coreboot/default: add --nuke flag to ifdtool

e.g.

./ifdtool --nuke me coreboot.rom

this will be used by rom release build scripts, to scrub
stuff like intel me from the rom

resources/coreboot/default/patches/0001-apple-macbook21-Set-default-VRAM-to-64MiB-instead-of.patch

@@ -1,7 +1,7 @@
-From 087327fa0513b27be0487a4dd8fbf4c3c783cf12 Mon Sep 17 00:00:00 2001
+From 852c6bfbd599460983ad864db019d1b60be35296 Mon Sep 17 00:00:00 2001
 From: Leah Rowe <leah@retroboot.org>
 Date: Fri, 19 Mar 2021 05:54:58 +0000
-Subject: [PATCH 01/14] apple/macbook21: Set default VRAM to 64MiB instead of
+Subject: [PATCH 01/17] apple/macbook21: Set default VRAM to 64MiB instead of
  8MiB
 
 ---

resources/coreboot/default/patches/0002-add-c3-and-clockgen-to-apple-macbook21.patch

@@ -1,7 +1,7 @@
-From 7f5cdb1b4677cacc396ac62dd4f62b600d1a324a Mon Sep 17 00:00:00 2001
+From 82418ef368b7876fb1199b5e77139e2cef411250 Mon Sep 17 00:00:00 2001
 From: Vitali64 <5405891-vitali64yt@users.noreply.gitlab.com>
 Date: Wed, 27 Oct 2021 13:36:01 +0200
-Subject: [PATCH 02/14] add c3 and clockgen to apple/macbook21
+Subject: [PATCH 02/17] add c3 and clockgen to apple/macbook21
 
 ---
  src/mainboard/apple/macbook21/Kconfig       |  1 +

resources/coreboot/default/patches/0003-lenovo-x60-64MiB-Video-RAM-changed-to-default-previo.patch

@@ -1,7 +1,7 @@
-From 1582b3d799e43dc44f92d4e043ac2f86cfd1bd86 Mon Sep 17 00:00:00 2001
+From 54e80b550f86cd08136242f0519053d63a1e4bfd Mon Sep 17 00:00:00 2001
 From: Leah Rowe <leah@osboot.org>
 Date: Sun, 3 Jan 2021 03:34:01 +0000
-Subject: [PATCH 03/14] lenovo/x60: 64MiB Video RAM changed to default
+Subject: [PATCH 03/17] lenovo/x60: 64MiB Video RAM changed to default
  (previously it was 8MiB)
 
 ---

resources/coreboot/default/patches/0004-lenovo-t60-make-64MiB-VRAM-the-default-in-cmos.defau.patch

@@ -1,7 +1,7 @@
-From 0fb538599c46a4e7f950c57b67b2d8c0d92200f4 Mon Sep 17 00:00:00 2001
+From 48c0fbea2d0f4be7860205dad5db07f00b1b0a78 Mon Sep 17 00:00:00 2001
 From: Leah Rowe <leah@osboot.org>
 Date: Mon, 22 Feb 2021 22:16:59 +0000
-Subject: [PATCH 04/14] lenovo/t60: make 64MiB VRAM the default in cmos.default
+Subject: [PATCH 04/17] lenovo/t60: make 64MiB VRAM the default in cmos.default
 
 ---
  src/mainboard/lenovo/t60/cmos.default | 2 +-

resources/coreboot/default/patches/0005-lenovo-t400-set-VRAM-to-352MiB-VRAM-by-default.patch

@@ -1,7 +1,7 @@
-From 702e80f25436126f0b157dff95a90fdbe318c2c5 Mon Sep 17 00:00:00 2001
+From 21b3f3773dcb50cef81690d6648e804814e573a4 Mon Sep 17 00:00:00 2001
 From: Leah Rowe <leah@libreboot.org>
 Date: Fri, 14 May 2021 13:10:33 +0100
-Subject: [PATCH 05/14] lenovo/t400: set VRAM to 352MiB VRAM by default
+Subject: [PATCH 05/17] lenovo/t400: set VRAM to 352MiB VRAM by default
 
 In the past, this caused stability issues so we set it to 256MiB. Nowadays,
 coreboot has fixed the issue preventing this. See:

resources/coreboot/default/patches/0006-lenovo-x200-set-VRAM-to-352MiB-by-default.patch

@@ -1,7 +1,7 @@
-From d9d2e1fceb4abf99e140662a25059c6e913556de Mon Sep 17 00:00:00 2001
+From f1d4dab6fc8e86c59ae1b65c51d812d4605972cf Mon Sep 17 00:00:00 2001
 From: Leah Rowe <leah@libreboot.org>
 Date: Fri, 14 May 2021 13:11:59 +0100
-Subject: [PATCH 06/14] lenovo/x200: set VRAM to 352MiB by default
+Subject: [PATCH 06/17] lenovo/x200: set VRAM to 352MiB by default
 
 This fix makes it possible:
 https://review.coreboot.org/c/coreboot/+/16831

resources/coreboot/default/patches/0007-gigabyte-ga-g41m-es2l-set-VRAM-to-352MiB-by-default.patch

@@ -1,7 +1,7 @@
-From b69a04a9ec173a431507e35e70f150fbd864fde3 Mon Sep 17 00:00:00 2001
+From 7e51411400fd71ebaf2b90c22a778227c275bb22 Mon Sep 17 00:00:00 2001
 From: Leah Rowe <leah@libreboot.org>
 Date: Fri, 14 May 2021 13:18:26 +0100
-Subject: [PATCH 07/14] gigabyte/ga-g41m-es2l: set VRAM to 352MiB by default
+Subject: [PATCH 07/17] gigabyte/ga-g41m-es2l: set VRAM to 352MiB by default
 
 ---
  src/mainboard/gigabyte/ga-g41m-es2l/cmos.default | 2 +-

resources/coreboot/default/patches/0008-acer-g43t-am3-set-VRAM-to-352MiB-by-default.patch

@@ -1,7 +1,7 @@
-From 5409b84b222f4f04238dcafb7411986692909098 Mon Sep 17 00:00:00 2001
+From add3b218110aa54a8aa89a0ea7c20ab58d5c7a47 Mon Sep 17 00:00:00 2001
 From: Leah Rowe <leah@libreboot.org>
 Date: Fri, 14 May 2021 13:21:39 +0100
-Subject: [PATCH 08/14] acer/g43t-am3: set VRAM to 352MiB by default
+Subject: [PATCH 08/17] acer/g43t-am3: set VRAM to 352MiB by default
 
 ---
  src/mainboard/acer/g43t-am3/cmos.default | 2 +-

resources/coreboot/default/patches/0009-lenovo-t400-Enable-all-SATA-ports.patch

@@ -1,7 +1,7 @@
-From 1c3812ccecef2b22379e4999666de95cd7f38acf Mon Sep 17 00:00:00 2001
+From 967ef36a3f3cf5efaf92235905ab4a6b5a878d01 Mon Sep 17 00:00:00 2001
 From: persmule <persmule@gmail.com>
 Date: Sun, 31 Oct 2021 23:33:26 +0000
-Subject: [PATCH 09/14] lenovo/t400: Enable all SATA ports
+Subject: [PATCH 09/17] lenovo/t400: Enable all SATA ports
 
 There are 2 SATA ports on the chassis of t400(s), but at least one dock for
 t400 contains a port for (P/S)ATA device, and t400s has a eSATA port on its

resources/coreboot/default/patches/0010-coreboot-Add-Lenovo-X230-patch-gfx_uma_size-224M-by-.patch

@@ -1,7 +1,7 @@
-From d35656413f27f37b0d7680f6ed0a2b1aac31b982 Mon Sep 17 00:00:00 2001
+From 990717f4bed5ff0bcf89e7f583251c76f6cf5559 Mon Sep 17 00:00:00 2001
 From: Leah Rowe <leah@libreboot.org>
 Date: Mon, 20 Dec 2021 01:29:31 +0000
-Subject: [PATCH 10/14] coreboot: Add Lenovo X230 patch: gfx_uma_size 224M by
+Subject: [PATCH 10/17] coreboot: Add Lenovo X230 patch: gfx_uma_size 224M by
  default
 
 ---

resources/coreboot/default/patches/0011-lenovo-x230-set-me_state-Disabled-in-cmos.default.patch

@@ -1,7 +1,7 @@
-From 0f2cd8edad3326a8c9f3b785efbda395d1c8cde9 Mon Sep 17 00:00:00 2001
+From a069b42f28f22e6377d0ddcc5984cd191ab196f0 Mon Sep 17 00:00:00 2001
 From: Leah Rowe <leah@libreboot.org>
 Date: Mon, 3 Jan 2022 19:06:22 +0000
-Subject: [PATCH 11/14] lenovo/x230: set me_state=Disabled in cmos.default
+Subject: [PATCH 11/17] lenovo/x230: set me_state=Disabled in cmos.default
 
 I only recently found out about this. It's possible to use me_cleaner to
 do the same thing, but some people might just flash coreboot and not do

resources/coreboot/default/patches/0012-set-me_state-Disabled-on-all-cmos.default-files.patch

@@ -1,7 +1,7 @@
-From 694fac8e25949c20de421ee1b199a16b94c202e5 Mon Sep 17 00:00:00 2001
+From 3be4cad0bd43fe33cd62f22ed7b89433232d4ed7 Mon Sep 17 00:00:00 2001
 From: Leah Rowe <leah@libreboot.org>
 Date: Wed, 2 Mar 2022 21:50:01 +0000
-Subject: [PATCH 12/14] set me_state=Disabled on all cmos.default files!
+Subject: [PATCH 12/17] set me_state=Disabled on all cmos.default files!
 
 yeah. why the hell isn't this the default
 ---

resources/coreboot/default/patches/0013-specifically-use-python3-in-scripts.patch

@@ -1,7 +1,7 @@
-From 4106d0163987ae926a7f4261dec06e3e8bf85ff0 Mon Sep 17 00:00:00 2001
+From 45c2ae2e2885aedd8a75de077bf4cbbcf5b87a87 Mon Sep 17 00:00:00 2001
 From: Leah Rowe <leah@libreboot.org>
 Date: Sun, 13 Mar 2022 18:04:55 +0000
-Subject: [PATCH 13/14] specifically use python3, in scripts
+Subject: [PATCH 13/17] specifically use python3, in scripts
 
 ---
  src/drivers/intel/fsp2_0/Makefile.inc | 2 +-

resources/coreboot/default/patches/0014-coreboot-default-fix-crossgcc-build.patch

@@ -1,7 +1,7 @@
-From 9837b542ee2ff56032950b211e60e1e180343f44 Mon Sep 17 00:00:00 2001
+From d89a5c66a0150bb6a2e82c685915b2c8a44cb9ed Mon Sep 17 00:00:00 2001
 From: Leah Rowe <leah@libreboot.org>
 Date: Sat, 19 Nov 2022 03:30:34 +0000
-Subject: [PATCH 14/14] coreboot/default: fix crossgcc build
+Subject: [PATCH 14/17] coreboot/default: fix crossgcc build
 
 patch copied from
 coreboot f9b5665d280faa35c6b41fe0c48a9e9e1afd634b

resources/coreboot/default/patches/0015-lenovo-x230-introduce-FHD-variant.patch

@@ -1,7 +1,7 @@
-From 06fe32bb5f65c784e7819b875c505fcceab11b99 Mon Sep 17 00:00:00 2001
+From 495555d383345124d7b45b8e2c8feb38153b9f7e Mon Sep 17 00:00:00 2001
 From: Alexander Couzens <lynxis@fe80.eu>
 Date: Sat, 19 Mar 2022 13:42:33 +0000
-Subject: [PATCH] lenovo/x230: introduce FHD variant
+Subject: [PATCH 15/17] lenovo/x230: introduce FHD variant
 
 There is a modification for the x230 which uses the 2nd DP from the dock
 as the integrated panel's connection, which allows using a custom eDP
@@ -44,7 +44,7 @@ Signed-off-by: Felix Singer <felixsinger@posteo.net>
  create mode 100644 src/mainboard/lenovo/x230/variants/x230_edp/gma-mainboard.ads
 
 diff --git a/src/mainboard/lenovo/x230/Kconfig b/src/mainboard/lenovo/x230/Kconfig
-index a6fd796206..7aa5af6d85 100644
+index cafdead858..b8cae24199 100644
 --- a/src/mainboard/lenovo/x230/Kconfig
 +++ b/src/mainboard/lenovo/x230/Kconfig
 @@ -1,4 +1,4 @@

resources/coreboot/default/patches/0016-lenovo-x230-fix-the-data.vbt-path-for-the-EDP-varian.patch

@@ -1,7 +1,7 @@
-From 62cd7b24205122d366526aea1e3ad0c15ec8210f Mon Sep 17 00:00:00 2001
+From 27f963913d9afc6da15043c6e8b224c9b1a727ac Mon Sep 17 00:00:00 2001
 From: Alexei Sorokin <sor.alexei@meowr.ru>
 Date: Sun, 27 Nov 2022 18:36:26 +0300
-Subject: [PATCH] lenovo/x230: fix the data.vbt path for the EDP variant
+Subject: [PATCH 16/17] lenovo/x230: fix the data.vbt path for the EDP variant
 
 ---
  src/mainboard/lenovo/x230/Kconfig | 3 ---

resources/coreboot/default/patches/0017-util-ifdtool-add-nuke-flag-all-0xFF-on-region.patch

@@ -0,0 +1,183 @@
+From 0cf2eee19eef5270410d054cf8e26a8be99245a8 Mon Sep 17 00:00:00 2001
+From: Leah Rowe <leah@libreboot.org>
+Date: Sun, 4 Dec 2022 22:35:01 +0000
+Subject: [PATCH 17/17] util/ifdtool: add --nuke flag (all 0xFF on region)
+
+When this option is used, the region's contents are overwritten
+with all ones (0xFF).
+
+Example:
+
+./ifdtool --nuke gbe coreboot.rom
+./ifdtool --nuke bios coreboot.com
+./ifdtool --nuke me coreboot.com
+---
+ util/ifdtool/ifdtool.c | 98 ++++++++++++++++++++++++++++++++----------
+ 1 file changed, 76 insertions(+), 22 deletions(-)
+
+diff --git a/util/ifdtool/ifdtool.c b/util/ifdtool/ifdtool.c
+index ca5d3b8d21..8ba1335772 100644
+--- a/util/ifdtool/ifdtool.c
++++ b/util/ifdtool/ifdtool.c
+@@ -1640,19 +1640,68 @@ static void print_usage(const char *name)
+ 	       "                                         tgl    - Tiger Lake\n"
+ 	       "   -S | --setpchstrap                    Write a PCH strap\n"
+ 	       "   -V | --newvalue                       The new value to write into PCH strap specified by -S\n"
++	       "   -N | --nuke <region>                  Overwrite the specified region with 0xFF (all ones)\n"
+ 	       "   -v | --version:                       print the version\n"
+ 	       "   -h | --help:                          print this help\n\n"
+ 	       "<region> is one of Descriptor, BIOS, ME, GbE, Platform, res1, res2, res3\n"
+ 	       "\n");
+ }
+ 
++static int
++get_region_type_string(const char *region_type_string)
++{
++	if (region_type_string == NULL)
++		return -1;
++	else if (!strcasecmp("Descriptor", region_type_string))
++		return 0;
++	else if (!strcasecmp("BIOS", region_type_string))
++		return 1;
++	else if (!strcasecmp("ME", region_type_string))
++		return 2;
++	else if (!strcasecmp("GbE", region_type_string))
++		return 3;
++	else if (!strcasecmp("Platform", region_type_string))
++		return 4;
++	else if (!strcasecmp("res1", region_type_string))
++		return 5;
++	else if (!strcasecmp("res2", region_type_string))
++		return 6;
++	else if (!strcasecmp("res3", region_type_string))
++		return 7;
++	else if (!strcasecmp("EC", region_type_string))
++		return 8;
++	else
++		return -1;
++}
++
++
++static void
++nuke(const char *filename, char *image, int size, int region_type)
++{
++	int i;
++	region_t region;
++	const frba_t *frba = find_frba(image, size);
++	if (!frba)
++		exit(EXIT_FAILURE);
++
++	region = get_region(frba, region_type);
++	if (region.size > 0) {
++		for (i = region.base; i <= region.limit; i++) {
++			if ((i + 1) > (size))
++				break;
++			image[i] = 0xFF;
++		}
++		write_image(filename, image, size);
++	}
++}
++
+ int main(int argc, char *argv[])
+ {
+ 	int opt, option_index = 0;
+ 	int mode_dump = 0, mode_extract = 0, mode_inject = 0, mode_spifreq = 0;
+ 	int mode_em100 = 0, mode_locked = 0, mode_unlocked = 0, mode_validate = 0;
+ 	int mode_layout = 0, mode_newlayout = 0, mode_density = 0, mode_setstrap = 0;
+-	int mode_read = 0, mode_altmedisable = 0, altmedisable = 0;
++	int mode_read = 0, mode_altmedisable = 0, altmedisable = 0, mode_nuke = 0;
+ 	char *region_type_string = NULL, *region_fname = NULL;
+ 	const char *layout_fname = NULL;
+ 	char *new_filename = NULL;
+@@ -1683,6 +1732,7 @@ int main(int argc, char *argv[])
+ 		{"validate", 0, NULL, 't'},
+ 		{"setpchstrap", 1, NULL, 'S'},
+ 		{"newvalue", 1, NULL, 'V'},
++		{"nuke", 1, NULL, 'N'},
+ 		{0, 0, 0, 0}
+ 	};
+ 
+@@ -1723,25 +1773,8 @@ int main(int argc, char *argv[])
+ 			region_fname++;
+ 			// Descriptor, BIOS, ME, GbE, Platform
+ 			// valid type?
+-			if (!strcasecmp("Descriptor", region_type_string))
+-				region_type = 0;
+-			else if (!strcasecmp("BIOS", region_type_string))
+-				region_type = 1;
+-			else if (!strcasecmp("ME", region_type_string))
+-				region_type = 2;
+-			else if (!strcasecmp("GbE", region_type_string))
+-				region_type = 3;
+-			else if (!strcasecmp("Platform", region_type_string))
+-				region_type = 4;
+-			else if (!strcasecmp("res1", region_type_string))
+-				region_type = 5;
+-			else if (!strcasecmp("res2", region_type_string))
+-				region_type = 6;
+-			else if (!strcasecmp("res3", region_type_string))
+-				region_type = 7;
+-			else if (!strcasecmp("EC", region_type_string))
+-				region_type = 8;
+-			if (region_type == -1) {
++			if ((region_type =
++			    get_region_type_string(region_type_string)) == -1) {
+ 				fprintf(stderr, "No such region type: '%s'\n\n",
+ 					region_type_string);
+ 				print_usage(argv[0]);
+@@ -1900,6 +1933,22 @@ int main(int argc, char *argv[])
+ 		case 't':
+ 			mode_validate = 1;
+ 			break;
++		case 'N':
++			region_type_string = strdup(optarg);
++			if (!region_type_string) {
++				fprintf(stderr, "No region specified\n");
++				print_usage(argv[0]);
++				exit(EXIT_FAILURE);
++			}
++			if ((region_type =
++			    get_region_type_string(region_type_string)) == -1) {
++				fprintf(stderr, "No such region type: '%s'\n\n",
++					region_type_string);
++				print_usage(argv[0]);
++				exit(EXIT_FAILURE);
++			}
++			mode_nuke = 1;
++			break;
+ 		case 'v':
+ 			print_version();
+ 			exit(EXIT_SUCCESS);
+@@ -1915,7 +1964,7 @@ int main(int argc, char *argv[])
+ 
+ 	if ((mode_dump + mode_layout + mode_extract + mode_inject + mode_setstrap +
+ 		mode_newlayout + (mode_spifreq | mode_em100 | mode_unlocked |
+-		 mode_locked) + mode_altmedisable + mode_validate) > 1) {
++		 mode_locked) + mode_altmedisable + mode_validate + mode_nuke) > 1) {
+ 		fprintf(stderr, "You may not specify more than one mode.\n\n");
+ 		print_usage(argv[0]);
+ 		exit(EXIT_FAILURE);
+@@ -1923,7 +1972,8 @@ int main(int argc, char *argv[])
+ 
+ 	if ((mode_dump + mode_layout + mode_extract + mode_inject + mode_setstrap +
+ 	     mode_newlayout + mode_spifreq + mode_em100 + mode_locked +
+-	     mode_unlocked + mode_density + mode_altmedisable + mode_validate) == 0) {
++	     mode_unlocked + mode_density + mode_altmedisable + mode_validate +
++	     mode_nuke) == 0) {
+ 		fprintf(stderr, "You need to specify a mode.\n\n");
+ 		print_usage(argv[0]);
+ 		exit(EXIT_FAILURE);
+@@ -2021,6 +2071,10 @@ int main(int argc, char *argv[])
+ 		write_image(new_filename, image, size);
+ 	}
+ 
++	if (mode_nuke) {
++		nuke(new_filename, image, size, region_type);
++	}
++
+ 	if (mode_altmedisable) {
+ 		fpsba_t *fpsba = find_fpsba(image, size);
+ 		fmsba_t *fmsba = find_fmsba(image, size);
+-- 
+2.25.1
+