Change in coreboot[master]: security/intel/txt: Correct reporting of chipset production fuse state

[Michał Żygowski (Code Review)]

Michał Żygowski has submitted this change. ( https://review.coreboot.org/c/coreboot/+/59514 )

Change subject: security/intel/txt: Correct reporting of chipset production fuse state
......................................................................

security/intel/txt: Correct reporting of chipset production fuse state

Implement the chipset production fuse state reporting as described in
the Intel TXT Software Development Guide. Also fix all occurrences
where the production fuse state is checked.

TEST=Dell OptiPlex 9010 with i7-3770/Q77 reports the chipset is
production fused

Signed-off-by: Michał Żygowski 
Change-Id: Ic86c5a9e1d162630a1cf61435d1014edabf104b0
Reviewed-on: https://review.coreboot.org/c/coreboot/+/59514
Reviewed-by: Patrick Rudolph 
Tested-by: build bot (Jenkins) 
---
M src/security/intel/txt/common.c
M src/security/intel/txt/logging.c
M src/security/intel/txt/txt.h
3 files changed, 20 insertions(+), 3 deletions(-)

Approvals:
  build bot (Jenkins): Verified
  Patrick Rudolph: Looks good to me, approved

diff --git a/src/security/intel/txt/common.c b/src/security/intel/txt/common.c
index e3e2f5c..7e6c55c 100644
--- a/src/security/intel/txt/common.c
+++ b/src/security/intel/txt/common.c
@@ -141,6 +141,22 @@
    return ret;
 }

+bool intel_txt_chipset_is_production_fused(void)
+{
+	/*
+	 * Certain chipsets report production fused information in either
+	 * TXT.VER.FSBIF or TXT.VER.EMIF/TXT.VER.QPIIF.
+	 * Chapter B.1.7 and B.1.9
+	 * Intel TXT Software Development Guide (Document: 315168-015)
+	 */
+	uint32_t reg = read32((void *)TXT_VER_FSBIF);
+
+	if (reg == 0 || reg == UINT32_MAX)
+		reg = read32((void *)TXT_VER_QPIIF);
+
+	return (reg & TXT_VER_PRODUCTION_FUSED) ? true : false;
+}
+
 static struct acm_info_table *find_info_table(const void *ptr)
 {
    const struct acm_header_v0 *acm_header = (struct acm_header_v0 *)ptr;
@@ -203,8 +219,8 @@
    if (memcmp(acm_uuid, info->uuid, sizeof(acm_uuid)) != 0)
    	return ACM_E_UUID_NOT_MATCH;

-	if ((acm_header->flags & ACM_FORMAT_FLAGS_DEBUG) ==
-	    (read64((void *)TXT_VER_FSBIF) & TXT_VER_PRODUCTION_FUSED))
+	const bool production_acm = !(acm_header->flags & ACM_FORMAT_FLAGS_DEBUG);
+	if (production_acm != intel_txt_chipset_is_production_fused())
    	return ACM_E_PLATFORM_IS_NOT_PROD;

return 0;
diff --git a/src/security/intel/txt/logging.c b/src/security/intel/txt/logging.c
index b4eac33..f73ae4b 100644
--- a/src/security/intel/txt/logging.c
+++ b/src/security/intel/txt/logging.c
@@ -185,7 +185,7 @@

printk(BIOS_INFO, "TEE-TXT: DIDVID 0x%x\n", read32((void *)TXT_DIDVID));
    printk(BIOS_INFO, "TEE-TXT: production fused chipset: %s\n",
-	       (read64((void *)TXT_VER_FSBIF) & TXT_VER_PRODUCTION_FUSED) ? "true" : "false");
+	       intel_txt_chipset_is_production_fused() ? "true" : "false");
 }

void txt_dump_regions(void)
diff --git a/src/security/intel/txt/txt.h b/src/security/intel/txt/txt.h
index e1a78af..63ac91c 100644
--- a/src/security/intel/txt/txt.h
+++ b/src/security/intel/txt/txt.h
@@ -23,6 +23,7 @@
 int intel_txt_log_acm_error(const uint32_t acm_error);
 void intel_txt_log_spad(void);
 bool intel_txt_memory_has_secrets(void);
+bool intel_txt_chipset_is_production_fused(void);
 void intel_txt_run_sclean(void);
 int intel_txt_run_bios_acm(const u8 input_params);
 bool intel_txt_prepare_txt_env(void);