Change in coreboot[master]: util/ifdtool: Enable CPU read of the ME region

[Patrick Georgi (Code Review)]

Patrick Georgi has submitted this change. ( https://review.coreboot.org/c/coreboot/+/46441 )

Change subject: util/ifdtool: Enable CPU read of the ME region
......................................................................

util/ifdtool: Enable CPU read of the ME region

We are implementing a mechanism in coreboot to update CSME firmware,
this requires coreboot to be able to read CSME region. Exposing the
CSME data is not an issue since the data stored by CSE is all encrypted.

This patch provides a command line option "-r" which will enable read
access to CSME region when locking.

Without this change, locking SPI regions using ifdtool will block BIOS
access to read/access CSME. This will cause failure since BIOS can't
read basic information such as CSME version.

TEST=Flashrom returns success while erasing the SI_ME region.
After rebooting the DUT, DUT boots into OS without any issues on
Drawlat EVT.

Signed-off-by: Usha P 
Change-Id: I1d9a8e17fba19b717453476fbcb7bcf95b278abe
Reviewed-on: https://review.coreboot.org/c/coreboot/+/46441
Tested-by: build bot (Jenkins) 
Reviewed-by: Rizwan Qureshi 
Reviewed-by: Maulik V Vaghela 
Reviewed-by: Subrata Banik 
Reviewed-by: Angel Pons 
---
M util/ifdtool/ifdtool.c
1 file changed, 29 insertions(+), 2 deletions(-)

Approvals:
  build bot (Jenkins): Verified
  Rizwan Qureshi: Looks good to me, approved
  Subrata Banik: Looks good to me, approved
  Maulik V Vaghela: Looks good to me, approved
  Angel Pons: Looks good to me, but someone else must approve

diff --git a/util/ifdtool/ifdtool.c b/util/ifdtool/ifdtool.c
index 93f6f3f..7dbed66 100644
--- a/util/ifdtool/ifdtool.c
+++ b/util/ifdtool/ifdtool.c
@@ -1266,6 +1266,25 @@
    write_image(filename, image, size);
 }

+static void enable_cpu_read_me(const char *filename, char *image, int size)
+{
+	int rd_shift;
+	fmba_t *fmba = find_fmba(image, size);
+
+	if (!fmba)
+		exit(EXIT_FAILURE);
+
+	if (ifd_version >= IFD_VERSION_2)
+		rd_shift = FLMSTR_RD_SHIFT_V2;
+	else
+		rd_shift = FLMSTR_RD_SHIFT_V1;
+
+	/* CPU/BIOS can read ME. */
+	fmba->flmstr1 |= (1 << REGION_ME) << rd_shift;
+
+	write_image(filename, image, size);
+}
+
 static void unlock_descriptor(const char *filename, char *image, int size)
 {
    fmba_t *fmba = find_fmba(image, size);
@@ -1626,6 +1645,7 @@
           "   -e | --em100                          set SPI frequency to 20MHz and disable\n"
           "                                         Dual Output Fast Read Support\n"
           "   -l | --lock                           Lock firmware descriptor and ME region\n"
+	       "   -r | --read				 Enable CPU/BIOS read access for ME region\n"
           "   -u | --unlock                         Unlock firmware descriptor and ME region\n"
           "   -M | --altmedisable <0|1>             Set the MeDisable and AltMeDisable (or HAP for skylake or newer platform)\n"
           "                                         bits to disable ME\n"
@@ -1652,7 +1672,7 @@
    int mode_dump = 0, mode_extract = 0, mode_inject = 0, mode_spifreq = 0;
    int mode_em100 = 0, mode_locked = 0, mode_unlocked = 0, mode_validate = 0;
    int mode_layout = 0, mode_newlayout = 0, mode_density = 0, mode_setstrap = 0;
-	int mode_altmedisable = 0, altmedisable = 0;
+	int mode_read = 0, mode_altmedisable = 0, altmedisable = 0;
    char *region_type_string = NULL, *region_fname = NULL;
    const char *layout_fname = NULL;
    char *new_filename = NULL;
@@ -1675,6 +1695,7 @@
    	{"altmedisable", 1, NULL, 'M'},
    	{"em100", 0, NULL, 'e'},
    	{"lock", 0, NULL, 'l'},
+		{"read", 0, NULL, 'r'},
    	{"unlock", 0, NULL, 'u'},
    	{"version", 0, NULL, 'v'},
    	{"help", 0, NULL, 'h'},
@@ -1685,7 +1706,7 @@
    	{0, 0, 0, 0}
    };

-	while ((opt = getopt_long(argc, argv, "S:V:df:D:C:M:xi:n:O:s:p:eluvth?",
+	while ((opt = getopt_long(argc, argv, "S:V:df:D:C:M:xi:n:O:s:p:elruvth?",
    			  long_options, &option_index)) != EOF) {
    	switch (opt) {
    	case 'd':
@@ -1859,6 +1880,9 @@
    			exit(EXIT_FAILURE);
    		}
    		break;
+		case 'r':
+			mode_read = 1;
+			break;
    	case 'u':
    		mode_unlocked = 1;
    		if (mode_locked == 1) {
@@ -2000,6 +2024,9 @@
    if (mode_locked)
    	lock_descriptor(new_filename, image, size);

+	if (mode_read)
+		enable_cpu_read_me(new_filename, image, size);
+
    if (mode_unlocked)
    	unlock_descriptor(new_filename, image, size);