[M] Change in coreboot[master]: soc/intel/alderlake: Check MANUF_LOCK when logging manufacturing mode

[Felix Held (Code Review)]

Felix Held has submitted this change. ( https://review.coreboot.org/c/coreboot/+/69324 )

Change subject: soc/intel/alderlake: Check MANUF_LOCK when logging manufacturing mode
......................................................................

soc/intel/alderlake: Check MANUF_LOCK when logging manufacturing mode

As per Intel doc #627331 Section 3.6.1 "Intel CSME Production Machine
Determination", from ADL onwards there are three criteria which
determine whether a device is in production mode:
1. Fuses are programmed
2. SPI descriptor is locked
3. Manufacturing variables are locked

When logging whether the device is in manufacturing mode, 1 and 2 are
already checked. Add a check for 3 as well.

Also add logs for each individual criteria so it's easy to tell why the
overall Manufacturing Mode is set or not.

BUG=b:255462682
TEST=On a nivviks which has not gone through EOM:
Before:
[DEBUG]  ME: Manufacturing Mode          : YES
[DEBUG]  ME: SPI Protection Mode Enabled : NO

After:
[DEBUG]  ME: Manufacturing Mode          : YES
[DEBUG]  ME: SPI Protection Mode Enabled : NO
[DEBUG]  ME: FPFs Committed              : NO
[DEBUG]  ME: Manufacturing Vars Locked   : NO

On an anahera which has gone through EOM:
Before:
[DEBUG]  ME: Manufacturing Mode          : NO
[DEBUG]  ME: SPI Protection Mode Enabled : YES

After:
[DEBUG]  ME: Manufacturing Mode          : NO
[DEBUG]  ME: SPI Protection Mode Enabled : YES
[DEBUG]  ME: FPFs Committed              : YES
[DEBUG]  ME: Manufacturing Vars Locked   : YES

Change-Id: Iac605baa291ab5cc5f28464006f4828c12c748fe
Signed-off-by: Reka Norman 
Reviewed-on: https://review.coreboot.org/c/coreboot/+/69324
Reviewed-by: Eric Lai 
Reviewed-by: Kapil Porwal 
Reviewed-by: Kangheui Won 
Reviewed-by: Subrata Banik 
Reviewed-by: Michał Żygowski 
Tested-by: build bot (Jenkins) 
---
M src/soc/intel/alderlake/me.c
1 file changed, 76 insertions(+), 8 deletions(-)

Approvals:
  build bot (Jenkins): Verified
  Michał Żygowski: Looks good to me, approved
  Kangheui Won: Looks good to me, approved
  Subrata Banik: Looks good to me, approved
  Eric Lai: Looks good to me, but someone else must approve
  Kapil Porwal: Looks good to me, approved

diff --git a/src/soc/intel/alderlake/me.c b/src/soc/intel/alderlake/me.c
index a965807..4937ced 100644
--- a/src/soc/intel/alderlake/me.c
+++ b/src/soc/intel/alderlake/me.c
@@ -102,11 +102,25 @@
    			base, limit);
    }

-	/* If EOM is disabled, but CSE RO is not write protected, log error */
+	/*
+	 * If manufacturing mode is disabled, but CSE RO is not write protected,
+	 * log error.
+	 */
    if (!mfg_mode && !cse_ro_wp_en)
    	printk(BIOS_ERR, "ME: Write protection for CSE RO is not enabled\n");
 }

+static bool is_manuf_mode(union me_hfsts1 hfsts1, union me_hfsts6 hfsts6)
+{
+	/*
+	 * ME manufacturing mode is disabled if the descriptor is locked, fuses
+	 * are programmed and manufacturing variables are locked.
+	 */
+	return !((hfsts1.fields.mfg_mode == 0) &&
+		 (hfsts6.fields.fpf_soc_lock == 1) &&
+		 (hfsts6.fields.manuf_lock == 1));
+}
+
 static void dump_me_status(void *unused)
 {
    union me_hfsts1 hfsts1;
@@ -115,6 +129,7 @@
    union me_hfsts4 hfsts4;
    union me_hfsts5 hfsts5;
    union me_hfsts6 hfsts6;
+	bool manuf_mode;

if (!is_cse_enabled())
    	return;
@@ -133,19 +148,19 @@
    printk(BIOS_DEBUG, "ME: HFSTS5                      : 0x%08X\n", hfsts5.data);
    printk(BIOS_DEBUG, "ME: HFSTS6                      : 0x%08X\n", hfsts6.data);

-	/*
-	 * Lock Descriptor, and Fuses must be programmed on a
-	 * production system to indicate ME Manufacturing mode is disabled.
-	 */
+	manuf_mode = is_manuf_mode(hfsts1, hfsts6);
    printk(BIOS_DEBUG, "ME: Manufacturing Mode          : %s\n",
-		((hfsts1.fields.mfg_mode == 0) &&
-		(hfsts6.fields.fpf_soc_lock == 1)) ? "NO" : "YES");
+	       manuf_mode ? "YES" : "NO");
    /*
     * The SPI Protection Mode bit reflects SPI descriptor
     * locked(0) or unlocked(1).
     */
    printk(BIOS_DEBUG, "ME: SPI Protection Mode Enabled : %s\n",
    	hfsts1.fields.mfg_mode ? "NO" : "YES");
+	printk(BIOS_DEBUG, "ME: FPFs Committed              : %s\n",
+		hfsts6.fields.fpf_soc_lock ? "YES" : "NO");
+	printk(BIOS_DEBUG, "ME: Manufacturing Vars Locked   : %s\n",
+		hfsts6.fields.manuf_lock ? "YES" : "NO");
    printk(BIOS_DEBUG, "ME: FW Partition Table          : %s\n",
    	hfsts1.fields.fpt_bad ? "BAD" : "OK");
    printk(BIOS_DEBUG, "ME: Bringup Loader Failure      : %s\n",
@@ -180,7 +195,7 @@
    	hfsts6.fields.txt_support ? "YES" : "NO");

if (CONFIG(SOC_INTEL_CSE_LITE_SKU))
-		log_me_ro_write_protection_info(!!hfsts1.fields.mfg_mode);
+		log_me_ro_write_protection_info(manuf_mode);
 }

BOOT_STATE_INIT_ENTRY(BS_DEV_ENABLE, BS_ON_EXIT, print_me_fw_version, NULL);