| ## SPDX-License-Identifier: GPL-2.0-only |
| |
| config DISABLE_HECI1_AT_PRE_BOOT |
| bool "Disable HECI1 at the end of boot" |
| depends on SOC_INTEL_COMMON_BLOCK_CSE |
| default n |
| help |
| This config decides the state of HECI1(CSE) device at the end of boot. |
| Mainboard users to select this config to make HECI1 `function disable` |
| prior to handing off to payload. |
| |
| config MAX_HECI_DEVICES |
| int |
| default 6 |
| |
| config SOC_INTEL_COMMON_BLOCK_CSE |
| bool |
| default n |
| help |
| Driver for communication with Converged Security Engine (CSE) |
| over Host Embedded Controller Interface (HECI) |
| |
| config SOC_INTEL_COMMON_BLOCK_HECI1_DISABLE_USING_SBI |
| bool |
| default y if HECI_DISABLE_USING_SMM |
| select SOC_INTEL_COMMON_BLOCK_P2SB |
| help |
| Use this config to allow common CSE block to make HECI1 function disable |
| in the SMM mode. From CNL PCH onwards,`HECI1` disabling can only be done |
| using the non-posted sideband write after FSP-S sets the postboot_sai |
| attribute. |
| |
| config SOC_INTEL_COMMON_BLOCK_HECI1_DISABLE_USING_PMC_IPC |
| bool |
| default n |
| select SOC_INTEL_COMMON_BLOCK_PMC |
| help |
| Use this config to allow common CSE block to make HECI1 function disable |
| using PMC IPC command `0xA9`. From TGL PCH onwards, disabling heci1 |
| device using PMC IPC doesn't required to run the operation in SMM. |
| |
| config SOC_INTEL_COMMON_BLOCK_HECI1_DISABLE_USING_PCR |
| bool |
| default n |
| select SOC_INTEL_COMMON_BLOCK_PCR |
| help |
| Use this config for SoC platform prior to CNL PCH (with postboot_sai implemented) |
| to make `HECI1` device disable using private configuration register (PCR) write. |
| |
| config SOC_INTEL_STORE_CSE_FW_VERSION |
| bool |
| default y |
| depends on SOC_INTEL_CSE_LITE_SKU |
| help |
| This configuration option stores CSE RW FW version in CBMEM area. |
| This information can be used to identify if the CSE firmware update is successful |
| by comparing the currently running CSE RW firmware version against CSE version |
| belongs to the CONFIG_SOC_INTEL_CSE_RW_VERSION (decided statically while |
| building the AP FW image). |
| |
| The way to retrieve the CSE firmware version is by sending the HECI command to |
| read the CSE Boot Partition (BP) info. The cost of sending HECI command to read |
| the CSE FW version is between 7ms-20ms (depending on the SoC architecture) hence, |
| ensure this feature is platform specific and only enabled for the platform |
| that would like to store the CSE version into the CBMEM. |
| |
| config SOC_INTEL_CSE_FW_PARTITION_CMOS_OFFSET |
| int |
| default 68 |
| depends on SOC_INTEL_CSE_LITE_SKU |
| help |
| This configuration option stores the starting offset of cse fw partition versions in |
| CMOS memory. The offset should be byte aligned and must leave enough memory to store |
| required firmware partition versions. |
| |
| config SOC_INTEL_STORE_ISH_FW_VERSION |
| bool |
| default n |
| depends on DRIVERS_INTEL_ISH |
| help |
| This configuration option stores ISH version in CBMEM area. |
| This information can be used to identify the currently running ISH firmware |
| version. |
| |
| ISH BUP is sitting inside the CSE firmware partition. The way to retrieve the |
| ISH version is by sending the HECI command to read the CSE FPT. The cost of sending |
| HECI command to read the CSE FPT is significant (~200ms) hence, the idea is to |
| read the CSE RW version on every cold reset (to cover the CSE update scenarios) |
| and store into CBMEM to avoid the cost of resending the HECI command in all |
| consecutive warm boots. |
| |
| Later boot stages can just read the CBMEM ID to retrieve the ISH version. |
| |
| Additionally, ensure this feature is platform specific hence, only enabled |
| for the platform that would like to store the ISH version into the CBMEM and |
| parse to perform some additional work. |
| |
| config SOC_INTEL_CSE_SEND_EOP_EARLY |
| bool "CSE send EOP early" |
| depends on SOC_INTEL_COMMON_BLOCK_CSE |
| help |
| Use this config to send End Of Post (EOP) earlier through SoC code in order to |
| reduce time required to send EOP and getting CSE response. |
| In later stages, CSE might be busy and might require more time to process EOP command. |
| SoC can use this Kconfig to send EOP earlier by itself. |
| |
| config SOC_INTEL_CSE_SEND_EOP_LATE |
| bool |
| depends on SOC_INTEL_COMMON_BLOCK_CSE |
| help |
| Use this config to send End Of Post (EOP) late (even after CSE `final` operation) |
| using boot state either `BS_PAYLOAD_BOOT` or `BS_PAYLOAD_LOAD` from common code |
| in order to reduce time required to send EOP and getting CSE response. |
| It has been observed that CSE might be busy and might require more time to |
| process the EOP command. |
| SoC can use this Kconfig to send EOP later by itself. |
| Starting with Jasper Lake, coreboot sends EOP before loading payload hence, this |
| config is applicable for those platforms. |
| |
| config SOC_INTEL_CSE_SEND_EOP_ASYNC |
| bool |
| depends on SOC_INTEL_COMMON_BLOCK_CSE |
| depends on !SOC_INTEL_CSE_SEND_EOP_LATE |
| depends on !SOC_INTEL_CSE_SEND_EOP_EARLY |
| help |
| Use this config to handle End Of Post (EOP) completion |
| asynchronously. The EOP command is sent first and the result |
| is checked later leaving time to CSE to complete the |
| operation while coreboot perform other activities. |
| Performing EOP asynchronously reduces the time spent |
| actively waiting for command completion which can have a |
| significant impact on boot time. |
| |
| Using this asynchronous approach comes with the limitation |
| that no HECI command should be sent between the time the EOP |
| request is posted (at CSE .final device operation) and the |
| time coreboot check for its completion (BS_PAYLOAD_LOAD). |
| |
| config SOC_INTEL_CSE_SEND_EOP_BY_PAYLOAD |
| bool |
| depends on SOC_INTEL_COMMON_BLOCK_CSE |
| depends on !SOC_INTEL_CSE_SEND_EOP_LATE |
| depends on !SOC_INTEL_CSE_SEND_EOP_EARLY |
| depends on !SOC_INTEL_CSE_SEND_EOP_ASYNC |
| depends on !DISABLE_HECI1_AT_PRE_BOOT |
| help |
| Use this config to specify that the payload will send the End Of Post (EOP) instead |
| of coreboot. |
| |
| In this case, the HECI interface needs to stay visible and the payload must support |
| sending commands to CSE. |
| |
| config SOC_INTEL_CSE_LITE_SYNC_BY_PAYLOAD |
| bool |
| depends on SOC_INTEL_COMMON_BLOCK_CSE |
| help |
| Use this config to specify that the payload will update the CSE RW partition instead |
| of coreboot. |
| |
| In this case, CSE shall not switch to RW partition and the payload must support |
| CSE RW update. |
| |
| config SOC_INTEL_CSE_LITE_SKU |
| bool |
| default n |
| help |
| Enables CSE Lite SKU |
| |
| config SOC_INTEL_CSE_LITE_PSR |
| bool |
| default n |
| depends on SOC_INTEL_CSE_LITE_SKU |
| select SOC_INTEL_CSE_LITE_SYNC_IN_RAMSTAGE |
| help |
| Select this config if Platform Service Record(PSR) is supported by the platform. This |
| config is applicable only for Lite SKU, where PSR data backup is required prior to a |
| CSE firmware downgrade during which CSE data is cleared. PSR services in CSE FW is |
| enabled only post DRAM init and the command to backup PSR data is also supported only |
| post DRAM init. Hence platform that selects PSR would need to perform CSE firmware sync |
| in ramstage. |
| |
| config SOC_INTEL_CSE_SERVER_SKU |
| bool |
| default n |
| help |
| Enables CSE Server SKU |
| |
| config SOC_INTEL_CSE_RW_UPDATE |
| bool "Enable the CSE RW Update Feature" |
| default n |
| depends on SOC_INTEL_CSE_LITE_SKU |
| help |
| This config will enable CSE RW firmware update feature and also will be used ensure |
| all the required configs are provided by mainboard. |
| |
| config SOC_INTEL_CSE_FMAP_NAME |
| string "Name of CSE Region in FMAP" if SOC_INTEL_CSE_RW_UPDATE |
| default "SI_ME" |
| help |
| Name of CSE region in FMAP |
| |
| config SOC_INTEL_CSE_RW_A_FMAP_NAME |
| string "Location of CSE RW A in FMAP" if SOC_INTEL_CSE_RW_UPDATE |
| default "ME_RW_A" |
| help |
| Name of CSE RW A region in FMAP |
| |
| config SOC_INTEL_CSE_RW_B_FMAP_NAME |
| string "Location of CSE RW B in FMAP" if SOC_INTEL_CSE_RW_UPDATE |
| default "ME_RW_B" |
| help |
| Name of CSE RW B region in FMAP |
| |
| config SOC_INTEL_CSE_RW_CBFS_NAME |
| string "CBFS entry name for CSE RW blob" if SOC_INTEL_CSE_RW_UPDATE |
| default "me_rw" |
| help |
| CBFS entry name for Intel CSE CBFS RW blob |
| |
| config SOC_INTEL_CSE_RW_HASH_CBFS_NAME |
| string "CBFS name for CSE RW hash file" if SOC_INTEL_CSE_RW_UPDATE |
| default "me_rw.hash" |
| help |
| CBFS name for Intel CSE CBFS RW hash file |
| |
| config SOC_INTEL_CSE_RW_VERSION_CBFS_NAME |
| string "CBFS name for CSE RW version file" if SOC_INTEL_CSE_RW_UPDATE |
| default "me_rw.version" |
| help |
| CBFS name for Intel CSE CBFS RW version file |
| |
| config SOC_INTEL_CSE_RW_FILE |
| string "Intel CSE CBFS RW path and filename" if SOC_INTEL_CSE_RW_UPDATE && !STITCH_ME_BIN |
| default "" |
| help |
| Intel CSE CBFS RW blob path and file name |
| |
| config SOC_INTEL_CSE_RW_VERSION |
| string "Intel CSE RW firmware version (deprecated)" if SOC_INTEL_CSE_RW_UPDATE |
| default "" |
| help |
| This config contains the Intel CSE RW version of the blob that is provided by |
| SOC_INTEL_CSE_RW_FILE config and the version must be set in the format |
| major.minor.hotfix.build (ex: 14.0.40.1209). |
| |
| This config may be deprecated in the future. Consider not providing the CSE RW |
| firmware version here and let the CSE version be automatically queried from the CSE |
| binary at build time (available with Meteor Lake and following platforms). |
| |
| config SOC_INTEL_CSE_SET_EOP |
| bool |
| default n |
| select PMC_IPC_ACPI_INTERFACE |
| help |
| This config ensures coreboot will send the CSE the End-of-POST message |
| just prior to loading the payload. This is a security feature so the |
| CSE will no longer respond to Pre-Boot commands. |
| |
| config SOC_INTEL_CSE_SUB_PART_UPDATE |
| bool "Enable the CSE sub-partition update Feature" |
| default n |
| depends on SOC_INTEL_CSE_LITE_SKU |
| help |
| This config will enable CSE sub-partition firmware update feature and also will be used ensure |
| all the required configs are provided by mainboard. |
| |
| config SOC_INTEL_CSE_IOM_CBFS_NAME |
| string "CBFS name for CSE sub-partition IOM binary" if SOC_INTEL_CSE_SUB_PART_UPDATE |
| default "cse_iom" |
| help |
| CBFS entry name for Intel CSE sub-partition IOM binary |
| |
| config SOC_INTEL_CSE_IOM_CBFS_FILE |
| string "Intel CBFS path and file name for CSE sub-partition IOM binary" if SOC_INTEL_CSE_SUB_PART_UPDATE |
| default "" |
| help |
| CBFS path and file name for Intel CSE sub-partition IOM binary |
| |
| config SOC_INTEL_CSE_NPHY_CBFS_NAME |
| string "CBFS name for CSE sub-partition NPHY binary" if SOC_INTEL_CSE_SUB_PART_UPDATE |
| default "cse_nphy" |
| help |
| CBFS entry name for Intel CSE sub-partition NPHY binary |
| |
| config SOC_INTEL_CSE_NPHY_CBFS_FILE |
| string "Intel CBFS path and file name for CSE sub-partition NPHY binary" if SOC_INTEL_CSE_SUB_PART_UPDATE |
| default "" |
| help |
| CBFS path and file name for Intel CSE sub-partition NPHY binary |
| |
| config SOC_INTEL_CSE_LITE_COMPRESS_ME_RW |
| bool |
| default n |
| depends on SOC_INTEL_CSE_LITE_SKU |
| select CBFS_ALLOW_UNVERIFIED_DECOMPRESSION if CBFS_VERIFICATION && !VBOOT_CBFS_INTEGRATION |
| help |
| Enable compression on Intel CSE CBFS RW blob |
| |
| config SOC_INTEL_CSE_PRE_CPU_RESET_TELEMETRY |
| def_bool n |
| depends on SOC_INTEL_CSE_LITE_SKU |
| help |
| Mainboard user to select this Kconfig in order to capture pre-cpu |
| reset boot performance telemetry data. |
| |
| config SOC_INTEL_CSE_PRE_CPU_RESET_TELEMETRY_V1 |
| bool |
| select SOC_INTEL_CSE_PRE_CPU_RESET_TELEMETRY |
| help |
| This config will make mainboard use version 1 of the CSE timestamp |
| definitions, it can be used for Alder Lake and Raptor Lake (all SKUs). |
| |
| config SOC_INTEL_CSE_PRE_CPU_RESET_TELEMETRY_V2 |
| bool |
| select SOC_INTEL_CSE_PRE_CPU_RESET_TELEMETRY |
| help |
| This config will make mainboard use version 2 of the CSE timestamp |
| definitions, it can be used for Meteor Lake M/P. |
| |
| config SOC_INTEL_CSE_LITE_SYNC_IN_ROMSTAGE |
| bool |
| default !SOC_INTEL_CSE_LITE_SYNC_IN_RAMSTAGE |
| depends on SOC_INTEL_CSE_LITE_SKU && !SOC_INTEL_CSE_LITE_COMPRESS_ME_RW |
| help |
| Use default flow of CSE FW Update in romstage when uncompressed ME_RW blobs are used. |
| |
| config SOC_INTEL_CSE_LITE_SYNC_IN_RAMSTAGE |
| bool |
| default n |
| help |
| Use this option if CSE RW update needs to be triggered during RAMSTAGE. |
| |
| config SOC_INTEL_CSE_HAVE_SPEC_SUPPORT |
| bool |
| depends on SOC_INTEL_COMMON_BLOCK_CSE |
| default n |
| help |
| This option config will allow SoC platform to use applicable ME specification. |
| The version based CSE measured ME specification data structures are defined at |
| common code. Enabling this option will use those CSE defined ME specification |
| for the SoC. User should select pertinent ME spec version along with this option. |
| |
| config SOC_INTEL_COMMON_BLOCK_ME_SPEC_12 |
| bool |
| select SOC_INTEL_CSE_HAVE_SPEC_SUPPORT |
| help |
| This config will enable 'ME specification version 12'. It will ensure ME specific |
| declaration and uses of required data structures for Host firmware status registers. |
| |
| config SOC_INTEL_COMMON_BLOCK_ME_SPEC_13 |
| bool |
| select SOC_INTEL_CSE_HAVE_SPEC_SUPPORT |
| help |
| This config will enable 'ME specification version 13'. It will ensure ME specific |
| declaration and uses of required data structures for Host firmware status registers. |
| |
| config SOC_INTEL_COMMON_BLOCK_ME_SPEC_15 |
| bool |
| select SOC_INTEL_CSE_HAVE_SPEC_SUPPORT |
| help |
| This config will enable 'ME specification version 15'. It will ensure ME specific |
| declaration and uses of required data structures for Host firmware status registers. |
| |
| config SOC_INTEL_COMMON_BLOCK_ME_SPEC_16 |
| bool |
| select SOC_INTEL_CSE_HAVE_SPEC_SUPPORT |
| help |
| This config will enable 'ME specification version 16'. It will ensure ME specific |
| declaration and uses of required data structures for Host firmware status registers. |
| |
| config SOC_INTEL_COMMON_BLOCK_ME_SPEC_18 |
| bool |
| select SOC_INTEL_CSE_HAVE_SPEC_SUPPORT |
| help |
| This config will enable 'ME specification version 18'. It will ensure ME specific |
| declaration and uses of required data structures for Host firmware status registers. |
| |
| if SOC_INTEL_CSE_HAVE_SPEC_SUPPORT |
| |
| config ME_SPEC |
| int |
| default 12 if SOC_INTEL_COMMON_BLOCK_ME_SPEC_12 |
| default 13 if SOC_INTEL_COMMON_BLOCK_ME_SPEC_13 |
| default 15 if SOC_INTEL_COMMON_BLOCK_ME_SPEC_15 |
| default 16 if SOC_INTEL_COMMON_BLOCK_ME_SPEC_16 |
| default 18 if SOC_INTEL_COMMON_BLOCK_ME_SPEC_18 |
| help |
| This config holds the ME spec version if defined. |
| |
| endif # SOC_INTEL_CSE_HAVE_SPEC_SUPPORT |
| |
| if STITCH_ME_BIN |
| |
| config CSE_COMPONENTS_PATH |
| string "Path to directory containing all CSE input components to stitch" |
| default "3rdparty/blobs/mainboard/\$(CONFIG_MAINBOARD_DIR)/firmware" |
| help |
| This is the file path containing all the input CSE component files. |
| These will be used by cse_serger tool to stitch CSE image. |
| |
| config CSE_FPT_FILE |
| string "Name of CSE FPT file" |
| default "cse_fpt.bin" |
| help |
| This file is the CSE input binary as released by Intel in a CSE kit. |
| |
| config CSE_DATA_FILE |
| string "Name of CSE data file" |
| default "cse_data.bin" |
| help |
| This file is the CSE data binary typically generated by Intel FIT tool. |
| |
| config CSE_PMCP_FILE |
| string "Name of PMC file" |
| default "pmc.bin" |
| help |
| This file is the PMC input binary as released by Intel in a CSE kit. |
| |
| config CSE_IOMP_FILE |
| string "Name of IOM file" |
| default "iom.bin" |
| help |
| This file is the IOM input binary as released by Intel in a CSE kit. |
| |
| config CSE_TBTP_FILE |
| string "Name of TBT file" |
| default "tbt.bin" |
| help |
| This file is the TBT input binary as released by Intel in a CSE kit. |
| |
| config CSE_NPHY_FILE |
| string "Name of NPHY file" |
| default "nphy.bin" |
| help |
| This file is the NPHY input binary as released by Intel in a CSE kit. |
| |
| config CSE_PCHC_FILE |
| string "Name of PCHC file" |
| default "pchc.bin" |
| help |
| This file is the PCHC input binary as released by Intel in a CSE kit. |
| |
| config CSE_IUNP_FILE |
| string "Name of IUNIT file" |
| default "iunit.bin" |
| help |
| This file is the PCHC input binary as released by Intel in a CSE kit. |
| |
| config CSE_BPDT_VERSION |
| string |
| help |
| This config indicates the BPDT version used by CSE for a given SoC. |
| |
| config CSE_OEMP_FILE |
| string "Name of OEM Key Manifest file" |
| default "oem_km.bin" |
| help |
| OEM Key Manifest lists the public key hashes used for authenticating the |
| OEM created binaries to be loaded. This binary is generated by signing with |
| the key owned by trusted owner. |
| |
| endif |
| |
| config CSE_RESET_CLEAR_EC_AP_IDLE_FLAG |
| bool |
| default y if !SYSTEM_TYPE_LAPTOP |
| help |
| Select this if the variant is a Chromebox/base. This allows AP to direct EC |
| to clear AP_IDLE flag before triggering reset to make sure AP can boot up |
| after reset. |