Sridhar Siricilla has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/48267 )
Change subject: sb/intel/common: Modify CONFIG_LOCK_MANAGEMENT_ENGINE behavior ......................................................................
sb/intel/common: Modify CONFIG_LOCK_MANAGEMENT_ENGINE behavior
The patch modifies KConfig behaviour if CSE Lite SKU is integrated into the coreboot. When the CSE Lite SKU is integrated, the KConfig prevents writing to ME region. Also, it modifies the KConfig's help text to reflect the change.
When CSE Lite SKU is integrated, master access permissions: FLMSTR1: 0x002007ff (Host CPU/BIOS) EC Region Write Access: disabled Platform Data Region Write Access: disabled GbE Region Write Access: disabled Intel ME Region Write Access: disabled Host CPU/BIOS Region Write Access: enabled Flash Descriptor Write Access: disabled EC Region Read Access: disabled Platform Data Region Read Access: disabled GbE Region Read Access: disabled Intel ME Region Read Access: enabled Host CPU/BIOS Region Read Access: enabled Flash Descriptor Read Access: enabled
BUG=b:174118018 TEST=Built and verified the access permissions.
Signed-off-by: Sridhar Siricilla sridhar.siricilla@intel.com Change-Id: I2f6677ab7b59ddce827d3fcaae61508a30dc1b28 --- M src/southbridge/intel/common/firmware/Kconfig M src/southbridge/intel/common/firmware/Makefile.inc 2 files changed, 14 insertions(+), 7 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/67/48267/1
diff --git a/src/southbridge/intel/common/firmware/Kconfig b/src/southbridge/intel/common/firmware/Kconfig index 4e93426..999930a 100644 --- a/src/southbridge/intel/common/firmware/Kconfig +++ b/src/southbridge/intel/common/firmware/Kconfig @@ -145,12 +145,12 @@ config LOCK_MANAGEMENT_ENGINE bool "Lock ME/TXE section" help - The Intel Firmware Descriptor supports preventing write accesses - from the host to the ME or TXE section in the firmware - descriptor. If the section is locked, it can only be overwritten - with an external SPI flash programmer. You will want this if you - want to increase security of your ROM image once you are sure - that the ME/TXE firmware is no longer going to change. + The Intel Firmware Descriptor supports preventing write and read + accesses from the host to the ME or TXE section. If the section + is locked, it can only be overwritten with an external SPI flash + programmer or HECI HMRFPO_ENABLE command needs to be sent to CSE + before writing to the ME Section. If CSE Lite SKU is integrated, + the Kconfigprevents only writing to the ME section.
If unsure, select "Unlock flash regions".
diff --git a/src/southbridge/intel/common/firmware/Makefile.inc b/src/southbridge/intel/common/firmware/Makefile.inc index df9a57f..7b0ce53 100644 --- a/src/southbridge/intel/common/firmware/Makefile.inc +++ b/src/southbridge/intel/common/firmware/Makefile.inc @@ -17,6 +17,12 @@ IFDTOOL_USE_CHIPSET := -p $(CONFIG_IFD_CHIPSET) endif
+ifeq ($(CONFIG_SOC_INTEL_CSE_LITE_SKU),y) +IFDTOOL_LOCK_ME_MODE := -lr +else +IFDTOOL_LOCK_ME_MODE := -l +endif + add_intel_firmware: $(call strip_quotes,$(CONFIG_IFD_BIN_PATH)) ifeq ($(CONFIG_HAVE_ME_BIN),y) add_intel_firmware: $(call strip_quotes,$(CONFIG_ME_BIN_PATH)) @@ -73,10 +79,11 @@ ifeq ($(CONFIG_LOCK_MANAGEMENT_ENGINE),y) printf " IFDTOOL Locking Management Engine\n" $(objutil)/ifdtool/ifdtool \ - $(IFDTOOL_USE_CHIPSET) -l \ + $(IFDTOOL_USE_CHIPSET) $(IFDTOOL_LOCK_ME_MODE) \ -O $(obj)/coreboot.pre \ $(obj)/coreboot.pre endif + ifeq ($(CONFIG_UNLOCK_FLASH_REGIONS),y) printf " IFDTOOL Unlocking Management Engine\n" $(objutil)/ifdtool/ifdtool \
Furquan Shaikh has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/48267 )
Change subject: sb/intel/common: Modify CONFIG_LOCK_MANAGEMENT_ENGINE behavior ......................................................................
Patch Set 2: Code-Review+1
(3 comments)
https://review.coreboot.org/c/coreboot/+/48267/1/src/southbridge/intel/commo... File src/southbridge/intel/common/firmware/Kconfig:
https://review.coreboot.org/c/coreboot/+/48267/1/src/southbridge/intel/commo... PS1, Line 153: Kconfigprevents Kconfig prevents
https://review.coreboot.org/c/coreboot/+/48267/2/src/southbridge/intel/commo... File src/southbridge/intel/common/firmware/Kconfig:
https://review.coreboot.org/c/coreboot/+/48267/2/src/southbridge/intel/commo... PS2, Line 153: Kconfigprevents space between Kconfig and prevents
https://review.coreboot.org/c/coreboot/+/48267/2/src/southbridge/intel/commo... File src/southbridge/intel/common/firmware/Makefile.inc:
https://review.coreboot.org/c/coreboot/+/48267/2/src/southbridge/intel/commo... PS2, Line 20: CONFIG_SOC_INTEL_CSE_LITE_SKU In general, I think we avoid using SOC specific configs in more common code. I think it would be better to have a new Kconfig in src/southbridge/intel/common/firmware (ME_REGION_ALLOW_CPU_READ_ACCESS) that soc/intel/common/block/cse/Kconfig can select for CSE Lite SKU. In this Makefile, you can use this new Kconfig to add -r.
Hello build bot (Jenkins), Furquan Shaikh, Jamie Ryu, Patrick Georgi, Martin Roth, Paul Menzel, Rizwan Qureshi, Tim Wawrzynczak, Nick Vaccaro, Krishna P Bhat D, Patrick Rudolph, Karthik Ramasubramanian,
I'd like you to reexamine a change. Please visit
https://review.coreboot.org/c/coreboot/+/48267
to look at the new patch set (#3).
Change subject: sb/intel/common: Modify CONFIG_LOCK_MANAGEMENT_ENGINE behavior ......................................................................
sb/intel/common: Modify CONFIG_LOCK_MANAGEMENT_ENGINE behavior
The patch modifies KConfig behaviour if CSE Lite SKU is integrated into the coreboot. When the CSE Lite SKU is integrated, the KConfig prevents writing to ME region. Also, it modifies the KConfig's help text to reflect the change.
When CSE Lite SKU is integrated, master access permissions: FLMSTR1: 0x002007ff (Host CPU/BIOS) EC Region Write Access: disabled Platform Data Region Write Access: disabled GbE Region Write Access: disabled Intel ME Region Write Access: disabled Host CPU/BIOS Region Write Access: enabled Flash Descriptor Write Access: disabled EC Region Read Access: disabled Platform Data Region Read Access: disabled GbE Region Read Access: disabled Intel ME Region Read Access: enabled Host CPU/BIOS Region Read Access: enabled Flash Descriptor Read Access: enabled
BUG=b:174118018 TEST=Built and verified the access permissions.
Signed-off-by: Sridhar Siricilla sridhar.siricilla@intel.com Change-Id: I2f6677ab7b59ddce827d3fcaae61508a30dc1b28 --- M src/soc/intel/common/block/cse/Kconfig M src/southbridge/intel/common/firmware/Kconfig M src/southbridge/intel/common/firmware/Makefile.inc 3 files changed, 18 insertions(+), 7 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/67/48267/3
Sridhar Siricilla has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/48267 )
Change subject: sb/intel/common: Modify CONFIG_LOCK_MANAGEMENT_ENGINE behavior ......................................................................
Patch Set 3:
(3 comments)
https://review.coreboot.org/c/coreboot/+/48267/1/src/southbridge/intel/commo... File src/southbridge/intel/common/firmware/Kconfig:
https://review.coreboot.org/c/coreboot/+/48267/1/src/southbridge/intel/commo... PS1, Line 153: Kconfigprevents
Kconfig prevents
Ack
https://review.coreboot.org/c/coreboot/+/48267/2/src/southbridge/intel/commo... File src/southbridge/intel/common/firmware/Kconfig:
https://review.coreboot.org/c/coreboot/+/48267/2/src/southbridge/intel/commo... PS2, Line 153: Kconfigprevents
space between Kconfig and prevents
Ack
https://review.coreboot.org/c/coreboot/+/48267/2/src/southbridge/intel/commo... File src/southbridge/intel/common/firmware/Makefile.inc:
https://review.coreboot.org/c/coreboot/+/48267/2/src/southbridge/intel/commo... PS2, Line 20: CONFIG_SOC_INTEL_CSE_LITE_SKU
In general, I think we avoid using SOC specific configs in more common code. […]
Ah, agree, modified the code accordingly.
Sridhar Siricilla has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/48267 )
Change subject: sb/intel/common: Modify CONFIG_LOCK_MANAGEMENT_ENGINE behavior ......................................................................
Patch Set 3:
(1 comment)
https://review.coreboot.org/c/coreboot/+/48267/2/src/southbridge/intel/commo... File src/southbridge/intel/common/firmware/Makefile.inc:
https://review.coreboot.org/c/coreboot/+/48267/2/src/southbridge/intel/commo... PS2, Line 20: CONFIG_SOC_INTEL_CSE_LITE_SKU
Ah, agree, modified the code accordingly.
Done
Furquan Shaikh has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/48267 )
Change subject: sb/intel/common: Modify CONFIG_LOCK_MANAGEMENT_ENGINE behavior ......................................................................
Patch Set 3:
(2 comments)
https://review.coreboot.org/c/coreboot/+/48267/3//COMMIT_MSG Commit Message:
https://review.coreboot.org/c/coreboot/+/48267/3//COMMIT_MSG@11 PS3, Line 11: . but keeps read access enabled. (Also, can you please state the reason why this is required).
https://review.coreboot.org/c/coreboot/+/48267/3/src/southbridge/intel/commo... File src/southbridge/intel/common/firmware/Kconfig:
https://review.coreboot.org/c/coreboot/+/48267/3/src/southbridge/intel/commo... PS3, Line 60: default n can you please add help text here?
Hello build bot (Jenkins), Furquan Shaikh, Jamie Ryu, Patrick Georgi, Martin Roth, Paul Menzel, Rizwan Qureshi, Tim Wawrzynczak, Nick Vaccaro, Krishna P Bhat D, Patrick Rudolph, Karthik Ramasubramanian,
I'd like you to reexamine a change. Please visit
https://review.coreboot.org/c/coreboot/+/48267
to look at the new patch set (#4).
Change subject: sb/intel/common: Modify CONFIG_LOCK_MANAGEMENT_ENGINE behavior ......................................................................
sb/intel/common: Modify CONFIG_LOCK_MANAGEMENT_ENGINE behavior
The patch modifies KConfig behaviour if CSE Lite SKU is integrated into the coreboot. When the CSE Lite SKU is integrated, the KConfig prevents writing to ME region but keeps read access enabled. Since CSE Lite driver checks the signature of RW partition to identify the interrupted CSE firmware update, so host must have read access to the ME region. Also, the patch modifies the KConfig's help text to reflect the change.
When CSE Lite SKU is integrated, master access permissions: FLMSTR1: 0x002007ff (Host CPU/BIOS) EC Region Write Access: disabled Platform Data Region Write Access: disabled GbE Region Write Access: disabled Intel ME Region Write Access: disabled Host CPU/BIOS Region Write Access: enabled Flash Descriptor Write Access: disabled EC Region Read Access: disabled Platform Data Region Read Access: disabled GbE Region Read Access: disabled Intel ME Region Read Access: enabled Host CPU/BIOS Region Read Access: enabled Flash Descriptor Read Access: enabled
BUG=b:174118018 TEST=Built and verified the access permissions.
Signed-off-by: Sridhar Siricilla sridhar.siricilla@intel.com Change-Id: I2f6677ab7b59ddce827d3fcaae61508a30dc1b28 --- M src/soc/intel/common/block/cse/Kconfig M src/southbridge/intel/common/firmware/Kconfig M src/southbridge/intel/common/firmware/Makefile.inc 3 files changed, 22 insertions(+), 7 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/67/48267/4
Sridhar Siricilla has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/48267 )
Change subject: sb/intel/common: Modify CONFIG_LOCK_MANAGEMENT_ENGINE behavior ......................................................................
Patch Set 4:
(2 comments)
https://review.coreboot.org/c/coreboot/+/48267/3//COMMIT_MSG Commit Message:
https://review.coreboot.org/c/coreboot/+/48267/3//COMMIT_MSG@11 PS3, Line 11: .
but keeps read access enabled. (Also, can you please state the reason why this is required).
Ack
https://review.coreboot.org/c/coreboot/+/48267/3/src/southbridge/intel/commo... File src/southbridge/intel/common/firmware/Kconfig:
https://review.coreboot.org/c/coreboot/+/48267/3/src/southbridge/intel/commo... PS3, Line 60: default n
can you please add help text here?
Ack
Tim Wawrzynczak has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/48267 )
Change subject: sb/intel/common: Modify CONFIG_LOCK_MANAGEMENT_ENGINE behavior ......................................................................
Patch Set 4: Code-Review+1
Furquan Shaikh has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/48267 )
Change subject: sb/intel/common: Modify CONFIG_LOCK_MANAGEMENT_ENGINE behavior ......................................................................
Patch Set 4: Code-Review+2
Karthik Ramasubramanian has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/48267 )
Change subject: sb/intel/common: Modify CONFIG_LOCK_MANAGEMENT_ENGINE behavior ......................................................................
Patch Set 4: Code-Review+2
Jamie Ryu has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/48267 )
Change subject: sb/intel/common: Modify CONFIG_LOCK_MANAGEMENT_ENGINE behavior ......................................................................
Patch Set 4: Code-Review+1
Patrick Georgi has submitted this change. ( https://review.coreboot.org/c/coreboot/+/48267 )
Change subject: sb/intel/common: Modify CONFIG_LOCK_MANAGEMENT_ENGINE behavior ......................................................................
sb/intel/common: Modify CONFIG_LOCK_MANAGEMENT_ENGINE behavior
The patch modifies KConfig behaviour if CSE Lite SKU is integrated into the coreboot. When the CSE Lite SKU is integrated, the KConfig prevents writing to ME region but keeps read access enabled. Since CSE Lite driver checks the signature of RW partition to identify the interrupted CSE firmware update, so host must have read access to the ME region. Also, the patch modifies the KConfig's help text to reflect the change.
When CSE Lite SKU is integrated, master access permissions: FLMSTR1: 0x002007ff (Host CPU/BIOS) EC Region Write Access: disabled Platform Data Region Write Access: disabled GbE Region Write Access: disabled Intel ME Region Write Access: disabled Host CPU/BIOS Region Write Access: enabled Flash Descriptor Write Access: disabled EC Region Read Access: disabled Platform Data Region Read Access: disabled GbE Region Read Access: disabled Intel ME Region Read Access: enabled Host CPU/BIOS Region Read Access: enabled Flash Descriptor Read Access: enabled
BUG=b:174118018 TEST=Built and verified the access permissions.
Signed-off-by: Sridhar Siricilla sridhar.siricilla@intel.com Change-Id: I2f6677ab7b59ddce827d3fcaae61508a30dc1b28 Reviewed-on: https://review.coreboot.org/c/coreboot/+/48267 Tested-by: build bot (Jenkins) no-reply@coreboot.org Reviewed-by: Tim Wawrzynczak twawrzynczak@chromium.org Reviewed-by: Furquan Shaikh furquan@google.com Reviewed-by: Karthik Ramasubramanian kramasub@google.com Reviewed-by: Jamie Ryu jamie.m.ryu@intel.com --- M src/soc/intel/common/block/cse/Kconfig M src/southbridge/intel/common/firmware/Kconfig M src/southbridge/intel/common/firmware/Makefile.inc 3 files changed, 22 insertions(+), 7 deletions(-)
Approvals: build bot (Jenkins): Verified Furquan Shaikh: Looks good to me, approved Karthik Ramasubramanian: Looks good to me, approved Tim Wawrzynczak: Looks good to me, but someone else must approve Jamie Ryu: Looks good to me, but someone else must approve
diff --git a/src/soc/intel/common/block/cse/Kconfig b/src/soc/intel/common/block/cse/Kconfig index ee6ce68..d3b7288 100644 --- a/src/soc/intel/common/block/cse/Kconfig +++ b/src/soc/intel/common/block/cse/Kconfig @@ -17,6 +17,7 @@ bool default n depends on CHROMEOS + select ME_REGION_ALLOW_CPU_READ_ACCESS help Enables CSE Lite SKU
diff --git a/src/southbridge/intel/common/firmware/Kconfig b/src/southbridge/intel/common/firmware/Kconfig index 4e93426..cd975ba 100644 --- a/src/southbridge/intel/common/firmware/Kconfig +++ b/src/southbridge/intel/common/firmware/Kconfig @@ -55,6 +55,14 @@ proceeding with the build, in order to prevent an accidental loading of a corrupted ME/TXE image.
+config ME_REGION_ALLOW_CPU_READ_ACCESS + bool "Allows HOST/CPU read access to ME region" + default n + help + The config ensures Host has read access to the ME region if it is locked + through LOCK_MANAGEMENT_ENGINE config. This config is enabled when the CSE + Lite SKU is integrated. + config USE_ME_CLEANER bool "Strip down the Intel ME/TXE firmware" depends on HAVE_ME_BIN && (NORTHBRIDGE_INTEL_IRONLAKE || \ @@ -145,12 +153,12 @@ config LOCK_MANAGEMENT_ENGINE bool "Lock ME/TXE section" help - The Intel Firmware Descriptor supports preventing write accesses - from the host to the ME or TXE section in the firmware - descriptor. If the section is locked, it can only be overwritten - with an external SPI flash programmer. You will want this if you - want to increase security of your ROM image once you are sure - that the ME/TXE firmware is no longer going to change. + The Intel Firmware Descriptor supports preventing write and read + accesses from the host to the ME or TXE section. If the section + is locked, it can only be overwritten with an external SPI flash + programmer or HECI HMRFPO_ENABLE command needs to be sent to CSE + before writing to the ME Section. If CSE Lite SKU is integrated, + the Kconfig prevents only writing to the ME section.
If unsure, select "Unlock flash regions".
diff --git a/src/southbridge/intel/common/firmware/Makefile.inc b/src/southbridge/intel/common/firmware/Makefile.inc index df9a57f..516cd4d 100644 --- a/src/southbridge/intel/common/firmware/Makefile.inc +++ b/src/southbridge/intel/common/firmware/Makefile.inc @@ -17,6 +17,12 @@ IFDTOOL_USE_CHIPSET := -p $(CONFIG_IFD_CHIPSET) endif
+ifeq ($(CONFIG_ME_REGION_ALLOW_CPU_READ_ACCESS),y) +IFDTOOL_LOCK_ME_MODE := -lr +else +IFDTOOL_LOCK_ME_MODE := -l +endif + add_intel_firmware: $(call strip_quotes,$(CONFIG_IFD_BIN_PATH)) ifeq ($(CONFIG_HAVE_ME_BIN),y) add_intel_firmware: $(call strip_quotes,$(CONFIG_ME_BIN_PATH)) @@ -73,7 +79,7 @@ ifeq ($(CONFIG_LOCK_MANAGEMENT_ENGINE),y) printf " IFDTOOL Locking Management Engine\n" $(objutil)/ifdtool/ifdtool \ - $(IFDTOOL_USE_CHIPSET) -l \ + $(IFDTOOL_USE_CHIPSET) $(IFDTOOL_LOCK_ME_MODE) \ -O $(obj)/coreboot.pre \ $(obj)/coreboot.pre endif
Attention is currently required from: Sridhar Siricilla. Nico Huber has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/48267 )
Change subject: sb/intel/common: Modify CONFIG_LOCK_MANAGEMENT_ENGINE behavior ......................................................................
Patch Set 5:
(1 comment)
File src/southbridge/intel/common/firmware/Kconfig:
https://review.coreboot.org/c/coreboot/+/48267/comment/7bb36401_f73126ff PS5, Line 60: default n This option requires an IFD to make any sense. Please set dependencies appropriately.
Sridhar Siricilla has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/48267 )
Change subject: sb/intel/common: Modify CONFIG_LOCK_MANAGEMENT_ENGINE behavior ......................................................................
Patch Set 5:
(1 comment)
File src/southbridge/intel/common/firmware/Kconfig:
https://review.coreboot.org/c/coreboot/+/48267/comment/8d4888a2_cd7181c7 PS5, Line 60: default n
This option requires an IFD to make any sense. Please set dependencies […]
Agree, without IFDTOOL, it doesn't make any sense. Let me correct this through a patch. Thanks.
Attention is currently required from: Sridhar Siricilla. Tim Wawrzynczak has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/48267 )
Change subject: sb/intel/common: Modify CONFIG_LOCK_MANAGEMENT_ENGINE behavior ......................................................................
Patch Set 5:
(1 comment)
File src/southbridge/intel/common/firmware/Kconfig:
https://review.coreboot.org/c/coreboot/+/48267/comment/21d082e5_2e403466 PS5, Line 60: default n
Agree, without IFDTOOL, it doesn't make any sense. Let me correct this through a patch. Thanks.
Good call Nico, probably depends on LOCK_MANAGEMENT_ENGINE, since it modifies the behavior of it... actually maybe we want to split this out more and make it more granular, e.g., make it simpler to say which flash master can read and/or write which regions.
Sridhar Siricilla has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/48267 )
Change subject: sb/intel/common: Modify CONFIG_LOCK_MANAGEMENT_ENGINE behavior ......................................................................
Patch Set 5:
(1 comment)
File src/southbridge/intel/common/firmware/Kconfig:
https://review.coreboot.org/c/coreboot/+/48267/comment/1746df14_9612f02c PS5, Line 60: default n
Good call Nico, probably depends on LOCK_MANAGEMENT_ENGINE, since it modifies the behavior of it... […]
@TIm, correct, LOCK_MANAGEMENT_ENGINE does more like touching other master's access permissions than it supposed to do. At least we should limit modifying other master access permissions (like ME/GBE/EC etc) when LOCK_MANAGEMENT_ENGINE is selected. For other master access permissions, IFDTool needs to be enhanced to support granular actions. Thoughts?
Attention is currently required from: Sridhar Siricilla. Tim Wawrzynczak has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/48267 )
Change subject: sb/intel/common: Modify CONFIG_LOCK_MANAGEMENT_ENGINE behavior ......................................................................
Patch Set 5:
(1 comment)
File src/southbridge/intel/common/firmware/Kconfig:
https://review.coreboot.org/c/coreboot/+/48267/comment/29561729_4ad4a54a PS5, Line 60: default n
@TIm, correct, LOCK_MANAGEMENT_ENGINE does more like touching other master's access permissions than […]
yes, that was my thought, it would be nice if ifdtool was able to support setting SPI Flash read & write master permissions for all masters (cpu, me, gbe, ec), but that's not urgent right now. Let's fix the dependencies here first.
Sridhar Siricilla has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/48267 )
Change subject: sb/intel/common: Modify CONFIG_LOCK_MANAGEMENT_ENGINE behavior ......................................................................
Patch Set 5:
(1 comment)
File src/southbridge/intel/common/firmware/Kconfig:
https://review.coreboot.org/c/coreboot/+/48267/comment/b0b747fc_d9aef683 PS5, Line 60: default n
yes, that was my thought, it would be nice if ifdtool was able to support setting SPI Flash read & w […]
Ack