soc/intel/common/block: Add common finalize implementation

This introduces a common finalize implementation for Intel SoCs that
consolidates the nearly identical finalize.c files across Meteor Lake
and Panther Lake platforms.

The implementation includes:
- pch_finalize(): TCO lockdown and PMC status clearing
- tbt_finalize(): Disable Thunderbolt PCIe root ports bus master
- sa_finalize(): Lock system agent PAM regions when coreboot handles
  chipset lockdown
- heci_finalize(): Set HECI to D0i3 and optionally disable HECI1
- soc_finalize(): Main finalization sequence coordinating all the above

This consolidation eliminates duplicate code and ensures consistent
finalization behavior across platforms. Alder Lake is intentionally
excluded as it has additional platform-specific camera clock (ISCLK)
configuration that would complicate the common implementation.

The common driver is enabled via the SOC_INTEL_COMMON_FEATURE_FINALIZE
Kconfig option.

Platforms that will use this common implementation:
- Meteor Lake
- Panther Lake

Change-Id: I4dd9ccf7e14fecdded92da6bf366e6ff56d866a4
Signed-off-by: Jeremy Compostella <jeremy.compostella@intel.com>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/91227
Reviewed-by: Huang, Cliff <cliff.huang@intel.com>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>

src/soc/intel/common/feature/finalize/Kconfig

@@ -0,0 +1,8 @@
+## SPDX-License-Identifier: GPL-2.0-only
+
+config SOC_INTEL_COMMON_FEATURE_FINALIZE
+	bool
+	help
+	  Include common finalize implementation for Intel SoCs. This driver
+	  consolidates the nearly identical finalize implementations across
+	  Meteor Lake and Panther Lake platforms.

src/soc/intel/common/feature/finalize/Makefile.mk

@@ -0,0 +1,3 @@
+## SPDX-License-Identifier: GPL-2.0-only
+
+ramstage-$(CONFIG_SOC_INTEL_COMMON_FEATURE_FINALIZE) += finalize.c

src/soc/intel/common/feature/finalize/finalize.c

@@ -0,0 +1,79 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+
+#include <bootstate.h>
+#include <console/console.h>
+#include <cpu/x86/smm.h>
+#include <device/pci.h>
+#include <intelblocks/cfg.h>
+#include <intelblocks/cse.h>
+#include <intelblocks/pmclib.h>
+#include <intelblocks/systemagent.h>
+#include <intelblocks/tco.h>
+#include <intelpch/lockdown.h>
+#include <soc/pci_devs.h>
+#include <soc/systemagent.h>
+
+/*
+ * Common finalize implementation for Intel SoCs.
+ * This consolidates the nearly identical finalize.c implementations
+ * across Meteor Lake and Panther Lake platforms.
+ */
+
+static void pch_finalize(void)
+{
+	/* TCO Lock down */
+	tco_lockdown();
+
+	/* TODO: Add Thermal Configuration */
+
+	pmc_clear_pmcon_sts();
+}
+
+static void tbt_finalize(void)
+{
+	int i;
+	const struct device *dev;
+
+	/* Disable Thunderbolt PCIe root ports bus master */
+	for (i = 0; i < NUM_TBT_FUNCTIONS; i++) {
+		dev = pcidev_path_on_root(PCI_DEVFN_TBT(i));
+		if (dev)
+			pci_dev_disable_bus_master(dev);
+	}
+}
+
+static void sa_finalize(void)
+{
+	if (get_lockdown_config() == CHIPSET_LOCKDOWN_COREBOOT)
+		sa_lock_pam();
+}
+
+static void heci_finalize(void)
+{
+	heci_set_to_d0i3();
+	if (CONFIG(DISABLE_HECI1_AT_PRE_BOOT))
+		heci1_disable();
+}
+
+static void soc_finalize(void *unused)
+{
+	printk(BIOS_DEBUG, "Finalizing chipset.\n");
+
+	pch_finalize();
+	apm_control(APM_CNT_FINALIZE);
+	tbt_finalize();
+	sa_finalize();
+	if (CONFIG(USE_FSP_NOTIFY_PHASE_READY_TO_BOOT) &&
+			 CONFIG(USE_FSP_NOTIFY_PHASE_END_OF_FIRMWARE))
+		heci_finalize();
+
+	/* Indicate finalize step with post code */
+	post_code(POSTCODE_OS_BOOT);
+}
+
+BOOT_STATE_INIT_ENTRY(BS_OS_RESUME, BS_ON_ENTRY, soc_finalize, NULL);
+/*
+ * The purpose of this change is to accommodate more time to push out sending
+ * CSE EOP messages at post.
+ */
+BOOT_STATE_INIT_ENTRY(BS_PAYLOAD_BOOT, BS_ON_ENTRY, soc_finalize, NULL);