Martin Roth | 59aa2b1 | 2015-06-20 16:17:12 -0600 | [diff] [blame] | 1 | ## |
| 2 | ## This file is part of the coreboot project. |
| 3 | ## |
| 4 | ## Copyright (C) 2011 Google Inc. |
| 5 | ## Copyright (C) 2013-2014 Sage Electronic Engineering, LLC. |
| 6 | ## |
| 7 | ## This program is free software; you can redistribute it and/or modify |
| 8 | ## it under the terms of the GNU General Public License as published by |
| 9 | ## the Free Software Foundation; version 2 of the License. |
| 10 | ## |
| 11 | ## This program is distributed in the hope that it will be useful, |
| 12 | ## but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 13 | ## MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| 14 | ## GNU General Public License for more details. |
| 15 | ## |
Martin Roth | 59aa2b1 | 2015-06-20 16:17:12 -0600 | [diff] [blame] | 16 | |
| 17 | config HAVE_INTEL_FIRMWARE |
| 18 | bool |
| 19 | help |
| 20 | Chipset uses the Intel Firmware Descriptor to describe the |
| 21 | layout of the SPI ROM chip. |
| 22 | |
| 23 | if HAVE_INTEL_FIRMWARE |
| 24 | |
| 25 | comment "Intel Firmware" |
| 26 | |
| 27 | config HAVE_IFD_BIN |
| 28 | bool "Add Intel descriptor.bin file" |
| 29 | help |
| 30 | The descriptor binary |
| 31 | |
| 32 | config IFD_BIN_PATH |
| 33 | string "Path and filename of the descriptor.bin file" |
Stefan Reinauer | cecabc1 | 2015-07-01 17:37:57 -0700 | [diff] [blame] | 34 | default "3rdparty/blobs/mainboard/$(MAINBOARDDIR)/descriptor.bin" |
Martin Roth | 59aa2b1 | 2015-06-20 16:17:12 -0600 | [diff] [blame] | 35 | depends on HAVE_IFD_BIN && !BUILD_WITH_FAKE_IFD |
| 36 | |
Martin Roth | b9de78b | 2015-12-03 14:27:45 -0700 | [diff] [blame] | 37 | config EM100 |
| 38 | bool "Configure IFD for EM100 usage" |
| 39 | depends on HAVE_IFD_BIN && !BUILD_WITH_FAKE_IFD |
| 40 | help |
| 41 | Set SPI frequency to 20MHz and disable Dual Output Fast Read Support |
| 42 | |
Martin Roth | 59aa2b1 | 2015-06-20 16:17:12 -0600 | [diff] [blame] | 43 | config HAVE_ME_BIN |
Martin Roth | c407cb9 | 2015-06-23 19:59:30 -0600 | [diff] [blame] | 44 | bool "Add Intel ME/TXE firmware" |
Martin Roth | c528c2e | 2015-06-27 08:59:10 -0600 | [diff] [blame] | 45 | depends on HAVE_IFD_BIN |
Martin Roth | 59aa2b1 | 2015-06-20 16:17:12 -0600 | [diff] [blame] | 46 | help |
| 47 | The Intel processor in the selected system requires a special firmware |
Martin Roth | c407cb9 | 2015-06-23 19:59:30 -0600 | [diff] [blame] | 48 | for an integrated controller. This might be called the Management |
| 49 | Engine (ME), the Trusted Execution Engine (TXE) or something else |
| 50 | depending on the chip. This firmware might or might not be available |
| 51 | in coreboot's 3rdparty/blobs repository. If it is not and if you don't |
| 52 | have access to the firmware from elsewhere, you can still build |
| 53 | coreboot without it. In this case however, you'll have to make sure |
| 54 | that you don't overwrite your ME/TXE firmware on your flash ROM. |
Martin Roth | 59aa2b1 | 2015-06-20 16:17:12 -0600 | [diff] [blame] | 55 | |
| 56 | config ME_BIN_PATH |
| 57 | string "Path to management engine firmware" |
Stefan Reinauer | cecabc1 | 2015-07-01 17:37:57 -0700 | [diff] [blame] | 58 | default "3rdparty/blobs/mainboard/$(MAINBOARDDIR)/me.bin" |
Martin Roth | 59aa2b1 | 2015-06-20 16:17:12 -0600 | [diff] [blame] | 59 | depends on HAVE_ME_BIN |
| 60 | |
Nicola Corna | 16719ad | 2017-03-10 11:27:39 +0100 | [diff] [blame] | 61 | config CHECK_ME |
| 62 | bool "Verify the integrity of the supplied ME/TXE firmware" |
Naresh G Solanki | 95d6dd2 | 2017-04-12 20:15:53 +0530 | [diff] [blame] | 63 | default n |
Nicola Corna | 16719ad | 2017-03-10 11:27:39 +0100 | [diff] [blame] | 64 | depends on HAVE_ME_BIN && (NORTHBRIDGE_INTEL_NEHALEM || \ |
| 65 | NORTHBRIDGE_INTEL_SANDYBRIDGE || \ |
| 66 | NORTHBRIDGE_INTEL_IVYBRIDGE || NORTHBRIDGE_INTEL_HASWELL || \ |
| 67 | SOC_INTEL_BROADWELL || SOC_INTEL_SKYLAKE || \ |
Nicola Corna | d58dd5c | 2018-03-31 16:40:03 +0200 | [diff] [blame] | 68 | SOC_INTEL_KABYLAKE || SOC_INTEL_BAYTRAIL || SOC_INTEL_BRASWELL) |
Nicola Corna | 16719ad | 2017-03-10 11:27:39 +0100 | [diff] [blame] | 69 | help |
| 70 | Verify the integrity of the supplied Intel ME/TXE firmware before |
| 71 | proceeding with the build, in order to prevent an accidental loading |
| 72 | of a corrupted ME/TXE image. |
| 73 | |
Nicola Corna | 92e95ca | 2017-01-23 15:29:03 +0100 | [diff] [blame] | 74 | config USE_ME_CLEANER |
| 75 | bool "Strip down the Intel ME/TXE firmware" |
| 76 | depends on HAVE_ME_BIN && (NORTHBRIDGE_INTEL_SANDYBRIDGE || \ |
| 77 | NORTHBRIDGE_INTEL_IVYBRIDGE || NORTHBRIDGE_INTEL_HASWELL || \ |
| 78 | SOC_INTEL_BROADWELL || SOC_INTEL_SKYLAKE || \ |
Nicola Corna | d58dd5c | 2018-03-31 16:40:03 +0200 | [diff] [blame] | 79 | SOC_INTEL_KABYLAKE || SOC_INTEL_BAYTRAIL || SOC_INTEL_BRASWELL) |
Nicola Corna | 92e95ca | 2017-01-23 15:29:03 +0100 | [diff] [blame] | 80 | help |
| 81 | Use me_cleaner to remove all the non-fundamental code from the Intel |
| 82 | ME/TXE firmware. |
| 83 | The resulting Intel ME/TXE firmware will have only the code |
| 84 | responsible for the very basic hardware initialization, leaving the |
| 85 | ME/TXE subsystem essentially in a disabled state. |
| 86 | |
| 87 | Don't flash a modified ME/TXE firmware and a new coreboot image at the |
| 88 | same time, test them in two different steps. |
| 89 | |
| 90 | WARNING: this tool isn't based on any official Intel documentation but |
| 91 | only on reverse engineering and trial & error. |
| 92 | |
| 93 | See the project's page |
Nicola Corna | 98f3034 | 2017-08-08 21:24:49 +0200 | [diff] [blame] | 94 | https://github.com/corna/me_cleaner |
Nicola Corna | 92e95ca | 2017-01-23 15:29:03 +0100 | [diff] [blame] | 95 | or the wiki |
Nicola Corna | 98f3034 | 2017-08-08 21:24:49 +0200 | [diff] [blame] | 96 | https://github.com/corna/me_cleaner/wiki/How-to-apply-me_cleaner |
| 97 | https://github.com/corna/me_cleaner/wiki/How-does-it-work%3F |
| 98 | https://github.com/corna/me_cleaner/wiki/me_cleaner-status |
Nicola Corna | 92e95ca | 2017-01-23 15:29:03 +0100 | [diff] [blame] | 99 | for more info about this tool |
| 100 | |
| 101 | If unsure, say N. |
| 102 | |
| 103 | comment "Please test the modified ME/TXE firmware and coreboot in two steps" |
| 104 | depends on USE_ME_CLEANER |
| 105 | |
Nicola Corna | 364f2e1 | 2018-03-31 18:24:44 +0200 | [diff] [blame^] | 106 | config ME_CLEANER_ARGS |
| 107 | string |
| 108 | depends on USE_ME_CLEANER |
| 109 | default "-S" |
| 110 | |
Martin Roth | c6a177d | 2015-07-09 20:50:51 -0600 | [diff] [blame] | 111 | config HAVE_GBE_BIN |
| 112 | bool "Add gigabit ethernet firmware" |
| 113 | depends on HAVE_IFD_BIN |
| 114 | help |
| 115 | The integrated gigabit ethernet controller needs a firmware file. |
| 116 | Select this if you are going to use the PCH integrated controller |
| 117 | and have the firmware. |
| 118 | |
| 119 | config GBE_BIN_PATH |
| 120 | string "Path to gigabit ethernet firmware" |
| 121 | depends on HAVE_GBE_BIN |
| 122 | default "3rdparty/blobs/mainboard/$(MAINBOARDDIR)/gbe.bin" |
| 123 | |
Lijian Zhao | 0fb6568 | 2017-05-16 12:11:45 -0700 | [diff] [blame] | 124 | config HAVE_EC_BIN |
| 125 | bool "Add EC firmware" |
| 126 | depends on HAVE_IFD_BIN |
| 127 | help |
| 128 | The embedded controller needs a firmware file. |
| 129 | |
| 130 | Select this if you are going to use the PCH integrated controller |
| 131 | and have the EC firmware. EC firmware will be added to final image |
| 132 | through ifdtool. |
| 133 | |
| 134 | config EC_BIN_PATH |
| 135 | string "Path to EC firmware" |
| 136 | depends on HAVE_EC_BIN |
| 137 | default "3rdparty/blobs/mainboard/$(MAINBOARDDIR)/ec.bin" |
| 138 | |
Martin Roth | 59aa2b1 | 2015-06-20 16:17:12 -0600 | [diff] [blame] | 139 | ##### Fake IFD ##### |
| 140 | |
| 141 | config BUILD_WITH_FAKE_IFD |
| 142 | bool "Build with a fake IFD" if !HAVE_IFD_BIN |
| 143 | help |
| 144 | If you don't have an Intel Firmware Descriptor (descriptor.bin) for your |
| 145 | board, you can select this option and coreboot will build without it. |
| 146 | The resulting coreboot.rom will not contain all parts required |
| 147 | to get coreboot running on your board. You can however write only the |
| 148 | BIOS section to your board's flash ROM and keep the other sections |
| 149 | untouched. Unfortunately the current version of flashrom doesn't |
| 150 | support this yet. But there is a patch pending [1]. |
| 151 | |
| 152 | WARNING: Never write a complete coreboot.rom to your flash ROM if it |
| 153 | was built with a fake IFD. It just won't work. |
| 154 | |
| 155 | [1] http://www.flashrom.org/pipermail/flashrom/2013-June/011083.html |
| 156 | |
| 157 | config IFD_BIOS_SECTION |
| 158 | depends on BUILD_WITH_FAKE_IFD |
Martin Roth | 57eff2a | 2015-06-23 21:49:56 -0600 | [diff] [blame] | 159 | string "BIOS Region Starting:Ending addresses within the ROM" |
Martin Roth | 59aa2b1 | 2015-06-20 16:17:12 -0600 | [diff] [blame] | 160 | default "" |
Martin Roth | 57eff2a | 2015-06-23 21:49:56 -0600 | [diff] [blame] | 161 | help |
| 162 | The BIOS region is typically the size of the CBFS area, and is located |
| 163 | at the end of the ROM space. |
| 164 | |
| 165 | For an 8MB ROM with a 3MB CBFS area, this would look like: |
| 166 | 0x00500000:0x007fffff |
Martin Roth | 59aa2b1 | 2015-06-20 16:17:12 -0600 | [diff] [blame] | 167 | |
| 168 | config IFD_ME_SECTION |
| 169 | depends on BUILD_WITH_FAKE_IFD |
Martin Roth | 57eff2a | 2015-06-23 21:49:56 -0600 | [diff] [blame] | 170 | string "ME/TXE Region Starting:Ending addresses within the ROM" |
Martin Roth | 59aa2b1 | 2015-06-20 16:17:12 -0600 | [diff] [blame] | 171 | default "" |
Martin Roth | 57eff2a | 2015-06-23 21:49:56 -0600 | [diff] [blame] | 172 | help |
| 173 | The ME/TXE region typically starts at around 0x1000 and often fills the |
| 174 | ROM space not used by CBFS. |
| 175 | |
| 176 | For an 8MB ROM with a 3MB CBFS area, this might look like: |
| 177 | 0x00001000:0x004fffff |
Martin Roth | 59aa2b1 | 2015-06-20 16:17:12 -0600 | [diff] [blame] | 178 | |
| 179 | config IFD_GBE_SECTION |
| 180 | depends on BUILD_WITH_FAKE_IFD |
Martin Roth | 57eff2a | 2015-06-23 21:49:56 -0600 | [diff] [blame] | 181 | string "GBE Region Starting:Ending addresses within the ROM" |
Martin Roth | 59aa2b1 | 2015-06-20 16:17:12 -0600 | [diff] [blame] | 182 | default "" |
Martin Roth | 57eff2a | 2015-06-23 21:49:56 -0600 | [diff] [blame] | 183 | help |
| 184 | The Gigabit Ethernet ROM region is used when an Intel NIC is built into |
| 185 | the Southbridge/SOC and the platform uses this device instead of an external |
| 186 | PCIe NIC. It will be located between the ME/TXE and the BIOS region. |
| 187 | |
| 188 | Leave this empty if you're unsure. |
Martin Roth | 59aa2b1 | 2015-06-20 16:17:12 -0600 | [diff] [blame] | 189 | |
| 190 | config IFD_PLATFORM_SECTION |
| 191 | depends on BUILD_WITH_FAKE_IFD |
Martin Roth | 57eff2a | 2015-06-23 21:49:56 -0600 | [diff] [blame] | 192 | string "Platform Region Starting:Ending addresses within the Rom" |
Martin Roth | 59aa2b1 | 2015-06-20 16:17:12 -0600 | [diff] [blame] | 193 | default "" |
Martin Roth | 57eff2a | 2015-06-23 21:49:56 -0600 | [diff] [blame] | 194 | help |
| 195 | The Platform region is used for platform specific data. |
| 196 | It will be located between the ME/TXE and the BIOS region. |
| 197 | |
| 198 | Leave this empty if you're unsure. |
Martin Roth | 59aa2b1 | 2015-06-20 16:17:12 -0600 | [diff] [blame] | 199 | |
Martin Roth | 775d508 | 2015-06-23 21:47:19 -0600 | [diff] [blame] | 200 | config LOCK_MANAGEMENT_ENGINE |
| 201 | bool "Lock ME/TXE section" |
Martin Roth | 775d508 | 2015-06-23 21:47:19 -0600 | [diff] [blame] | 202 | default n |
| 203 | help |
| 204 | The Intel Firmware Descriptor supports preventing write accesses |
| 205 | from the host to the ME or TXE section in the firmware |
| 206 | descriptor. If the section is locked, it can only be overwritten |
| 207 | with an external SPI flash programmer. You will want this if you |
| 208 | want to increase security of your ROM image once you are sure |
| 209 | that the ME/TXE firmware is no longer going to change. |
| 210 | |
| 211 | If unsure, say N. |
| 212 | |
Martin Roth | 59ff340 | 2016-02-09 09:06:46 -0700 | [diff] [blame] | 213 | config CBFS_SIZE |
| 214 | hex |
| 215 | default 0x100000 |
| 216 | help |
| 217 | Reduce CBFS size to give room to the IFD blobs. |
| 218 | |
Martin Roth | 59aa2b1 | 2015-06-20 16:17:12 -0600 | [diff] [blame] | 219 | endif #INTEL_FIRMWARE |