NAI 68INT6: board devices, ACPI tables, PCIe bring-up, Multiboot2 payloads, faster cold boot and an ATA write fix

.gitignore

@@ -250,6 +250,7 @@ tools/unit-tests/unit-fwtpm-nv-oob
 tools/unit-tests/unit-x86-paging-oob
 tools/unit-tests/unit-ahci-unlock-panic
 tools/unit-tests/unit-ata-security-passphrase-zeroize
+tools/unit-tests/unit-ata-sector-io
 tools/unit-tests/unit-arm-tee-psa-ipc
 tools/unit-tests/unit-flash-write-mcxa
 tools/unit-tests/unit-rw612-flash
@@ -625,6 +626,13 @@ tools/unit-tests/unit-hifive1-flash-write
 tools/unit-tests/unit-hifive1-hfrosccfg
 tools/unit-tests/unit-keygen-keystore
 tools/unit-tests/unit-kontron-tgl-spi
+tools/unit-tests/unit-fsp-nvs
+tools/unit-tests/unit-fsp-nvs-save
+tools/unit-tests/unit-tgl-spi-hwseq
+tools/unit-tests/unit-x86-apic-ids
+tools/unit-tests/unit-x86-acpi
+tools/unit-tests/unit-boot-x86-fsp-measure
+tools/unit-tests/unit-boot-x86-fsp-payload
 tools/unit-tests/unit-nrf5340-flash-protect
 tools/unit-tests/unit-nrf5340-uart-crlf
 tools/unit-tests/unit-nrf54l-uart-write
@@ -670,6 +678,8 @@ tools/unit-tests/keystore_gen
 tools/unit-tests/kinetis_erase_extract.h
 tools/unit-tests/kontron_spi_extract.h
 tools/unit-tests/kontron_spi_fn_extract.h
+tools/unit-tests/tgl_spi_hwseq_extract.h
+tools/unit-tests/x86_apic_ids_extract.h
 tools/unit-tests/nrf5340_protect_fn_extract.h
 tools/unit-tests/nrf54l_uart_write_extract.h
 tools/unit-tests/p1021_erase_extract.h

arch.mk

@@ -2500,6 +2500,9 @@ ifeq ("${FSP}", "1")
       OBJS+=src/x86/tgl_fsp.o
       OBJS+=src/ucode0.o
       CFLAGS += -DUCODE0_ADDRESS=$(UCODE0_BASE)
+      ifeq ($(FSP_NVS_CACHE),1)
+        OBJS+=src/x86/fsp_nvs.o
+      endif
     endif
   else
     # building wolfBoot
@@ -2546,6 +2549,9 @@ ifeq ("${FSP}", "1")
     endif
     ifeq ($(FSP_TGL), 1)
       OBJS+=src/x86/tgl_fsp.o
+      ifeq ($(FSP_NVS_CACHE),1)
+        OBJS+=src/x86/fsp_nvs.o
+      endif
     endif
   endif
   ifeq ($(64BIT),1)

config/examples/nai_68int6.config

@@ -18,7 +18,6 @@ ENCRYPTION=0
 WOLFBOOT_NO_PARTITIONS=1
 # Disk boot: signed kernels in GPT partitions 3/4, Ubuntu root in partition 2.
 # The A/B boot-partition indices are set per target in src/update_disk.c.
-WOLFBOOT_BOOT_DISK=0
 FORCE_32BIT=1
 
 ########## Flash layout (measured from the factory descriptor, 32 MB) ##########
@@ -41,6 +40,12 @@ BIOS_REGION_SIZE=0xc00000
 UCODE0_BASE=0xffd90000
 UCODE0_BIN=src/x86/ucode0.bin
 
+# FSP memory training data cache: 128 KB of the BIOS region just below the
+# wolfBoot window, so it survives a reflash of the window.
+FSP_NVS_CACHE=1
+FSP_NVS_BASE=0xff9e0000
+FSP_NVS_SIZE=0x20000
+
 FSP_T_BIN=./src/x86/fsp_t.bin
 FSP_M_BIN=./src/x86/fsp_m.bin
 FSP_S_BIN=./src/x86/fsp_s.bin
@@ -68,6 +73,15 @@ PCH_HAS_PCR=1
 # Generate ACPI tables so Linux gets the interrupt model and PCI routing.
 ACPI=1
 
+########## PCIe switch and backplane (stock BIOS defaults) ##########
+# Lanes: 8x1, 1x4_4x1, 4x1_1x4, 1x4_1x4 or 1x8. Delays are in seconds.
+NAI_68INT6_PCIE_LANES=8x1
+NAI_68INT6_PCIE_NT=0
+NAI_68INT6_BACKPLANE_CLK=0
+NAI_68INT6_PCIE_LINK_DELAY_S=0
+NAI_68INT6_BOOT_DELAY_S=0
+NAI_68INT6_FPGA_READY_DELAY_S=0
+
 ########## Payload: signed 64-bit Linux bzImage ##########
 64BIT=1
 ELF=1

docs/Targets.md

@@ -9058,7 +9058,7 @@ wolfBoot target `nai_68int6` for the North Atlantic Industries 68INT6, a 3U Open
 | | |
 |---|---|
 | CPU | i7-1185GRE (`06-8C-01`), Tiger Lake UP3, PCH-LP |
-| Memory | 2 x 32 GB DDR4-3200 SODIMM, non-ECC |
+| Memory | DDR4-3200, soldered down, with In-Band ECC (`FSP_IN_BAND_ECC`) |
 | BIOS flash | Rev C/D5: 2 x W25R256JV (32 MB), selected by JP36. Next revision: one 64 MB device |
 | TPM | SLB9670 (SHA-1/256), or SLB9672, which adds a SHA-384 bank |
 | Storage | Onboard SATA SSD, AHCI at `00:17.0` |
@@ -9070,12 +9070,11 @@ wolfBoot target `nai_68int6` for the North Atlantic Industries 68INT6, a 3U Open
 cp config/examples/nai_68int6.config .config
 ./tools/scripts/x86_fsp/tgl/tgl_download_fsp.sh              # FSP UPD headers, first time only
 ./tools/scripts/x86_fsp/tgl/nai_extract_fsp.sh <68INT6.bin>  # board's own FSP blobs
-./tools/scripts/x86_fsp/tgl/assemble_image.sh -k             # generate signing keys
-make
+make                                                         # first build generates the signing key
 ./tools/scripts/x86_fsp/tgl/assemble_image.sh -n <68INT6.bin>
 ```
 
-`nai_extract_fsp.sh` takes FSP-T/M/S and the microcode from a 68INT6 BIOS image. Without it the build uses the public FSP, which compiles but does not train memory. The `-n` stitch replaces the top 6 MB (`BOOTLOADER_PARTITION_SIZE`) of the 12 MB BIOS region and keeps the descriptor and CSME byte for byte. The board has no recovery region (recovery is the second flash device), so use `-n`, not `-m`. The result is `final_image.bin`.
+The host needs `nasm`, `gcc-multilib` and `python-is-python3` besides the usual build tools. `nai_extract_fsp.sh` takes FSP-T/M/S and the microcode from a 68INT6 BIOS image. Without it the build uses the public FSP, which compiles but does not train memory. The `-n` stitch replaces the top 6 MB (`BOOTLOADER_PARTITION_SIZE`) of the 12 MB BIOS region and keeps the descriptor and CSME byte for byte. The board has no recovery region (recovery is the second flash device). The result is `final_image.bin`.
 
 ### Integrity algorithms
 
@@ -9087,7 +9086,7 @@ ECC P-384 and SHA-384 match what Intel Boot Guard uses for the Initial Boot Bloc
 | Image digest | SHA-384 (`HASH=SHA384`) |
 | Measured boot PCR | SHA-256 (the SLB9670 has only SHA-1 and SHA-256 banks) |
 
-`wolfBoot_image_measure()` re-hashes the authenticated digest with the PCR bank's algorithm, so one image serves either TPM. `MEASURED_PCR_ALG=SHA384` needs an SLB9672 with its SHA-384 bank allocated (`TPM2_PCR_Allocate` under platform auth, a provisioning step).
+Stage 1 re-hashes stage 2's authenticated SHA-384 digest with SHA-256 and extends PCR 0 with the result, as stage 2 does for the OS image in PCR 4, so `tools/scripts/x86_fsp/compute_pcr.py` can predict PCR 0. Only the SHA-256 PCR bank is supported.
 
 ### Configuration
 
@@ -9096,10 +9095,14 @@ Notable options in [config/examples/nai_68int6.config](../config/examples/nai_68
 | Option | Meaning |
 |---|---|
 | `X86_UART_NUMBER=2` | LPSS UART2 for all three FSP phases (Kontron uses 0) |
-| `ACPI=1` | Required. Generates ACPI tables (RSDP/XSDT/FADT/MADT/MCFG and a minimal DSDT); the board's PCI interrupt routing is only in the DSDT `_PRT`, since the MP table is the Kontron one |
+| `ACPI=1` | Required. Generates ACPI tables (RSDP/XSDT/FADT/MADT/MCFG/TPM2/HPET/DMAR and a minimal DSDT with the TPM device); the board's PCI interrupt routing is only in the DSDT `_PRT`, since the MP table is the Kontron one. The DSDT also declares the board devices on LPSS I2C0 (EEPROMs, RTC/watchdog) and GSPI0 (the PRC, for NAI's `naigspi` driver) |
+| `FSP_NVS_CACHE=1`, `FSP_NVS_BASE`, `FSP_NVS_SIZE` | Keeps FSP-M's memory training data (its non-volatile storage HOB) in a 128 KB area of the BIOS region below the wolfBoot window, so later boots skip full memory training. Stage 1 passes a valid copy back through `NvsBufferPtr`; stage 2 rewrites it, before FSP-S and before the BIOS region is locked, only when it changes. The record is keyed on a CRC of the FSP-M image and its UPDs, so a change to either falls back to full training. If FspMemInit fails with a saved record, stage 1 sets a CMOS flag and cold-resets, boots train from scratch until FspMemInit succeeds, and stage 2 replaces the record. `assemble_image.sh -n` blanks the area, so an image built from a board's flash dump does not carry that board's training data |
+| `FSP_HYPERTHREADING=1` | Hyper-Threading on (off by default). The MADT and the MP table list the enabled logical processors from the CPUID topology, so either setting works |
+| `NAI_68INT6_PCIE_LANES` | PCIe switch lane configuration, strapped on GPP_B21/B22/S4/S7/S6 before memory init: `8x1` (default), `1x4_4x1`, `4x1_1x4`, `1x4_1x4` or `1x8` |
+| `NAI_68INT6_PCIE_NT`, `NAI_68INT6_BACKPLANE_CLK` | PCIe switch non-transparent mode (GPP_S2) and the backplane PCIe clock (GPP_A0); both off by default |
+| `NAI_68INT6_PCIE_LINK_DELAY_S`, `NAI_68INT6_BOOT_DELAY_S`, `NAI_68INT6_FPGA_READY_DELAY_S` | Waits before CPU PCIe link training (0-5 s), before polling PCIE_RDY (0-255 s), and added to the 5 s PCIE_RDY timeout (0, 5 or 10 s); all 0 by default. Before PCI enumeration wolfBoot polls PCIE_RDY (GPP_C23) every 50 ms, continues with a warning on timeout, then drives GPP_B12 high |
 | `ANTI_ROLLBACK=1` | Persistent version floor and boot audit counters in TPM NV |
 | `MEASURED_BOOT=1`, `MEASURED_PCR_OS=4` | Firmware into PCR 0, the verified OS image into PCR 4 |
-| `WOLFBOOT_BOOT_DISK=0` | Boot from GPT partitions; the A/B indices (sda3/sda4) are set in `src/update_disk.c` |
 
 ### BIOS region lock
 
@@ -9109,15 +9112,34 @@ Before handoff, `hal_flash_protect()` in the shared Tiger Lake HAL (`hal/x86_fsp
 
 `ANTI_ROLLBACK=1` keeps a version floor and boot audit counters in a TPM NV index; the backend is `src/boot_state_tpm.c` and the policy is `src/boot_state.c`. The floor is the highest version ever booted, set trust-on-first-use. A validly signed older image still boots and records a rollback event. Only an untrustworthy reference halts the boot; `ANTI_ROLLBACK_HALT_ON_FAILURE=1` also halts when the TPM is unreachable, a write fails or the platform hierarchy cannot be disabled.
 
-TPM NV is used instead of the partition state trailer because the floor must survive a full reimage of the disk or flash. `DISK_BOOT_CONFIRM` still handles per-slot confirmation, and the backend can move to a root-of-trust device later without changing the policy.
+TPM NV is used instead of the partition state trailer because the floor must survive a full reimage of the disk or flash. Per-slot boot confirmation is `DISK_BOOT_CONFIRM`, which this configuration leaves off, and the backend can move to a root-of-trust device later without changing the policy.
 
 `ALLOW_DOWNGRADE` is left unset, the secure default: if the higher-versioned slot fails to verify, wolfBoot halts (`Rollback to lower version not allowed`) rather than boot the lower one. Building with `ALLOW_DOWNGRADE=1` allows that fall-back and leaves the TPM floor as the only rollback guard.
 
 The booted OS cannot lower the floor. The index is platform-created and writable only under platform auth (`TPMA_NV_PPWRITE`), and on every boot wolfBoot disables the platform hierarchy (`TPM2_HierarchyControl`) until the next TPM reset, as in section 10 of the TCG PC Client Platform specification. The OS can then neither write nor undefine the index. An index with any other write attributes is treated as corrupt. Platform-auth provisioning, such as `TPM2_PCR_Allocate`, must be done before wolfBoot is installed.
 
 ### Boot, programming and recovery
 
-wolfBoot boots the highest-versioned signed 64-bit `bzImage` that verifies from the two GPT boot partitions. It falls back to the other slot only if that is not a downgrade (see Anti-rollback), and halts if neither boots. Program the flash with a Dediprog SF100 on JP4 while the board is off; the BIOS region lock blocks `flashrom` from the booted OS. JP36 selects which bank boots and which one the programmer sees; move it only with the board off.
+wolfBoot boots the highest-versioned signed 64-bit `bzImage` or Multiboot2 ELF that verifies from the two GPT boot partitions. It falls back to the other slot only if that is not a downgrade (see Anti-rollback), and halts if neither boots. Before handoff it sets FULL_RST in the Reset Control register (0xCF9), as the stock BIOS does, so a later reset such as SYS_RESET# from the IPMC is a full reset. A kernel command line signed into the OS image (`sign --cmdline`, the `HDR_CMDLINE` TLV) replaces the built-in one, so changing a kernel argument does not need a reflash. Program the flash with a Dediprog SF100 on JP4 while the board is off; the BIOS region lock blocks `flashrom` from the booted OS. JP36 selects which bank boots and which one the programmer sees; move it only with the board off.
+
+### Multiboot2 ELF payloads
+
+The configuration builds both payload paths (`LINUX_PAYLOAD=1`, `ELF=1`, `MULTIBOOT2=1`), and `do_boot()` picks one per image: an image that starts with the ELF magic takes the Multiboot2 path, and anything else boots as Linux. A Multiboot2 RTOS image is signed and written to an A/B slot the same way as a kernel:
+
+```
+./tools/keytools/sign --ecc384 --sha384 <payload.elf> wolfboot_signing_private_key.der <version>
+```
+
+The two paths differ only in the handoff:
+
+| | Linux `bzImage` | Multiboot2 ELF |
+|---|---|---|
+| Entry | 64-bit Linux boot protocol, `boot_params` and the command line | ELF segments loaded at their physical addresses, virtual addresses mapped in wolfBoot's page tables, jump to `e_entry` in 64-bit mode with EAX=`0x36d76289` and EBX pointing to the Multiboot2 information |
+| Memory map | E820 table in `boot_params` | Multiboot2 memory map and basic memory information tags, from the FSP HOBs |
+| ACPI tables | Generated (`ACPI=1`) | None; they are only built on the Linux path |
+| RTC | The legacy CMOS RTC is ignored under the hardware-reduced ACPI tables; the I2C0 RTC is declared in the DSDT | The CMOS RTC is usable directly; I2C0 is enabled for the board RTC |
+
+Segments are loaded from the verified image only, and a segment that would overlap wolfBoot's own memory (from the stage 2 load address up to 4 GB) is rejected before anything is copied. Everything else is shared: FSP silicon setup (VT-d at the stock BIOS addresses, Hyper-Threading off), the halted PCH TCO watchdog, the BIOS region lock, measured boot, anti-rollback and A/B selection.
 
 ## Infineon PSOC Control C3
 

hal/nai_68int6.c

@@ -40,8 +40,16 @@ void hal_init(void)
     fsp_init_silicon();
 }
 
+/* Reset Control (0xCF9) FULL_RST: written alone it starts no reset, but makes
+ * any later reset a full one, as the stock BIOS does before the OS loader
+ * (its OS Reset Select default, Cold Reset). That covers SYS_RESET# from the
+ * IPMC, which is otherwise a warm reset. */
+#define RST_CNT_PORT 0xcf9
+#define RST_CNT_FULL_RST (1 << 3)
+
 void hal_prepare_boot(void)
 {
+    io_write8(RST_CNT_PORT, RST_CNT_FULL_RST);
 }
 #endif /* __WOLFBOOT */
 

hal/x86_fsp_tgl.c

@@ -21,6 +21,7 @@
 
 #include "wolfboot/wolfboot.h"
 #include <stdint.h>
+#include <string.h>
 
 #ifdef __WOLFBOOT
 
@@ -190,6 +191,156 @@ int hal_flash_protect(haladdr_t address, int len)
      * hook's address/len are the same range FREG1 describes. */
     return tgl_lock_bios_region();
 }
+
+#ifdef WOLFBOOT_FSP_NVS_CACHE
+/* Hardware-sequencing flash cycles, used to save the FSP memory training
+ * data before the BIOS region is locked. Runs from RAM (stage 2) only. */
+#define SPI_BIOS_CNTL (0xdc)
+#define SPI_BIOS_CNTL_WPD (1U << 0)
+#define SPI_FADDR (0x8)
+#define SPI_FDATA0 (0x10)
+#define SPI_HSFSTS_FDONE (1U << 0)
+#define SPI_HSFSTS_FCERR (1U << 1)
+#define SPI_HSFSTS_AEL (1U << 2)
+#define SPI_HSFSTS_SCIP (1U << 5)
+#define SPI_HSFSTS_FGO (1U << 16)
+#define SPI_HSFSTS_FCYCLE_SHIFT (17)
+#define SPI_HSFSTS_FDBC_SHIFT (24)
+#define SPI_FCYCLE_WRITE (2)
+#define SPI_FCYCLE_ERASE_4K (3)
+#define SPI_HWSEQ_MAX_DATA (64)
+#define SPI_ERASE_SIZE (0x1000)
+#define SPI_HWSEQ_TIMEOUT_MS (1000)
+
+static uint32_t tgl_spi_begin(uint32_t *cmd)
+{
+    uint32_t spi_bar, cntl;
+
+    spi_bar = pci_config_read32(0, SPI_PCI_DEV, SPI_PCI_FUN, PCI_BAR0_OFFSET);
+    spi_bar &= PCI_BAR_MASK;
+    *cmd = pci_config_read32(0, SPI_PCI_DEV, SPI_PCI_FUN, PCI_COMMAND_OFFSET);
+    pci_config_write32(0, SPI_PCI_DEV, SPI_PCI_FUN, PCI_COMMAND_OFFSET,
+                       *cmd | PCI_COMMAND_MEM_SPACE);
+    cntl = pci_config_read8(0, SPI_PCI_DEV, SPI_PCI_FUN, SPI_BIOS_CNTL);
+    pci_config_write8(0, SPI_PCI_DEV, SPI_PCI_FUN, SPI_BIOS_CNTL,
+                      cntl | SPI_BIOS_CNTL_WPD);
+    if ((pci_config_read8(0, SPI_PCI_DEV, SPI_PCI_FUN, SPI_BIOS_CNTL) &
+         SPI_BIOS_CNTL_WPD) == 0)
+        return 0;
+    return spi_bar;
+}
+
+static void tgl_spi_end(uint32_t cmd)
+{
+    uint8_t cntl;
+
+    cntl = pci_config_read8(0, SPI_PCI_DEV, SPI_PCI_FUN, SPI_BIOS_CNTL);
+    pci_config_write8(0, SPI_PCI_DEV, SPI_PCI_FUN, SPI_BIOS_CNTL,
+                      cntl & ~SPI_BIOS_CNTL_WPD);
+    pci_config_write32(0, SPI_PCI_DEV, SPI_PCI_FUN, PCI_COMMAND_OFFSET, cmd);
+}
+
+/* The BIOS region is mapped so that its last byte sits at 4 GB - 1;
+ * returns the flash linear address of the memory-mapped address, or -1
+ * when the range is outside the BIOS region. */
+static int64_t tgl_spi_linear(uint32_t spi_bar, uint32_t address,
+                              uint32_t len)
+{
+    uint32_t reg, base, top;
+    uint64_t lin;
+
+    reg = mmio_read32(spi_bar + SPI_FREG1);
+    base = (reg & SPI_FREG_BASE_MASK) << SPI_FREG_ADDR_SHIFT;
+    top = (((reg & SPI_FREG_LIMIT_MASK) >> SPI_FREG_LIMIT_SHIFT)
+           << SPI_FREG_ADDR_SHIFT) | 0xfffU;
+    if (top < base || len == 0)
+        return -1;
+    lin = (uint64_t)top - (0xffffffffULL - address);
+    if (lin < base || lin + len - 1 > top)
+        return -1;
+    return (int64_t)lin;
+}
+
+static int tgl_spi_cycle(uint32_t spi_bar, uint32_t cycle, uint32_t faddr,
+                         uint32_t len)
+{
+    uint32_t sts = 0;
+    int ms;
+
+    for (ms = 0; ms < SPI_HWSEQ_TIMEOUT_MS; ms++) {
+        if ((mmio_read32(spi_bar + SPI_BIOS_HSFSTS_CTL) &
+             SPI_HSFSTS_SCIP) == 0)
+            break;
+        delay(1);
+    }
+    if (ms == SPI_HWSEQ_TIMEOUT_MS)
+        return -1;
+    mmio_write32(spi_bar + SPI_BIOS_HSFSTS_CTL,
+                 SPI_HSFSTS_FDONE | SPI_HSFSTS_FCERR | SPI_HSFSTS_AEL);
+    mmio_write32(spi_bar + SPI_FADDR, faddr);
+    mmio_write32(spi_bar + SPI_BIOS_HSFSTS_CTL,
+                 ((len - 1) << SPI_HSFSTS_FDBC_SHIFT) |
+                 (cycle << SPI_HSFSTS_FCYCLE_SHIFT) | SPI_HSFSTS_FGO);
+    for (ms = 0; ms < SPI_HWSEQ_TIMEOUT_MS; ms++) {
+        sts = mmio_read32(spi_bar + SPI_BIOS_HSFSTS_CTL);
+        if (sts & (SPI_HSFSTS_FDONE | SPI_HSFSTS_FCERR))
+            break;
+        delay(1);
+    }
+    mmio_write32(spi_bar + SPI_BIOS_HSFSTS_CTL,
+                 SPI_HSFSTS_FDONE | SPI_HSFSTS_FCERR | SPI_HSFSTS_AEL);
+    if (ms == SPI_HWSEQ_TIMEOUT_MS || (sts & SPI_HSFSTS_FCERR))
+        return -1;
+    return 0;
+}
+
+int tgl_spi_flash_erase(uint32_t address, uint32_t len)
+{
+    uint32_t spi_bar, cmd, off;
+    int64_t lin;
+    int ret = 0;
+
+    if ((address | len) & (SPI_ERASE_SIZE - 1))
+        return -1;
+    spi_bar = tgl_spi_begin(&cmd);
+    lin = (spi_bar != 0) ? tgl_spi_linear(spi_bar, address, len) : -1;
+    if (lin < 0)
+        ret = -1;
+    for (off = 0; ret == 0 && off < len; off += SPI_ERASE_SIZE)
+        ret = tgl_spi_cycle(spi_bar, SPI_FCYCLE_ERASE_4K,
+                            (uint32_t)lin + off, 1);
+    tgl_spi_end(cmd);
+    return ret;
+}
+
+int tgl_spi_flash_write(uint32_t address, const uint8_t *buf, uint32_t len)
+{
+    uint32_t spi_bar, cmd, off, chunk, word, i;
+    int64_t lin;
+    int ret = 0;
+
+    spi_bar = tgl_spi_begin(&cmd);
+    lin = (spi_bar != 0) ? tgl_spi_linear(spi_bar, address, len) : -1;
+    if (lin < 0)
+        ret = -1;
+    for (off = 0; ret == 0 && off < len; off += chunk) {
+        /* 64-byte aligned cycles never cross a flash page */
+        chunk = SPI_HWSEQ_MAX_DATA - (((uint32_t)lin + off) &
+                                      (SPI_HWSEQ_MAX_DATA - 1));
+        if (chunk > len - off)
+            chunk = len - off;
+        for (i = 0; i < chunk; i += 4) {
+            word = 0xffffffffU;
+            memcpy(&word, buf + off + i, (chunk - i < 4) ? chunk - i : 4);
+            mmio_write32(spi_bar + SPI_FDATA0 + i, word);
+        }
+        ret = tgl_spi_cycle(spi_bar, SPI_FCYCLE_WRITE, (uint32_t)lin + off,
+                            chunk);
+    }
+    tgl_spi_end(cmd);
+    return ret;
+}
+#endif /* WOLFBOOT_FSP_NVS_CACHE */
 #endif /* WOLFBOOT_TGL */
 #endif
 

include/stage2_params.h

@@ -31,6 +31,12 @@ struct stage2_parameter {
     /* Verified payload length, set by the disk loader before do_boot so the
      * Linux loader can bound the signed container header against the image. */
     uint32_t payload_size;
+    /* Address of the signed HDR_CMDLINE of the verified image, NUL-terminated,
+     * or 0 when it carries none */
+    uint32_t cmdline;
+#ifdef WOLFBOOT_FSP_NVS_CACHE
+    uint32_t fsp_nvs_key;
+#endif
 #ifdef WOLFBOOT_TPM_SEAL
     uint32_t tpm_policy;
     uint16_t tpm_policy_size;