realtek_mst_i2c_spi.c: Add allow-brick=yes programmer param

Currently i2c programmers do not have a safe allow listing
mechanism via board_enable to facilitate fully qualified
chip detection.

Since i2c addresses alone can overlap a user may make the mistake
of using the wrong programmer. Although unlikely, it is within the
realm of possibility that a user could accidently somehow program
another chip on their board.

Change-Id: Ifb303989fdb67f7267002bd0425f3d050450ec93
Signed-off-by: Edward O'Callaghan <quasisec@google.com>
Reviewed-on: https://review.coreboot.org/c/flashrom/+/65545
Reviewed-by: Thomas Heijligen <src@posteo.de>
Reviewed-by: Anastasia Klimchuk <aklm@chromium.org>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>

3 files changed, 33 insertions, 5 deletions

diff --git a/flashrom.8.tmpl b/flashrom.8.tmpl
index 362b14a79..c8a998846 100644
--- a/flashrom.8.tmpl
+++ b/flashrom.8.tmpl
@@ -1554,6 +1554,9 @@ hub when beginning operation to put it into ISP mode.
 the MST hub on programming completion, causing it to exit ISP mode and to
 reload its own firmware from flash.
 
+\fBallow-brick\fP defaults to no, however must be set explicitly to "yes"
+to allow the driver to run if you are sure you have a MST chip.
+
 The hub must be in ISP mode for SPI flash access to be possible, so it is
 usually only useful to disable \fBenter-isp\fP if an earlier invocation avoided
 resetting it on completion. For instance, to erase the flash and
diff --git a/realtek_mst_i2c_spi.c b/realtek_mst_i2c_spi.c
index bfd211473..f817b9cd9 100644
--- a/realtek_mst_i2c_spi.c
+++ b/realtek_mst_i2c_spi.c
@@ -444,11 +444,24 @@ static const struct spi_master spi_master_i2c_realtek_mst = {
 	.probe_opcode	= default_spi_probe_opcode,
 };
 
-static int get_params(int *reset, int *enter_isp)
+static int get_params(int *reset, int *enter_isp, int *allow_brick)
 {
-	char *reset_str = NULL, *isp_str = NULL;
+	char *reset_str = NULL, *isp_str = NULL, *brick_str = NULL;
 	int ret = 0;
 
+	brick_str = extract_programmer_param_str("allow-brick");
+	if (brick_str) {
+		if (!strcmp(brick_str, "yes")) {
+			*allow_brick = 1;
+		} else {
+			msg_perr("%s: Incorrect param format, allow_brick=yes.\n", __func__);
+			ret = SPI_GENERIC_ERROR;
+		}
+	} else {
+		*allow_brick = 0; /* Default behaviour is to bail. */
+	}
+	free(brick_str);
+
 	reset_str = extract_programmer_param_str("reset-mcu");
 	if (reset_str) {
 		if (reset_str[0] == '1') {
@@ -485,11 +498,23 @@ static int get_params(int *reset, int *enter_isp)
 static int realtek_mst_i2c_spi_init(void)
 {
 	int ret = 0;
-	int reset = 0, enter_isp = 0;
+	int reset = 0, enter_isp = 0, allow_brick = 0;
 
-	if (get_params(&reset, &enter_isp))
+	if (get_params(&reset, &enter_isp, &allow_brick))
 		return SPI_GENERIC_ERROR;
 
+	/*
+	 * TODO: Once board_enable can facilitate safe i2c allow listing
+	 * 	 then this can be removed.
+	 */
+	if (!allow_brick) {
+		msg_perr("%s: For i2c drivers you must explicitly 'allow-brick=yes'. ", __func__);
+		msg_perr("There is currently no way to determine if the programmer works on a board "
+			 "as i2c device address space can be overloaded. Set 'allow-brick=yes' if "
+			 "you are sure you know what you are doing.\n");
+		return SPI_GENERIC_ERROR;
+	}
+
 	int fd = i2c_open_from_programmer_params(REGISTER_ADDRESS, 0);
 	if (fd < 0)
 		return fd;
diff --git a/tests/realtek_mst_i2c_spi.c b/tests/realtek_mst_i2c_spi.c
index 10fdbe0a3..3b004cbee 100644
--- a/tests/realtek_mst_i2c_spi.c
+++ b/tests/realtek_mst_i2c_spi.c
@@ -56,7 +56,7 @@ void realtek_mst_basic_lifecycle_test_success(void **state)
 		.fallback_open_state = &realtek_mst_fallback_open_state,
 	};
 
-	run_basic_lifecycle(state, &realtek_mst_io, &programmer_realtek_mst_i2c_spi, "bus=254,enter-isp=0");
+	run_basic_lifecycle(state, &realtek_mst_io, &programmer_realtek_mst_i2c_spi, "bus=254,enter-isp=0,allow-brick=yes");
 }
 #else
 	SKIP_TEST(realtek_mst_basic_lifecycle_test_success)