x86 fsp: cache the FSP-M memory training data in SPI flash and stop the NAI 68INT6 per-boot global reset

Author: dgarske

.gitignore

@@ -625,6 +625,9 @@ tools/unit-tests/unit-hifive1-flash-write
 tools/unit-tests/unit-hifive1-hfrosccfg
 tools/unit-tests/unit-keygen-keystore
 tools/unit-tests/unit-kontron-tgl-spi
+tools/unit-tests/unit-fsp-nvs
+tools/unit-tests/unit-fsp-nvs-save
+tools/unit-tests/unit-tgl-spi-hwseq
 tools/unit-tests/unit-nrf5340-flash-protect
 tools/unit-tests/unit-nrf5340-uart-crlf
 tools/unit-tests/unit-nrf54l-uart-write
@@ -670,6 +673,7 @@ tools/unit-tests/keystore_gen
 tools/unit-tests/kinetis_erase_extract.h
 tools/unit-tests/kontron_spi_extract.h
 tools/unit-tests/kontron_spi_fn_extract.h
+tools/unit-tests/tgl_spi_hwseq_extract.h
 tools/unit-tests/nrf5340_protect_fn_extract.h
 tools/unit-tests/nrf54l_uart_write_extract.h
 tools/unit-tests/p1021_erase_extract.h

arch.mk

@@ -2500,6 +2500,9 @@ ifeq ("${FSP}", "1")
       OBJS+=src/x86/tgl_fsp.o
       OBJS+=src/ucode0.o
       CFLAGS += -DUCODE0_ADDRESS=$(UCODE0_BASE)
+      ifeq ($(FSP_NVS_CACHE),1)
+        OBJS+=src/x86/fsp_nvs.o
+      endif
     endif
   else
     # building wolfBoot
@@ -2546,6 +2549,9 @@ ifeq ("${FSP}", "1")
     endif
     ifeq ($(FSP_TGL), 1)
       OBJS+=src/x86/tgl_fsp.o
+      ifeq ($(FSP_NVS_CACHE),1)
+        OBJS+=src/x86/fsp_nvs.o
+      endif
     endif
   endif
   ifeq ($(64BIT),1)

config/examples/nai_68int6.config

@@ -41,6 +41,12 @@ BIOS_REGION_SIZE=0xc00000
 UCODE0_BASE=0xffd90000
 UCODE0_BIN=src/x86/ucode0.bin
 
+# FSP memory training data cache: 128 KB of the BIOS region just below the
+# wolfBoot window, so it survives a reflash of the window.
+FSP_NVS_CACHE=1
+FSP_NVS_BASE=0xff9e0000
+FSP_NVS_SIZE=0x20000
+
 FSP_T_BIN=./src/x86/fsp_t.bin
 FSP_M_BIN=./src/x86/fsp_m.bin
 FSP_S_BIN=./src/x86/fsp_s.bin

docs/Targets.md

@@ -9097,6 +9097,7 @@ Notable options in [config/examples/nai_68int6.config](../config/examples/nai_68
 |---|---|
 | `X86_UART_NUMBER=2` | LPSS UART2 for all three FSP phases (Kontron uses 0) |
 | `ACPI=1` | Required. Generates ACPI tables (RSDP/XSDT/FADT/MADT/MCFG and a minimal DSDT); the board's PCI interrupt routing is only in the DSDT `_PRT`, since the MP table is the Kontron one. The DSDT also declares the board devices on LPSS I2C0 (EEPROMs, RTC/watchdog) and GSPI0 (the PRC, for NAI's `naigspi` driver) |
+| `FSP_NVS_CACHE=1`, `FSP_NVS_BASE`, `FSP_NVS_SIZE` | Keeps FSP-M's memory training data (its non-volatile storage HOB) in a 128 KB area of the BIOS region below the wolfBoot window, so later boots skip full memory training. Stage 1 passes a valid copy back through `NvsBufferPtr`; stage 2 rewrites it, before FSP-S and before the BIOS region is locked, only when it changes. The record is keyed on a CRC of the FSP-M image and its UPDs, so a change to either falls back to full training |
 | `ANTI_ROLLBACK=1` | Persistent version floor and boot audit counters in TPM NV |
 | `MEASURED_BOOT=1`, `MEASURED_PCR_OS=4` | Firmware into PCR 0, the verified OS image into PCR 4 |
 | `WOLFBOOT_BOOT_DISK=0` | Boot from GPT partitions; the A/B indices (sda3/sda4) are set in `src/update_disk.c` |

hal/x86_fsp_tgl.c

@@ -21,6 +21,7 @@
 
 #include "wolfboot/wolfboot.h"
 #include <stdint.h>
+#include <string.h>
 
 #ifdef __WOLFBOOT
 
@@ -190,6 +191,156 @@ int hal_flash_protect(haladdr_t address, int len)
      * hook's address/len are the same range FREG1 describes. */
     return tgl_lock_bios_region();
 }
+
+#ifdef WOLFBOOT_FSP_NVS_CACHE
+/* Hardware-sequencing flash cycles, used to save the FSP memory training
+ * data before the BIOS region is locked. Runs from RAM (stage 2) only. */
+#define SPI_BIOS_CNTL (0xdc)
+#define SPI_BIOS_CNTL_WPD (1U << 0)
+#define SPI_FADDR (0x8)
+#define SPI_FDATA0 (0x10)
+#define SPI_HSFSTS_FDONE (1U << 0)
+#define SPI_HSFSTS_FCERR (1U << 1)
+#define SPI_HSFSTS_AEL (1U << 2)
+#define SPI_HSFSTS_SCIP (1U << 5)
+#define SPI_HSFSTS_FGO (1U << 16)
+#define SPI_HSFSTS_FCYCLE_SHIFT (17)
+#define SPI_HSFSTS_FDBC_SHIFT (24)
+#define SPI_FCYCLE_WRITE (2)
+#define SPI_FCYCLE_ERASE_4K (3)
+#define SPI_HWSEQ_MAX_DATA (64)
+#define SPI_ERASE_SIZE (0x1000)
+#define SPI_HWSEQ_TIMEOUT_MS (1000)
+
+static uint32_t tgl_spi_begin(uint32_t *cmd)
+{
+    uint32_t spi_bar, cntl;
+
+    spi_bar = pci_config_read32(0, SPI_PCI_DEV, SPI_PCI_FUN, PCI_BAR0_OFFSET);
+    spi_bar &= PCI_BAR_MASK;
+    *cmd = pci_config_read32(0, SPI_PCI_DEV, SPI_PCI_FUN, PCI_COMMAND_OFFSET);
+    pci_config_write32(0, SPI_PCI_DEV, SPI_PCI_FUN, PCI_COMMAND_OFFSET,
+                       *cmd | PCI_COMMAND_MEM_SPACE);
+    cntl = pci_config_read8(0, SPI_PCI_DEV, SPI_PCI_FUN, SPI_BIOS_CNTL);
+    pci_config_write8(0, SPI_PCI_DEV, SPI_PCI_FUN, SPI_BIOS_CNTL,
+                      cntl | SPI_BIOS_CNTL_WPD);
+    if ((pci_config_read8(0, SPI_PCI_DEV, SPI_PCI_FUN, SPI_BIOS_CNTL) &
+         SPI_BIOS_CNTL_WPD) == 0)
+        return 0;
+    return spi_bar;
+}
+
+static void tgl_spi_end(uint32_t cmd)
+{
+    uint8_t cntl;
+
+    cntl = pci_config_read8(0, SPI_PCI_DEV, SPI_PCI_FUN, SPI_BIOS_CNTL);
+    pci_config_write8(0, SPI_PCI_DEV, SPI_PCI_FUN, SPI_BIOS_CNTL,
+                      cntl & ~SPI_BIOS_CNTL_WPD);
+    pci_config_write32(0, SPI_PCI_DEV, SPI_PCI_FUN, PCI_COMMAND_OFFSET, cmd);
+}
+
+/* The BIOS region is mapped so that its last byte sits at 4 GB - 1;
+ * returns the flash linear address of the memory-mapped address, or -1
+ * when the range is outside the BIOS region. */
+static int64_t tgl_spi_linear(uint32_t spi_bar, uint32_t address,
+                              uint32_t len)
+{
+    uint32_t reg, base, top;
+    uint64_t lin;
+
+    reg = mmio_read32(spi_bar + SPI_FREG1);
+    base = (reg & SPI_FREG_BASE_MASK) << SPI_FREG_ADDR_SHIFT;
+    top = (((reg & SPI_FREG_LIMIT_MASK) >> SPI_FREG_LIMIT_SHIFT)
+           << SPI_FREG_ADDR_SHIFT) | 0xfffU;
+    if (top < base || len == 0)
+        return -1;
+    lin = (uint64_t)top - (0xffffffffULL - address);
+    if (lin < base || lin + len - 1 > top)
+        return -1;
+    return (int64_t)lin;
+}
+
+static int tgl_spi_cycle(uint32_t spi_bar, uint32_t cycle, uint32_t faddr,
+                         uint32_t len)
+{
+    uint32_t sts = 0;
+    int ms;
+
+    for (ms = 0; ms < SPI_HWSEQ_TIMEOUT_MS; ms++) {
+        if ((mmio_read32(spi_bar + SPI_BIOS_HSFSTS_CTL) &
+             SPI_HSFSTS_SCIP) == 0)
+            break;
+        delay(1);
+    }
+    if (ms == SPI_HWSEQ_TIMEOUT_MS)
+        return -1;
+    mmio_write32(spi_bar + SPI_BIOS_HSFSTS_CTL,
+                 SPI_HSFSTS_FDONE | SPI_HSFSTS_FCERR | SPI_HSFSTS_AEL);
+    mmio_write32(spi_bar + SPI_FADDR, faddr);
+    mmio_write32(spi_bar + SPI_BIOS_HSFSTS_CTL,
+                 ((len - 1) << SPI_HSFSTS_FDBC_SHIFT) |
+                 (cycle << SPI_HSFSTS_FCYCLE_SHIFT) | SPI_HSFSTS_FGO);
+    for (ms = 0; ms < SPI_HWSEQ_TIMEOUT_MS; ms++) {
+        sts = mmio_read32(spi_bar + SPI_BIOS_HSFSTS_CTL);
+        if (sts & (SPI_HSFSTS_FDONE | SPI_HSFSTS_FCERR))
+            break;
+        delay(1);
+    }
+    mmio_write32(spi_bar + SPI_BIOS_HSFSTS_CTL,
+                 SPI_HSFSTS_FDONE | SPI_HSFSTS_FCERR | SPI_HSFSTS_AEL);
+    if (ms == SPI_HWSEQ_TIMEOUT_MS || (sts & SPI_HSFSTS_FCERR))
+        return -1;
+    return 0;
+}
+
+int tgl_spi_flash_erase(uint32_t address, uint32_t len)
+{
+    uint32_t spi_bar, cmd, off;
+    int64_t lin;
+    int ret = 0;
+
+    if ((address | len) & (SPI_ERASE_SIZE - 1))
+        return -1;
+    spi_bar = tgl_spi_begin(&cmd);
+    lin = (spi_bar != 0) ? tgl_spi_linear(spi_bar, address, len) : -1;
+    if (lin < 0)
+        ret = -1;
+    for (off = 0; ret == 0 && off < len; off += SPI_ERASE_SIZE)
+        ret = tgl_spi_cycle(spi_bar, SPI_FCYCLE_ERASE_4K,
+                            (uint32_t)lin + off, 1);
+    tgl_spi_end(cmd);
+    return ret;
+}
+
+int tgl_spi_flash_write(uint32_t address, const uint8_t *buf, uint32_t len)
+{
+    uint32_t spi_bar, cmd, off, chunk, word, i;
+    int64_t lin;
+    int ret = 0;
+
+    spi_bar = tgl_spi_begin(&cmd);
+    lin = (spi_bar != 0) ? tgl_spi_linear(spi_bar, address, len) : -1;
+    if (lin < 0)
+        ret = -1;
+    for (off = 0; ret == 0 && off < len; off += chunk) {
+        /* 64-byte aligned cycles never cross a flash page */
+        chunk = SPI_HWSEQ_MAX_DATA - (((uint32_t)lin + off) &
+                                      (SPI_HWSEQ_MAX_DATA - 1));
+        if (chunk > len - off)
+            chunk = len - off;
+        for (i = 0; i < chunk; i += 4) {
+            word = 0xffffffffU;
+            memcpy(&word, buf + off + i, (chunk - i < 4) ? chunk - i : 4);
+            mmio_write32(spi_bar + SPI_FDATA0 + i, word);
+        }
+        ret = tgl_spi_cycle(spi_bar, SPI_FCYCLE_WRITE, (uint32_t)lin + off,
+                            chunk);
+    }
+    tgl_spi_end(cmd);
+    return ret;
+}
+#endif /* WOLFBOOT_FSP_NVS_CACHE */
 #endif /* WOLFBOOT_TGL */
 #endif
 

include/stage2_params.h

@@ -31,6 +31,9 @@ struct stage2_parameter {
     /* Verified payload length, set by the disk loader before do_boot so the
      * Linux loader can bound the signed container header against the image. */
     uint32_t payload_size;
+#ifdef WOLFBOOT_FSP_NVS_CACHE
+    uint32_t fsp_nvs_key;
+#endif
 #ifdef WOLFBOOT_TPM_SEAL
     uint32_t tpm_policy;
     uint16_t tpm_policy_size;

include/x86/fsp_nvs.h

@@ -0,0 +1,47 @@
+/* fsp_nvs.h
+ *
+ * Copyright (C) 2026 wolfSSL Inc.
+ *
+ * This file is part of wolfBoot.
+ *
+ * wolfBoot is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * wolfBoot is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
+ */
+#ifndef FSP_NVS_H
+#define FSP_NVS_H
+
+#include <stdint.h>
+
+/* Flash record holding the FSP-M non-volatile storage (memory training)
+ * data. The key covers the FSP-M image and its UPDs, so a change to either
+ * invalidates the record. */
+#define FSP_NVS_MAGIC 0x5356464BU /* "KFVS" */
+
+struct fsp_nvs_record {
+    uint32_t magic;
+    uint32_t key;
+    uint32_t len;
+    uint32_t crc;
+    uint32_t reserved[4];
+    uint8_t data[];
+} __attribute__((packed));
+
+uint32_t fsp_nvs_crc32(uint32_t crc, const uint8_t *buf, uint32_t len);
+int fsp_nvs_record_valid(const struct fsp_nvs_record *rec, uint32_t key,
+                         uint32_t area_size);
+void fsp_nvs_apply(uint8_t *udp_m, uint32_t udp_size, const uint8_t *fsp_m,
+                   uint32_t fsp_m_size);
+void fsp_nvs_save(void);
+
+#endif /* FSP_NVS_H */

include/x86/tgl_fsp.h

@@ -25,5 +25,7 @@
 
 int x86_fsp_tgl_init_sata(uint32_t *bar);
 int tgl_lock_bios_region(void);
+int tgl_spi_flash_erase(uint32_t address, uint32_t len);
+int tgl_spi_flash_write(uint32_t address, const uint8_t *buf, uint32_t len);
 
 #endif /* TGL_FSP_H */

options.mk

@@ -1937,6 +1937,17 @@ ifeq ($(FSP), 1)
 
     # set CFLAGS defines for each x86_fsp option
     $(foreach option,$(X86_FSP_OPTIONS),$(if $($(option)), $(eval CFLAGS += -D$(option)=$($(option)))))
+
+  ifeq ($(FSP_NVS_CACHE),1)
+    ifeq ($(and $(FSP_NVS_BASE),$(FSP_NVS_SIZE)),)
+      $(error FSP_NVS_CACHE=1 needs FSP_NVS_BASE and FSP_NVS_SIZE)
+    endif
+    ifeq ($(filter $(TARGET),kontron_vx3060_s2 nai_68int6),)
+      $(error FSP_NVS_CACHE=1 is only supported on the Tiger Lake targets)
+    endif
+    CFLAGS+=-DWOLFBOOT_FSP_NVS_CACHE
+    CFLAGS+=-DFSP_NVS_BASE=$(FSP_NVS_BASE) -DFSP_NVS_SIZE=$(FSP_NVS_SIZE)
+  endif
 endif
 
 ifeq ($(FLASH_MULTI_SECTOR_ERASE),1)

src/boot_x86_fsp.c

@@ -42,6 +42,9 @@
 #include <loader.h>
 #include <tpm.h>
 #endif
+#ifdef WOLFBOOT_FSP_NVS_CACHE
+#include <x86/fsp_nvs.h>
+#endif
 
 
 #define WOLFBOOT_X86_STACK_SIZE 0x10000
@@ -586,6 +589,10 @@ void start(uint32_t stack_base, uint32_t stack_top, uint64_t timestamp,
     if (status != 0) {
         panic();
     }
+#if defined(WOLFBOOT_FSP_NVS_CACHE) && defined(BUILD_LOADER_STAGE1)
+    fsp_nvs_apply(udp_m_parameter, fsp_m_info_header->CfgRegionSize,
+                  fsp_m_base, fsp_m_info_header->ImageSize);
+#endif
 
 #if defined(WOLFBOOT_DUMP_FSP_UPD)
     wolfBoot_printf("Dumping fspm udp (%d bytes)" ENDLINE, (int)fsp_m_info_header->CfgRegionSize);