soc/intel/apollolake: Implement global reset handling

Global reset enable bit is not cleared on reset. Therefore, clear
the bit early. Lock down 0xcf9 so that payload/OS can't issue
global reset.

BUG=chrome-os-partner:54149
BRANCH=none
TEST=none

Change-Id: I3ddf6dd82429b725c818bcd96e163d2ca0acd308
Signed-off-by: Andrey Petrov <andrey.petrov@intel.com>
Reviewed-on: https://review.coreboot.org/15199
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
Tested-by: build bot (Jenkins)

src/soc/intel/apollolake/chip.c

@@ -32,6 +32,7 @@
 #include <soc/nvs.h>
 #include <soc/pci_devs.h>
 #include <spi-generic.h>
+#include <soc/pm.h>
 
 #include "chip.h"
 
@@ -93,6 +94,11 @@ static void soc_final(void *data)
 {
 	if (vbt)
 		rdev_munmap(&vbt_rdev, vbt);
+
+	/* Disable global reset, just in case */
+	global_reset_enable(0);
+	/* Make sure payload/OS can't trigger global reset */
+	global_reset_lock();
 }
 
 void platform_fsp_silicon_init_params_cb(struct FSPS_UPD *silupd)