sb/intel/common/firmware: Add Intel ME/TXE firmware check
Ensure that the provided ME/TXE firmware is valid, using the
check capabilities of me_cleaner.
me_cleaner checks that the fundamental partition is available and
it has a correct signature. The checks performed by me_cleaner
aren't exhaustive, but they should find at least whether the user
has provided an empty or corrupted firmware.
me_cleaner has been tested on all the ME (6-11.6) and TXE (1-3)
firmwares available here [1], and it hasn't reported any false
positive.
[1] http://www.win-raid.com/t832f39-Intel-Engine-Firmware-Repositories.html
Change-Id: Ie6ea3b4e637dca4097b9377bd0507e84c4e8f687
Signed-off-by: Nicola Corna <nicola@corna.info>
Reviewed-on: https://review.coreboot.org/18768
Tested-by: build bot (Jenkins)
Reviewed-by: Paul Menzel <paulepanter@users.sourceforge.net>
Reviewed-by: Philipp Deppenwiese <zaolin.daisuki@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philippe.mathieu.daude@gmail.com>
diff --git a/src/southbridge/intel/common/firmware/Kconfig b/src/southbridge/intel/common/firmware/Kconfig
index da40db0..f4be93c 100644
--- a/src/southbridge/intel/common/firmware/Kconfig
+++ b/src/southbridge/intel/common/firmware/Kconfig
@@ -58,6 +58,19 @@
default "3rdparty/blobs/mainboard/$(MAINBOARDDIR)/me.bin"
depends on HAVE_ME_BIN
+config CHECK_ME
+ bool "Verify the integrity of the supplied ME/TXE firmware"
+ default y
+ depends on HAVE_ME_BIN && (NORTHBRIDGE_INTEL_NEHALEM || \
+ NORTHBRIDGE_INTEL_SANDYBRIDGE || \
+ NORTHBRIDGE_INTEL_IVYBRIDGE || NORTHBRIDGE_INTEL_HASWELL || \
+ SOC_INTEL_BROADWELL || SOC_INTEL_SKYLAKE || \
+ SOC_INTEL_BAYTRAIL || SOC_INTEL_BRASWELL)
+ help
+ Verify the integrity of the supplied Intel ME/TXE firmware before
+ proceeding with the build, in order to prevent an accidental loading
+ of a corrupted ME/TXE image.
+
config USE_ME_CLEANER
bool "Strip down the Intel ME/TXE firmware"
depends on HAVE_ME_BIN && (NORTHBRIDGE_INTEL_SANDYBRIDGE || \