOCKDOWN_COREBOOT) {
/* BIOS Interface Lock */
fast_spi_set_bios_interface_lock_down();
/* Only allow writes in SMM */
if (CONFIG(BOOTMEDIA_SMM_BWP)) {
fast_spi_set_eiss();
fast_spi_enable_wp();
}
/* BIOS Lock */
fast_spi_set_lock_enable();
/* EXT BIOS Lock */
fast_spi_set_ext_bios_lock_enable();
}
}
static void lpc_lockdown_config(int chipset_lockdown)
{
/* Set BIOS Interface Lock, BIOS Lock */
if (chipset_lockdown == CHIPSET_LOCKDOWN_COREBOOT) {
/* BIOS Interface Lock */
lpc_set_bios_interface_lock_down();
/* Only allow writes in SMM */
if (CONFIG(BOOTMEDIA_SMM_BWP)) {
lpc_set_eiss();
lpc_enable_wp();
}
/* BIOS Lock */
lpc_set_lock_enable();
}
}
static void sa_lockdown_config(int chipset_lockdown)
{
if (!CONFIG(SOC_INTEL_COMMON_BLOCK_SA))
return;
if (chipset_lockdown == CHIPSET_LOCKDOWN_COREBOOT)
sa_lock_pam();
}
/*
* platform_lockdown_config has 2 major part.
* 1. Common SoC lockdown configuration.
* 2. SoC specific lockdown configuration as per Silicon
* guideline.
*/
static void platform_lockdown_config(void *unused)
{
int chipset_lockdown;
chipset_lockdown = get_lockdown_config();
/* SPI lock down configuration */
fast_spi_lockdown_cfg(chipset_lockdown);
/* LPC/eSPI lock down configuration */
lpc_lockdown_config(chipset_lockdown);
/* GPMR lock down configuration */
gpmr_lockdown_cfg();
/* SA lock down configuration */
sa_lockdown_config(chipset_lockdown);
/* SoC lock down configuration */
soc_lockdown_config(chipset_lockdown);
}
BOOT_STATE_INIT_ENTRY(BS_DEV_RESOURCES, BS_ON_EXIT, platform_lockdown_config,
NULL);
|
