soc/intel/common/cse: Add helper API for CSE SPI Protection Mode

This patch checks if CSE's spi protection mode is protected or
unprotected. Returns true if CSE's spi protection mode is protected,
otherwise false.

BUG=b:211954778
TEST=Able to build and boot brya with this change. Calling
`cse_is_hfs1_spi_protected()` in coreboot is able to provide
the SPI protection status.

Signed-off-by: Subrata Banik <subratabanik@google.com>
Change-Id: I23f1a1c4b55d8da6e6fd0cf84bef86f49ce80cca
Reviewed-on: https://review.coreboot.org/c/coreboot/+/60403
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Tim Wawrzynczak <twawrzynczak@chromium.org>
Reviewed-by: EricR Lai <ericr_lai@compal.corp-partner.google.com>
Reviewed-by: Paul Menzel <paulepanter@mailbox.org>

src/soc/intel/common/block/cse/cse.c

@@ -257,6 +257,22 @@ bool cse_is_hfs1_com_soft_temp_disable(void)
 	return cse_check_hfs1_com(ME_HFS1_COM_SOFT_TEMP_DISABLE);
 }
 
+/*
+ * TGL HFSTS1.spi_protection_mode bit replaces the previous
+ * `manufacturing mode (mfg_mode)` without changing the offset and purpose
+ * of this bit.
+ *
+ * Using HFSTS1.mfg_mode to get the SPI protection status for all PCH.
+ * mfg_mode = 0 means SPI protection in on.
+ * mfg_mode = 1 means SPI is unprotected.
+ */
+bool cse_is_hfs1_spi_protected(void)
+{
+	union me_hfsts1 hfs1;
+	hfs1.data = me_read_config32(PCI_ME_HFSTS1);
+	return !hfs1.fields.mfg_mode;
+}
+
 bool cse_is_hfs3_fw_sku_lite(void)
 {
 	union me_hfsts3 hfs3;

src/soc/intel/common/block/include/intelblocks/cse.h

@@ -300,6 +300,12 @@ bool cse_is_hfs1_com_secover_mei_msg(void);
  */
 bool cse_is_hfs1_com_soft_temp_disable(void);
 
+/*
+ * Checks CSE's spi protection mode is protected or unprotected.
+ * Returns true if CSE's spi protection mode is protected, otherwise false.
+ */
+bool cse_is_hfs1_spi_protected(void);
+
 /*
  * Checks CSE's Firmware SKU is Lite or not.
  * Returns true if CSE's Firmware SKU is Lite, otherwise false