1 /* SPDX-License-Identifier: GPL-2.0-only */
2
3 #include <bootstate.h>
4 #include <intelblocks/cfg.h>
5 #include <intelblocks/fast_spi.h>
6 #include <intelblocks/lpc_lib.h>
7 #include <intelblocks/pcr.h>
8 #include <intelblocks/systemagent.h>
9 #include <intelpch/lockdown.h>
10 #include <intelblocks/gpmr.h>
11 #include <soc/pci_devs.h>
12 #include <soc/pcr_ids.h>
13 #include <soc/soc_chip.h>
14
15 /*
16 * This function will get lockdown config specific to soc.
17 *
18 * Return values:
19 * 0 = CHIPSET_LOCKDOWN_COREBOOT = Use coreboot to lockdown IPs
20 * 1 = CHIPSET_LOCKDOWN_FSP = use FSP's lockdown functionality to lockdown IPs
21 */
get_lockdown_config(void)22 int get_lockdown_config(void)
23 {
24 const struct soc_intel_common_config *common_config;
25 common_config = chip_get_common_soc_structure();
26
27 return common_config->chipset_lockdown;
28 }
29
gpmr_lockdown_cfg(void)30 static void gpmr_lockdown_cfg(void)
31 {
32 if (!CONFIG(SOC_INTEL_COMMON_BLOCK_GPMR))
33 return;
34
35 /*
36 * GCS reg
37 *
38 * When set, prevents GCS.BBS from being changed
39 * GCS.BBS: (Boot BIOS Strap) This field determines the destination
40 * of accesses to the BIOS memory range.
41 * Bits Description
42 * "0b": SPI
43 * "1b": LPC/eSPI
44 */
45 gpmr_or32(GPMR_GCS, GPMR_GCS_BILD);
46
47 /*
48 * Set Secure Register Lock (SRL) bit in DMI control register to lock
49 * DMI configuration and bypass when IOC instead of DMI
50 */
51 if (!CONFIG(SOC_INTEL_COMMON_BLOCK_IOC))
52 gpmr_or32(GPMR_DMICTL, GPMR_DMICTL_SRLOCK);
53 }
54
fast_spi_lockdown_cfg(int chipset_lockdown)55 static void fast_spi_lockdown_cfg(int chipset_lockdown)
56 {
57 if (!CONFIG(SOC_INTEL_COMMON_BLOCK_FAST_SPI))
58 return;
59
60 /* Set FAST_SPI opcode menu */
61 fast_spi_set_opcode_menu();
62
63 /* Discrete Lock Flash PR registers */
64 fast_spi_pr_dlock();
65
66 /* Check if SPI transaction is pending */
67 fast_spi_cycle_in_progress();
68
69 /* Clear any outstanding status bits like AEL, FCERR, FDONE, SAF etc. */
70 fast_spi_clear_outstanding_status();
71
72 /* Lock FAST_SPIBAR */
73 fast_spi_lock_bar();
74
75 /* Set Vendor Component Lock (VCL) */
76 fast_spi_vscc0_lock();
77
78 /* Set BIOS Interface Lock, BIOS Lock */
79 if (chipset_lockdown == CHIPSET_LOCKDOWN_COREBOOT) {
80 /* BIOS Interface Lock */
81 fast_spi_set_bios_interface_lock_down();
82
83 /* Only allow writes in SMM */
84 if (CONFIG(BOOTMEDIA_SMM_BWP)) {
85 fast_spi_set_eiss();
86 fast_spi_enable_wp();
87 }
88
89 /* BIOS Lock */
90 fast_spi_set_lock_enable();
91
92 /* EXT BIOS Lock */
93 fast_spi_set_ext_bios_lock_enable();
94 }
95 }
96
lpc_lockdown_config(int chipset_lockdown)97 static void lpc_lockdown_config(int chipset_lockdown)
98 {
99 /* Set BIOS Interface Lock, BIOS Lock */
100 if (chipset_lockdown == CHIPSET_LOCKDOWN_COREBOOT) {
101 /* BIOS Interface Lock */
102 lpc_set_bios_interface_lock_down();
103
104 /* Only allow writes in SMM */
105 if (CONFIG(BOOTMEDIA_SMM_BWP)) {
106 lpc_set_eiss();
107 lpc_enable_wp();
108 }
109
110 /* BIOS Lock */
111 lpc_set_lock_enable();
112 }
113 }
114
sa_lockdown_config(int chipset_lockdown)115 static void sa_lockdown_config(int chipset_lockdown)
116 {
117 if (!CONFIG(SOC_INTEL_COMMON_BLOCK_SA))
118 return;
119
120 if (chipset_lockdown == CHIPSET_LOCKDOWN_COREBOOT)
121 sa_lock_pam();
122 }
123
124 /*
125 * platform_lockdown_config has 2 major part.
126 * 1. Common SoC lockdown configuration.
127 * 2. SoC specific lockdown configuration as per Silicon
128 * guideline.
129 */
platform_lockdown_config(void * unused)130 static void platform_lockdown_config(void *unused)
131 {
132 int chipset_lockdown;
133 chipset_lockdown = get_lockdown_config();
134
135 /* SPI lock down configuration */
136 fast_spi_lockdown_cfg(chipset_lockdown);
137
138 /* LPC/eSPI lock down configuration */
139 lpc_lockdown_config(chipset_lockdown);
140
141 /* GPMR lock down configuration */
142 gpmr_lockdown_cfg();
143
144 /* SA lock down configuration */
145 sa_lockdown_config(chipset_lockdown);
146
147 /* SoC lock down configuration */
148 soc_lockdown_config(chipset_lockdown);
149 }
150
151 BOOT_STATE_INIT_ENTRY(BS_DEV_RESOURCES, BS_ON_EXIT, platform_lockdown_config,
152 NULL);
153