Is FSP broken with SPI TPM?

https://review.coreboot.org/c/coreboot/+/37441

Hi, I've tested it on x11sch-f with a TPMv2 chip (9670H) but found a reproducible bug:

1) The commits for x11sch-f seems missed a patch to enable TPMv2:

diff --git a/src/mainboard/supermicro/x11-lga1151v2-series/Kconfig b/src/mainboard/supermicro/x11-lga1151v2-series/Kconfig ✓
index 802d81fe45..a046828777 100644
--- a/src/mainboard/supermicro/x11-lga1151v2-series/Kconfig
+++ b/src/mainboard/supermicro/x11-lga1151v2-series/Kconfig
@@ -12,7 +12,7 @@ config BOARD_SUPERMICRO_BASEBOARD_X11_LGA1151V2_SERIES
        select SUPERIO_ASPEED_AST2400
        select SUPERIO_ASPEED_COMMON_PRE_RAM
        select SUPERIO_ASPEED_HAS_UART_DELAY_WORKAROUND
-
+       select MAINBOARD_HAS_SPI_TPM
 if BOARD_SUPERMICRO_BASEBOARD_X11_LGA1151V2_SERIES

 config MAINBOARD_FAMILY

2) Enable the TPM options and build coreboot.

3) Plug in the TPM on the mainboard, the boot process will hang:

----------------------------------
coreboot-4.14-724-gac7779d32c-dirty--xXx Wed Jun 23 14:32:15 UTC 2021 bootblock starting (log level: 7)...
CPU: Intel(R) Xeon(R) E-2186G CPU @ 3.80GHz
CPU: ID 906ea, Coffeelake U0 (6+2), ucode: 000000dd
CPU: AES supported, TXT supported, VT supported
MCH: device id 3ec6 (rev 07) is Coffeelake-S WS(6+2)
PCH: device id a309 (rev 10) is Cannonlake-H C246
IGD: device id 3e96 (rev 00) is Coffeelake-S GT2
PMC: Using default GPE route.
misccfg_mask:fff000ff misccfg_value:43200
FMAP: Found "FLASH" version 1.1 at 0x1610000.
FMAP: base = 0xfe000000 size = 0x2000000 #areas = 4
FMAP: area COREBOOT found @ 1610200 (10419712 bytes)
CBFS: mcache @0xfef21c00 built for 19 files, used 0x418 of 0x4000 bytes
CBFS: Found 'fallback/romstage' @0x80 size 0xe030 in mcache @0xfef21c2c
TCPA: Clearing coreboot TCPA log
FMAP: area FMAP found @ 1610000 (512 bytes)
TPM: Digest of FMAP: FMAP to PCR 2 logged
CBFS: Found 'bootblock' @0x9e8600 size 0x77a0 in mcache @0xfef21fb4
FMAP: area COREBOOT found @ 1610200 (10419712 bytes)
TPM: Digest of FMAP: COREBOOT CBFS: bootblock to PCR 2 logged
CRTM initialized.
FMAP: area COREBOOT found @ 1610200 (10419712 bytes)
TPM: Digest of FMAP: COREBOOT CBFS: fallback/romstage to PCR 2 logged
BS: bootblock times (exec / console): total (unknown) / 108 ms

coreboot-4.14-724-gac7779d32c-dirty--xXx Wed Jun 23 14:32:15 UTC 2021 romstage starting (log level: 7)...
pm1_sts: 0000 pm1_en: 0000 pm1_cnt: 00001c00
gpe0_sts[0]: 00000000 gpe0_en[0]: 00000000
gpe0_sts[1]: 00000000 gpe0_en[1]: 00000000
gpe0_sts[2]: 00000000 gpe0_en[2]: 00000000
gpe0_sts[3]: 00000000 gpe0_en[3]: 00000000
TCO_STS:   0000 0004
GEN_PMCON: e0015008 00000200
GBLRST_CAUSE: 00000000 00000000
prev_sleep_state 5
FMAP: area COREBOOT found @ 1610200 (10419712 bytes)
CBFS: Found 'fspm.bin' @0x9adc0 size 0x88000 in mcache @0xfef21e4c
FMAP: area COREBOOT found @ 1610200 (10419712 bytes)
TPM: Digest of FMAP: COREBOOT CBFS: fspm.bin to PCR 2 logged
POST: 0x34
FMAP: area RW_MRC_CACHE found @ 1600000 (65536 bytes)
POST: 0x36
POST: 0x92
----------------------------------

The system will work without plug in the TPM. It seems a MRC bug in FSP?

intel / FSP

Is FSP broken with SPI TPM? #77