Furquan Shaikh has submitted this change and it was merged. ( https://review.coreboot.org/c/coreboot/+/34541 )
Change subject: soc/intel/cannonlake: Allow coreboot to handle required chipset lockdown ......................................................................
soc/intel/cannonlake: Allow coreboot to handle required chipset lockdown
This patch disables FSP-S chipset lockdown UPDs and lets coreboot perform chipset lockdown in ramstage.
BUG=b:138200201 TEST=FSP debug build suggests those UPDs are disable now.
Change-Id: I7e53c4e4987a7b0e7f475c92b0f797d94fdd60f4 Signed-off-by: Subrata Banik subrata.banik@intel.com Reviewed-on: https://review.coreboot.org/c/coreboot/+/34541 Tested-by: build bot (Jenkins) no-reply@coreboot.org Reviewed-by: Paul Fagerburg pfagerburg@chromium.org Reviewed-by: Patrick Rudolph siro@das-labor.org Reviewed-by: Tim Wawrzynczak twawrzynczak@chromium.org --- M src/soc/intel/cannonlake/fsp_params.c 1 file changed, 34 insertions(+), 0 deletions(-)
Approvals: build bot (Jenkins): Verified Patrick Rudolph: Looks good to me, approved Tim Wawrzynczak: Looks good to me, approved Paul Fagerburg: Looks good to me, but someone else must approve
diff --git a/src/soc/intel/cannonlake/fsp_params.c b/src/soc/intel/cannonlake/fsp_params.c index 6fb3060..f696f79 100644 --- a/src/soc/intel/cannonlake/fsp_params.c +++ b/src/soc/intel/cannonlake/fsp_params.c @@ -19,6 +19,7 @@ #include <fsp/api.h> #include <fsp/util.h> #include <intelblocks/xdci.h> +#include <intelpch/lockdown.h> #include <soc/intel/common/vbt.h> #include <soc/pci_devs.h> #include <soc/ramstage.h> @@ -402,6 +403,39 @@ configure_gspi_cs(i, config, ¶ms->SerialIoSpiCsPolarity[0], NULL, NULL); #endif + + /* Chipset Lockdown */ + if (get_lockdown_config() == CHIPSET_LOCKDOWN_COREBOOT) { + tconfig->PchLockDownGlobalSmi = 0; + tconfig->PchLockDownBiosInterface = 0; + params->PchLockDownBiosLock = 0; + params->PchLockDownRtcMemoryLock = 0; + /* + * TODO: Disable SpiFlashCfgLockDown config after FSP provides + * dedicated UPD + * + * Skip SPI Flash Lockdown from inside FSP. + * Making this config "0" means FSP won't set the FLOCKDN bit + * of SPIBAR + 0x04 (i.e., Bit 15 of BIOS_HSFSTS_CTL). + * So, it becomes coreboot's responsibility to set this bit + * before end of POST for security concerns. + */ + // params->SpiFlashCfgLockDown = 0; + } else { + tconfig->PchLockDownGlobalSmi = 1; + tconfig->PchLockDownBiosInterface = 1; + params->PchLockDownBiosLock = 1; + params->PchLockDownRtcMemoryLock = 1; + /* + * TODO: Enable SpiFlashCfgLockDown config after FSP provides + * dedicated UPD + * + * Enable SPI Flash Lockdown from inside FSP. + * Making this config "1" means FSP will set the FLOCKDN bit + * of SPIBAR + 0x04 (i.e., Bit 15 of BIOS_HSFSTS_CTL). + */ + // params->SpiFlashCfgLockDown = 1; + } }
/* Mainboard GPIO Configuration */