Elyes HAOUAS | 8741510 | 2020-05-07 11:49:08 +0200 | [diff] [blame] | 1 | # SPDX-License-Identifier: GPL-2.0-only |
Martin Roth | 59aa2b1 | 2015-06-20 16:17:12 -0600 | [diff] [blame] | 2 | |
| 3 | config HAVE_INTEL_FIRMWARE |
| 4 | bool |
Stefan Tauner | ef8b957 | 2018-09-06 00:34:28 +0200 | [diff] [blame] | 5 | default y if INTEL_DESCRIPTOR_MODE_CAPABLE |
Martin Roth | 59aa2b1 | 2015-06-20 16:17:12 -0600 | [diff] [blame] | 6 | help |
Stefan Tauner | ef8b957 | 2018-09-06 00:34:28 +0200 | [diff] [blame] | 7 | Platform uses the Intel Firmware Descriptor to describe the |
| 8 | layout of the SPI ROM chip. Enabling this option will allow you to |
| 9 | select further features that rely on this like providing individual |
| 10 | firmware blobs. |
Martin Roth | 59aa2b1 | 2015-06-20 16:17:12 -0600 | [diff] [blame] | 11 | |
| 12 | if HAVE_INTEL_FIRMWARE |
| 13 | |
| 14 | comment "Intel Firmware" |
| 15 | |
| 16 | config HAVE_IFD_BIN |
| 17 | bool "Add Intel descriptor.bin file" |
Simon Glass | 46255f7 | 2018-07-12 15:26:07 -0600 | [diff] [blame] | 18 | select HAVE_EM100_SUPPORT # We use ifdtool to enable this. |
Martin Roth | 59aa2b1 | 2015-06-20 16:17:12 -0600 | [diff] [blame] | 19 | help |
| 20 | The descriptor binary |
| 21 | |
| 22 | config IFD_BIN_PATH |
| 23 | string "Path and filename of the descriptor.bin file" |
Patrick Georgi | b8fba86 | 2020-06-17 21:06:53 +0200 | [diff] [blame] | 24 | default "3rdparty/blobs/mainboard/\$(MAINBOARDDIR)/descriptor.bin" |
Angel Pons | 240eaaa | 2018-08-20 16:32:22 +0200 | [diff] [blame] | 25 | depends on HAVE_IFD_BIN |
Martin Roth | 59aa2b1 | 2015-06-20 16:17:12 -0600 | [diff] [blame] | 26 | |
| 27 | config HAVE_ME_BIN |
Martin Roth | c407cb9 | 2015-06-23 19:59:30 -0600 | [diff] [blame] | 28 | bool "Add Intel ME/TXE firmware" |
Martin Roth | c528c2e | 2015-06-27 08:59:10 -0600 | [diff] [blame] | 29 | depends on HAVE_IFD_BIN |
Martin Roth | 59aa2b1 | 2015-06-20 16:17:12 -0600 | [diff] [blame] | 30 | help |
| 31 | The Intel processor in the selected system requires a special firmware |
Martin Roth | c407cb9 | 2015-06-23 19:59:30 -0600 | [diff] [blame] | 32 | for an integrated controller. This might be called the Management |
| 33 | Engine (ME), the Trusted Execution Engine (TXE) or something else |
| 34 | depending on the chip. This firmware might or might not be available |
| 35 | in coreboot's 3rdparty/blobs repository. If it is not and if you don't |
| 36 | have access to the firmware from elsewhere, you can still build |
| 37 | coreboot without it. In this case however, you'll have to make sure |
| 38 | that you don't overwrite your ME/TXE firmware on your flash ROM. |
Martin Roth | 59aa2b1 | 2015-06-20 16:17:12 -0600 | [diff] [blame] | 39 | |
| 40 | config ME_BIN_PATH |
| 41 | string "Path to management engine firmware" |
Patrick Georgi | b8fba86 | 2020-06-17 21:06:53 +0200 | [diff] [blame] | 42 | default "3rdparty/blobs/mainboard/\$(MAINBOARDDIR)/me.bin" |
Martin Roth | 59aa2b1 | 2015-06-20 16:17:12 -0600 | [diff] [blame] | 43 | depends on HAVE_ME_BIN |
| 44 | |
Nicola Corna | 16719ad | 2017-03-10 11:27:39 +0100 | [diff] [blame] | 45 | config CHECK_ME |
| 46 | bool "Verify the integrity of the supplied ME/TXE firmware" |
Naresh G Solanki | 95d6dd2 | 2017-04-12 20:15:53 +0530 | [diff] [blame] | 47 | default n |
Angel Pons | 95de231 | 2020-02-17 13:08:53 +0100 | [diff] [blame] | 48 | depends on HAVE_ME_BIN && (NORTHBRIDGE_INTEL_IRONLAKE || \ |
Nicola Corna | 16719ad | 2017-03-10 11:27:39 +0100 | [diff] [blame] | 49 | NORTHBRIDGE_INTEL_SANDYBRIDGE || \ |
Nico Huber | 772a154 | 2019-05-10 16:48:14 +0200 | [diff] [blame] | 50 | NORTHBRIDGE_INTEL_HASWELL || \ |
Nicola Corna | 16719ad | 2017-03-10 11:27:39 +0100 | [diff] [blame] | 51 | SOC_INTEL_BROADWELL || SOC_INTEL_SKYLAKE || \ |
Nicola Corna | d58dd5c | 2018-03-31 16:40:03 +0200 | [diff] [blame] | 52 | SOC_INTEL_KABYLAKE || SOC_INTEL_BAYTRAIL || SOC_INTEL_BRASWELL) |
Nicola Corna | 16719ad | 2017-03-10 11:27:39 +0100 | [diff] [blame] | 53 | help |
| 54 | Verify the integrity of the supplied Intel ME/TXE firmware before |
| 55 | proceeding with the build, in order to prevent an accidental loading |
| 56 | of a corrupted ME/TXE image. |
| 57 | |
Sridhar Siricilla | 416b828 | 2020-12-03 17:56:49 +0530 | [diff] [blame] | 58 | config ME_REGION_ALLOW_CPU_READ_ACCESS |
| 59 | bool "Allows HOST/CPU read access to ME region" |
Angel Pons | 862064c | 2021-07-06 13:50:23 +0200 | [diff] [blame] | 60 | depends on HAVE_IFD_BIN |
Sridhar Siricilla | 315ebb2 | 2021-01-22 17:15:00 +0530 | [diff] [blame] | 61 | default y if SOC_INTEL_CSE_LITE_SKU |
Sridhar Siricilla | 416b828 | 2020-12-03 17:56:49 +0530 | [diff] [blame] | 62 | default n |
| 63 | help |
| 64 | The config ensures Host has read access to the ME region if it is locked |
| 65 | through LOCK_MANAGEMENT_ENGINE config. This config is enabled when the CSE |
| 66 | Lite SKU is integrated. |
| 67 | |
Nicola Corna | 92e95ca | 2017-01-23 15:29:03 +0100 | [diff] [blame] | 68 | config USE_ME_CLEANER |
| 69 | bool "Strip down the Intel ME/TXE firmware" |
Angel Pons | 95de231 | 2020-02-17 13:08:53 +0100 | [diff] [blame] | 70 | depends on HAVE_ME_BIN && (NORTHBRIDGE_INTEL_IRONLAKE || \ |
Nicola Corna | 04d2601 | 2018-06-21 14:57:26 +0200 | [diff] [blame] | 71 | NORTHBRIDGE_INTEL_SANDYBRIDGE || \ |
Nico Huber | 772a154 | 2019-05-10 16:48:14 +0200 | [diff] [blame] | 72 | NORTHBRIDGE_INTEL_HASWELL || \ |
Nicola Corna | 92e95ca | 2017-01-23 15:29:03 +0100 | [diff] [blame] | 73 | SOC_INTEL_BROADWELL || SOC_INTEL_SKYLAKE || \ |
Nicola Corna | d58dd5c | 2018-03-31 16:40:03 +0200 | [diff] [blame] | 74 | SOC_INTEL_KABYLAKE || SOC_INTEL_BAYTRAIL || SOC_INTEL_BRASWELL) |
Nicola Corna | 92e95ca | 2017-01-23 15:29:03 +0100 | [diff] [blame] | 75 | help |
| 76 | Use me_cleaner to remove all the non-fundamental code from the Intel |
| 77 | ME/TXE firmware. |
| 78 | The resulting Intel ME/TXE firmware will have only the code |
| 79 | responsible for the very basic hardware initialization, leaving the |
| 80 | ME/TXE subsystem essentially in a disabled state. |
| 81 | |
| 82 | Don't flash a modified ME/TXE firmware and a new coreboot image at the |
| 83 | same time, test them in two different steps. |
| 84 | |
| 85 | WARNING: this tool isn't based on any official Intel documentation but |
| 86 | only on reverse engineering and trial & error. |
| 87 | |
| 88 | See the project's page |
Nicola Corna | 98f3034 | 2017-08-08 21:24:49 +0200 | [diff] [blame] | 89 | https://github.com/corna/me_cleaner |
Nicola Corna | 92e95ca | 2017-01-23 15:29:03 +0100 | [diff] [blame] | 90 | or the wiki |
Nicola Corna | 98f3034 | 2017-08-08 21:24:49 +0200 | [diff] [blame] | 91 | https://github.com/corna/me_cleaner/wiki/How-to-apply-me_cleaner |
| 92 | https://github.com/corna/me_cleaner/wiki/How-does-it-work%3F |
| 93 | https://github.com/corna/me_cleaner/wiki/me_cleaner-status |
Nicola Corna | 92e95ca | 2017-01-23 15:29:03 +0100 | [diff] [blame] | 94 | for more info about this tool |
| 95 | |
| 96 | If unsure, say N. |
| 97 | |
| 98 | comment "Please test the modified ME/TXE firmware and coreboot in two steps" |
| 99 | depends on USE_ME_CLEANER |
| 100 | |
Nicola Corna | 364f2e1 | 2018-03-31 18:24:44 +0200 | [diff] [blame] | 101 | config ME_CLEANER_ARGS |
| 102 | string |
| 103 | depends on USE_ME_CLEANER |
| 104 | default "-S" |
| 105 | |
Jan Tatje | 83a127a | 2019-01-09 20:39:28 +0100 | [diff] [blame] | 106 | config MAINBOARD_USES_IFD_GBE_REGION |
| 107 | def_bool n |
| 108 | |
Martin Roth | c6a177d | 2015-07-09 20:50:51 -0600 | [diff] [blame] | 109 | config HAVE_GBE_BIN |
Nico Huber | e81f334 | 2019-01-26 14:24:41 +0100 | [diff] [blame] | 110 | bool "Add gigabit ethernet configuration" |
Jan Tatje | 83a127a | 2019-01-09 20:39:28 +0100 | [diff] [blame] | 111 | depends on HAVE_IFD_BIN && MAINBOARD_USES_IFD_GBE_REGION |
Martin Roth | c6a177d | 2015-07-09 20:50:51 -0600 | [diff] [blame] | 112 | help |
Nico Huber | e81f334 | 2019-01-26 14:24:41 +0100 | [diff] [blame] | 113 | The integrated gigabit ethernet controller needs a configuration |
| 114 | file. Select this if you are going to use the PCH integrated |
| 115 | controller and want to add that file. |
Martin Roth | c6a177d | 2015-07-09 20:50:51 -0600 | [diff] [blame] | 116 | |
| 117 | config GBE_BIN_PATH |
Nico Huber | e81f334 | 2019-01-26 14:24:41 +0100 | [diff] [blame] | 118 | string "Path to gigabit ethernet configuration" |
Martin Roth | c6a177d | 2015-07-09 20:50:51 -0600 | [diff] [blame] | 119 | depends on HAVE_GBE_BIN |
Patrick Georgi | b8fba86 | 2020-06-17 21:06:53 +0200 | [diff] [blame] | 120 | default "3rdparty/blobs/mainboard/\$(MAINBOARDDIR)/gbe.bin" |
Martin Roth | c6a177d | 2015-07-09 20:50:51 -0600 | [diff] [blame] | 121 | |
Jan Tatje | 82a4e27 | 2019-01-06 17:38:36 +0100 | [diff] [blame] | 122 | config MAINBOARD_USES_IFD_EC_REGION |
| 123 | def_bool n |
| 124 | |
Lijian Zhao | 0fb6568 | 2017-05-16 12:11:45 -0700 | [diff] [blame] | 125 | config HAVE_EC_BIN |
| 126 | bool "Add EC firmware" |
Jan Tatje | 82a4e27 | 2019-01-06 17:38:36 +0100 | [diff] [blame] | 127 | depends on HAVE_IFD_BIN && MAINBOARD_USES_IFD_EC_REGION |
Lijian Zhao | 0fb6568 | 2017-05-16 12:11:45 -0700 | [diff] [blame] | 128 | help |
| 129 | The embedded controller needs a firmware file. |
| 130 | |
| 131 | Select this if you are going to use the PCH integrated controller |
| 132 | and have the EC firmware. EC firmware will be added to final image |
| 133 | through ifdtool. |
| 134 | |
| 135 | config EC_BIN_PATH |
| 136 | string "Path to EC firmware" |
| 137 | depends on HAVE_EC_BIN |
Patrick Georgi | b8fba86 | 2020-06-17 21:06:53 +0200 | [diff] [blame] | 138 | default "3rdparty/blobs/mainboard/\$(MAINBOARDDIR)/ec.bin" |
Lijian Zhao | 0fb6568 | 2017-05-16 12:11:45 -0700 | [diff] [blame] | 139 | |
Mario Scheithauer | 2687443 | 2019-02-27 10:29:01 +0100 | [diff] [blame] | 140 | choice |
Angel Pons | 862064c | 2021-07-06 13:50:23 +0200 | [diff] [blame] | 141 | prompt "Protect flash regions" if HAVE_IFD_BIN |
| 142 | default UNLOCK_FLASH_REGIONS if HAVE_IFD_BIN |
Mario Scheithauer | 2687443 | 2019-02-27 10:29:01 +0100 | [diff] [blame] | 143 | help |
| 144 | This option allows you to protect flash regions. |
| 145 | |
| 146 | config DO_NOT_TOUCH_DESCRIPTOR_REGION |
| 147 | bool "Use the preset values to protect the regions" |
| 148 | help |
| 149 | Read and write access permissions to different regions in the flash |
| 150 | can be controlled via dedicated bitfields in the flash descriptor. |
| 151 | These permissions can be modified with the Intel Flash Descriptor |
| 152 | Tool (ifdtool). If you don't want to change these permissions and |
| 153 | keep the ones provided in the initial descriptor, use this option. |
| 154 | |
Martin Roth | 775d508 | 2015-06-23 21:47:19 -0600 | [diff] [blame] | 155 | config LOCK_MANAGEMENT_ENGINE |
| 156 | bool "Lock ME/TXE section" |
Martin Roth | 775d508 | 2015-06-23 21:47:19 -0600 | [diff] [blame] | 157 | help |
Sridhar Siricilla | 416b828 | 2020-12-03 17:56:49 +0530 | [diff] [blame] | 158 | The Intel Firmware Descriptor supports preventing write and read |
| 159 | accesses from the host to the ME or TXE section. If the section |
| 160 | is locked, it can only be overwritten with an external SPI flash |
| 161 | programmer or HECI HMRFPO_ENABLE command needs to be sent to CSE |
| 162 | before writing to the ME Section. If CSE Lite SKU is integrated, |
| 163 | the Kconfig prevents only writing to the ME section. |
Martin Roth | 775d508 | 2015-06-23 21:47:19 -0600 | [diff] [blame] | 164 | |
Mario Scheithauer | 2687443 | 2019-02-27 10:29:01 +0100 | [diff] [blame] | 165 | If unsure, select "Unlock flash regions". |
| 166 | |
| 167 | config UNLOCK_FLASH_REGIONS |
| 168 | bool "Unlock flash regions" |
| 169 | help |
| 170 | All regions are completely unprotected and can be overwritten using |
| 171 | a flash programming tool. |
| 172 | |
| 173 | endchoice |
Martin Roth | 775d508 | 2015-06-23 21:47:19 -0600 | [diff] [blame] | 174 | |
Martin Roth | 59ff340 | 2016-02-09 09:06:46 -0700 | [diff] [blame] | 175 | config CBFS_SIZE |
| 176 | hex |
| 177 | default 0x100000 |
| 178 | help |
| 179 | Reduce CBFS size to give room to the IFD blobs. |
| 180 | |
Martin Roth | 59aa2b1 | 2015-06-20 16:17:12 -0600 | [diff] [blame] | 181 | endif #INTEL_FIRMWARE |