realtek_mst_i2c_spi.c: Add allow-brick=yes programmer param

Currently i2c programmers do not have a safe allow listing
mechanism via board_enable to facilitate fully qualified
chip detection.

Since i2c addresses alone can overlap a user may make the mistake
of using the wrong programmer. Although unlikely, it is within the
realm of possibility that a user could accidently somehow program
another chip on their board.

Change-Id: Ifb303989fdb67f7267002bd0425f3d050450ec93
Signed-off-by: Edward O'Callaghan <quasisec@google.com>
Reviewed-on: https://review.coreboot.org/c/flashrom/+/65545
Reviewed-by: Thomas Heijligen <src@posteo.de>
Reviewed-by: Anastasia Klimchuk <aklm@chromium.org>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>

1 files changed, 29 insertions, 4 deletions

diff --git a/realtek_mst_i2c_spi.c b/realtek_mst_i2c_spi.c
index bfd211473..f817b9cd9 100644
--- a/realtek_mst_i2c_spi.c
+++ b/realtek_mst_i2c_spi.c
@@ -444,11 +444,24 @@ static const struct spi_master spi_master_i2c_realtek_mst = {
 	.probe_opcode	= default_spi_probe_opcode,
 };
 
-static int get_params(int *reset, int *enter_isp)
+static int get_params(int *reset, int *enter_isp, int *allow_brick)
 {
-	char *reset_str = NULL, *isp_str = NULL;
+	char *reset_str = NULL, *isp_str = NULL, *brick_str = NULL;
 	int ret = 0;
 
+	brick_str = extract_programmer_param_str("allow-brick");
+	if (brick_str) {
+		if (!strcmp(brick_str, "yes")) {
+			*allow_brick = 1;
+		} else {
+			msg_perr("%s: Incorrect param format, allow_brick=yes.\n", __func__);
+			ret = SPI_GENERIC_ERROR;
+		}
+	} else {
+		*allow_brick = 0; /* Default behaviour is to bail. */
+	}
+	free(brick_str);
+
 	reset_str = extract_programmer_param_str("reset-mcu");
 	if (reset_str) {
 		if (reset_str[0] == '1') {
@@ -485,11 +498,23 @@ static int get_params(int *reset, int *enter_isp)
 static int realtek_mst_i2c_spi_init(void)
 {
 	int ret = 0;
-	int reset = 0, enter_isp = 0;
+	int reset = 0, enter_isp = 0, allow_brick = 0;
 
-	if (get_params(&reset, &enter_isp))
+	if (get_params(&reset, &enter_isp, &allow_brick))
 		return SPI_GENERIC_ERROR;
 
+	/*
+	 * TODO: Once board_enable can facilitate safe i2c allow listing
+	 * 	 then this can be removed.
+	 */
+	if (!allow_brick) {
+		msg_perr("%s: For i2c drivers you must explicitly 'allow-brick=yes'. ", __func__);
+		msg_perr("There is currently no way to determine if the programmer works on a board "
+			 "as i2c device address space can be overloaded. Set 'allow-brick=yes' if "
+			 "you are sure you know what you are doing.\n");
+		return SPI_GENERIC_ERROR;
+	}
+
 	int fd = i2c_open_from_programmer_params(REGISTER_ADDRESS, 0);
 	if (fd < 0)
 		return fd;