ish: Trim down the release branchstabilize-wristpin-14469.59.B-ishstabilize-voshyr-14637.B-ishstabilize-quickfix-14695.187.B-ishstabilize-quickfix-14695.124.B-ishstabilize-quickfix-14526.91.B-ishstabilize-14695.85.B-ishstabilize-14695.107.B-ishstabilize-14682.B-ishstabilize-14633.B-ishstabilize-14616.B-ishstabilize-14589.B-ishstabilize-14588.98.B-ishstabilize-14588.14.B-ishstabilize-14588.123.B-ishstabilize-14536.B-ishstabilize-14532.B-ishstabilize-14528.B-ishstabilize-14526.89.B-ishstabilize-14526.84.B-ishstabilize-14526.73.B-ishstabilize-14526.67.B-ishstabilize-14526.57.B-ishstabilize-14498.B-ishstabilize-14496.B-ishstabilize-14477.B-ishstabilize-14469.9.B-ishstabilize-14469.8.B-ishstabilize-14469.58.B-ishstabilize-14469.41.B-ishstabilize-14442.B-ishstabilize-14438.B-ishstabilize-14411.B-ishstabilize-14396.B-ishstabilize-14395.B-ishstabilize-14388.62.B-ishstabilize-14388.61.B-ishstabilize-14388.52.B-ishstabilize-14385.B-ishstabilize-14345.B-ishstabilize-14336.B-ishstabilize-14333.B-ishrelease-R99-14469.B-ishrelease-R98-14388.B-ishrelease-R102-14695.B-ishrelease-R101-14588.B-ishrelease-R100-14526.B-ishfirmware-cherry-14454.B-ishfirmware-brya-14505.B-ishfirmware-brya-14505.71.B-ishfactory-kukui-14374.B-ishfactory-guybrush-14600.B-ishfactory-cherry-14455.B-ishfactory-brya-14517.B-ish

In the interest of making long-term branch maintenance incur as little
technical debt on us as possible, we should not maintain any files on
the branch we are not actually using.

This has the added effect of making it extremely clear when merging CLs
from the main branch when changes have the possibility to affect us.

The follow-on CL adds a convenience script to actually pull updates from
the main branch and generate a CL for the update.

BUG=b:204206272
BRANCH=ish
TEST=make BOARD=arcada_ish && make BOARD=drallion_ish

Signed-off-by: Jack Rosenthal <jrosenth@chromium.org>
Change-Id: I17e4694c38219b5a0823e0a3e55a28d1348f4b18
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/ec/+/3262038
Reviewed-by: Jett Rink <jettrink@chromium.org>
Reviewed-by: Tom Hughes <tomhughes@chromium.org>

4 files changed, 0 insertions, 746 deletions

diff --git a/common/vboot/common.c b/common/vboot/common.c
deleted file mode 100644
index 39f8c193c7..0000000000
--- a/common/vboot/common.c
+++ /dev/null
@@ -1,58 +0,0 @@
-/* Copyright 2017 The Chromium OS Authors. All rights reserved.
- * Use of this source code is governed by a BSD-style license that can be
- * found in the LICENSE file.
- */
-
-#include "common.h"
-#include "console.h"
-#include "rsa.h"
-#include "sha256.h"
-#include "shared_mem.h"
-#include "vboot.h"
-
-#define CPRINTS(format, args...) cprints(CC_VBOOT, format, ## args)
-#define CPRINTF(format, args...) cprintf(CC_VBOOT, format, ## args)
-
-int vboot_is_padding_valid(const uint8_t *data, uint32_t start, uint32_t end)
-{
-	const uint32_t *data32 = (const uint32_t *)data;
-	int i;
-
-	if (start > end)
-		return EC_ERROR_INVAL;
-
-	if (start % 4 || end % 4)
-		return EC_ERROR_INVAL;
-
-	for (i = start / 4; i < end / 4; i++) {
-		if (data32[i] != 0xffffffff)
-			return EC_ERROR_INVAL;
-	}
-
-	return EC_SUCCESS;
-}
-
-int vboot_verify(const uint8_t *data, int len,
-		 const struct rsa_public_key *key, const uint8_t *sig)
-{
-	struct sha256_ctx ctx;
-	uint8_t *hash;
-	uint32_t *workbuf;
-	int err = EC_SUCCESS;
-
-	if (SHARED_MEM_ACQUIRE_CHECK(3 * RSANUMBYTES, (char **)&workbuf))
-		return EC_ERROR_MEMORY_ALLOCATION;
-
-	/* Compute hash of the RW firmware */
-	SHA256_init(&ctx);
-	SHA256_update(&ctx, data, len);
-	hash = SHA256_final(&ctx);
-
-	/* Verify the data */
-	if (rsa_verify(key, sig, hash, workbuf) != 1)
-		err = EC_ERROR_VBOOT_DATA_VERIFY;
-
-	shared_mem_release(workbuf);
-
-	return err;
-}
diff --git a/common/vboot/efs2.c b/common/vboot/efs2.c
deleted file mode 100644
index e5c3b64f04..0000000000
--- a/common/vboot/efs2.c
+++ /dev/null
@@ -1,352 +0,0 @@
-/* Copyright 2020 The Chromium OS Authors. All rights reserved.
- * Use of this source code is governed by a BSD-style license that can be
- * found in the LICENSE file.
- */
-
-/*
- * Early Firmware Selection ver.2.
- *
- * Verify and jump to a RW image. Register boot mode to Cr50.
- */
-
-#include "battery.h"
-#include "chipset.h"
-#include "clock.h"
-#include "compile_time_macros.h"
-#include "console.h"
-#include "crc8.h"
-#include "flash.h"
-#include "hooks.h"
-#include "sha256.h"
-#include "system.h"
-#include "task.h"
-#include "usb_pd.h"
-#include "uart.h"
-#include "vboot.h"
-#include "vboot_hash.h"
-
-#define CPRINTS(format, args...) cprints(CC_VBOOT,"VB " format, ## args)
-#define CPRINTF(format, args...) cprintf(CC_VBOOT,"VB " format, ## args)
-
-static const char *boot_mode_to_string(uint8_t mode)
-{
-	static const char *boot_mode_str[] = {
-		[BOOT_MODE_NORMAL] =		"NORMAL",
-		[BOOT_MODE_NO_BOOT] =		"NO_BOOT",
-	};
-	if (mode < ARRAY_SIZE(boot_mode_str))
-		return boot_mode_str[mode];
-	return "UNDEF";
-}
-
-/*
- * Check whether the session has successfully ended or not. ERR_TIMEOUT is
- * excluded because it's an internal error produced by EC itself.
- */
-static bool is_valid_cr50_response(enum cr50_comm_err code)
-{
-	return code != CR50_COMM_ERR_TIMEOUT
-			&& (code >> 8) == CR50_COMM_ERR_PREFIX;
-}
-
-__overridable void board_enable_packet_mode(bool enable)
-{
-	/*
-	 * This can be done by set_flags(INPUT|PULL_UP). We don't need it now
-	 * because Cr50 never initiates communication.
-	 */
-	gpio_set_level(GPIO_PACKET_MODE_EN, enable ? 1 : 0);
-}
-
-static enum cr50_comm_err send_to_cr50(const uint8_t *data, size_t size)
-{
-	timestamp_t until;
-	int i, timeout = 0;
-	uint32_t lock_key;
-	struct cr50_comm_response res = {};
-
-	/* This will wake up (if it's sleeping) and interrupt Cr50. */
-	board_enable_packet_mode(true);
-
-	uart_flush_output();
-	uart_clear_input();
-
-	if (uart_shell_stop()) {
-		/* Failed to stop the shell. */
-		board_enable_packet_mode(false);
-		return CR50_COMM_ERR_UNKNOWN;
-	}
-
-	/*
-	 * Send packet. No traffic control, assuming Cr50 consumes stream much
-	 * faster. TX buffer shouldn't overflow because it's cleared above and
-	 * much bigger than the max packet size.
-	 *
-	 * Disable interrupts so that the data frame will be stored in the Tx
-	 * buffer in one piece.
-	 */
-	lock_key = irq_lock();
-	uart_put_raw(data, size);
-	irq_unlock(lock_key);
-
-	uart_flush_output();
-
-	until.val = get_time().val + CR50_COMM_TIMEOUT;
-
-	/*
-	 * Make sure console task won't steal the response in case we exchange
-	 * packets after tasks start.
-	 */
-#ifndef CONFIG_ZEPHYR
-	if (task_start_called())
-		task_disable_task(TASK_ID_CONSOLE);
-#endif /* !CONFIG_ZEPHYR */
-
-	/* Wait for response from Cr50 */
-	for (i = 0; i < sizeof(res); i++) {
-		while (!timeout) {
-			int c = uart_getc();
-			if (c != -1) {
-				res.error = res.error | c << (i*8);
-				break;
-			}
-			msleep(1);
-			timeout = timestamp_expired(until, NULL);
-		}
-	}
-
-	uart_shell_start();
-#ifndef CONFIG_ZEPHYR
-	if (task_start_called())
-		task_enable_task(TASK_ID_CONSOLE);
-#endif /* CONFIG_ZEPHYR */
-
-	/* Exit packet mode */
-	board_enable_packet_mode(false);
-
-	CPRINTS("Received 0x%04x", res.error);
-
-	if (timeout) {
-		CPRINTS("Timeout");
-		return CR50_COMM_ERR_TIMEOUT;
-	}
-
-	return res.error;
-}
-
-static enum cr50_comm_err cmd_to_cr50(enum cr50_comm_cmd cmd,
-				      const uint8_t *data, size_t size)
-{
-	/*
-	 * This is on the stack instead of .bss because vboot_main currently is
-	 * called only once (from main). Keeping the space unused in .bss would
-	 * be wasteful.
-	 */
-	struct {
-		uint8_t preamble[CR50_UART_RX_BUFFER_SIZE];
-		uint8_t packet[CR50_COMM_MAX_REQUEST_SIZE];
-	} __packed s;
-	struct cr50_comm_request *p = (struct cr50_comm_request *)s.packet;
-	int retry = CR50_COMM_MAX_RETRY;
-	enum cr50_comm_err rv;
-
-	/* compose a frame = preamble + packet */
-	memset(s.preamble, CR50_COMM_PREAMBLE, sizeof(s.preamble));
-	p->magic = CR50_PACKET_MAGIC;
-	p->struct_version = CR50_COMM_PACKET_VERSION;
-	p->type = cmd;
-	p->size = size;
-	memcpy(p->data, data, size);
-	p->crc = cros_crc8((uint8_t *)&p->type,
-		      sizeof(p->type) + sizeof(p->size) + size);
-
-	do {
-		rv = send_to_cr50((uint8_t *)&s,
-				  sizeof(s.preamble) + sizeof(*p) + p->size);
-		if (is_valid_cr50_response(rv))
-			break;
-		msleep(5);
-	} while (--retry);
-
-	return rv;
-}
-
-static enum cr50_comm_err verify_hash(void)
-{
-	const uint8_t *hash;
-	int rv;
-
-	/* Wake up Cr50 beforehand in case it's asleep. */
-	board_enable_packet_mode(true);
-	CPRINTS("Ping Cr50");
-	msleep(1);
-	board_enable_packet_mode(false);
-
-	rv = vboot_get_rw_hash(&hash);
-	if (rv)
-		return rv;
-
-	CPRINTS("Verifying hash");
-	return cmd_to_cr50(CR50_COMM_CMD_VERIFY_HASH, hash, SHA256_DIGEST_SIZE);
-}
-
-static enum cr50_comm_err set_boot_mode(uint8_t mode)
-{
-	enum cr50_comm_err rv;
-
-	CPRINTS("Setting boot mode to %s(%d)", boot_mode_to_string(mode), mode);
-	rv = cmd_to_cr50(CR50_COMM_CMD_SET_BOOT_MODE,
-			 &mode, sizeof(enum boot_mode));
-	if (rv != CR50_COMM_SUCCESS)
-		CPRINTS("Failed to set boot mode");
-	return rv;
-}
-
-static bool pd_comm_enabled;
-
-static void enable_pd(void)
-{
-	CPRINTS("Enable USB-PD");
-	pd_comm_enabled = true;
-}
-
-bool vboot_allow_usb_pd(void)
-{
-	return pd_comm_enabled;
-}
-
-__overridable void show_critical_error(void)
-{
-	CPRINTS("%s", __func__);
-}
-
-static void verify_and_jump(void)
-{
-	enum cr50_comm_err rv = verify_hash();
-
-	switch (rv) {
-	case CR50_COMM_ERR_BAD_PAYLOAD:
-		/* Cr50 should have set NO_BOOT. */
-		CPRINTS("Hash mismatch");
-		enable_pd();
-		break;
-	case CR50_COMM_SUCCESS:
-		system_set_reset_flags(EC_RESET_FLAG_EFS);
-		rv = system_run_image_copy(EC_IMAGE_RW);
-		CPRINTS("Failed to jump (0x%x)", rv);
-		system_clear_reset_flags(EC_RESET_FLAG_EFS);
-		show_critical_error();
-		break;
-	default:
-		CPRINTS("Failed to verify RW (0x%x)", rv);
-		show_critical_error();
-	}
-}
-
-__overridable void show_power_shortage(void)
-{
-	CPRINTS("%s", __func__);
-}
-
-static bool is_battery_ready(void)
-{
-	/* TODO: Add battery check (https://crbug.com/1045216) */
-	return true;
-}
-
-void vboot_main(void)
-{
-	CPRINTS("Main");
-
-	if (system_is_in_rw()) {
-		/*
-		 * We come here and immediately return. LED shows power shortage
-		 * but it will be immediately corrected if the adapter can
-		 * provide enough power.
-		 */
-		CPRINTS("Already in RW");
-		show_power_shortage();
-		return;
-	}
-
-	if (system_is_manual_recovery() ||
-	    (system_get_reset_flags() & EC_RESET_FLAG_STAY_IN_RO)) {
-		if (system_is_manual_recovery())
-			CPRINTS("In recovery mode");
-		if (!IS_ENABLED(CONFIG_BATTERY)
-				&& !IS_ENABLED(HAS_TASK_KEYSCAN)) {
-			/*
-			 * For Chromeboxes, we relax security by allowing PD in
-			 * RO. Attackers don't gain meaningful advantage on
-			 * built-in-keyboard-less systems.
-			 *
-			 * Alternatively, we can use NO_BOOT to show a firmware
-			 * screen, strictly requiring BJ adapter and keeping PD
-			 * disabled.
-			 */
-			enable_pd();
-			return;
-		}
-
-		/*
-		 * If battery is drained or bad, we will boot in NO_BOOT mode to
-		 * inform the user of the problem.
-		 */
-		if (!is_battery_ready()) {
-			CPRINTS("Battery not ready or bad");
-			if (set_boot_mode(BOOT_MODE_NO_BOOT) ==
-					CR50_COMM_SUCCESS)
-				enable_pd();
-		}
-
-		/* We'll enter recovery mode immediately, later, or never. */
-		return;
-	}
-
-	verify_and_jump();
-
-	/*
-	 * EFS failed. EC-RO may be able to boot AP if:
-	 *
-	 *   - Battery is charged or
-	 *   - AC adapter supply in RO >= Boot threshold or
-	 *   - BJ adapter is plugged.
-	 *
-	 * Once AP boots, software sync will fix the mismatch. If that's the
-	 * reason of the failure, we won't come back here next time.
-	 */
-	CPRINTS("Exit");
-}
-
-void hook_shutdown(void)
-{
-	CPRINTS("%s", __func__);
-
-	/*
-	 * We filter the cases which can be interfered with if we execute
-	 * system_reset in HOOK_CHIPSET_SHUTDOWN context. Most cases are
-	 * filtered out by system_is_in_rw (e.g. system_common_shutdown,
-	 * check_pending_cutoff).
-	 */
-	if (system_is_in_rw())
-		return;
-
-	/*
-	 * We can't reset here because it'll completely tear down the power
-	 * and disturb the PCH's power sequence. We instead sysjump.
-	 *
-	 * Note that this does not reduce the security. Even if it's hijacked in
-	 * NO_BOOT mode, an RO still needs to go through a cold reset to clear
-	 * NO_BOOT flag since Cr50 rejects to switch from NO_BOOT to NORMAL.
-	 * If a spoofed matching hash is passed to Cr50, Cr50 would reset EC.
-	 */
-	system_set_reset_flags(EC_RESET_FLAG_AP_IDLE);
-	verify_and_jump();
-}
-/*
- * There can be hooks which are needed to set external chips to a certain state
- * in S5. If the initial state (i.e. AP_OFF state) is different from what those
- * hooks realize, they need to be considered. This hook runs last (i.e.
- * HOOK_PRIO_LAST) to make our landing on S5 as mild as possible.
- */
-DECLARE_HOOK(HOOK_CHIPSET_SHUTDOWN_COMPLETE, hook_shutdown, HOOK_PRIO_LAST);
diff --git a/common/vboot/vb21_lib.c b/common/vboot/vb21_lib.c
deleted file mode 100644
index 4e215c14e5..0000000000
--- a/common/vboot/vb21_lib.c
+++ /dev/null
@@ -1,108 +0,0 @@
-/* Copyright 2017 The Chromium OS Authors. All rights reserved.
- * Use of this source code is governed by a BSD-style license that can be
- * found in the LICENSE file.
- */
-
-/*
- * Common utility APIs for vboot 2.1
- */
-
-#include "common.h"
-#include "host_command.h"
-#include "rsa.h"
-#include "rwsig.h"
-#include "system.h"
-#include "vb21_struct.h"
-#include "vboot.h"
-
-int vb21_is_packed_key_valid(const struct vb21_packed_key *key)
-{
-	if (key->c.magic != VB21_MAGIC_PACKED_KEY)
-		return EC_ERROR_VBOOT_KEY_MAGIC;
-	if (key->key_size != sizeof(struct rsa_public_key))
-		return EC_ERROR_VBOOT_KEY_SIZE;
-	return EC_SUCCESS;
-}
-
-int vb21_is_signature_valid(const struct vb21_signature *sig,
-			    const struct vb21_packed_key *key)
-{
-	if (sig->c.magic != VB21_MAGIC_SIGNATURE)
-		return EC_ERROR_VBOOT_SIG_MAGIC;
-	if (sig->sig_size != RSANUMBYTES)
-		return EC_ERROR_VBOOT_SIG_SIZE;
-	if (key->sig_alg != sig->sig_alg)
-		return EC_ERROR_VBOOT_SIG_ALGORITHM;
-	if (key->hash_alg != sig->hash_alg)
-		return EC_ERROR_VBOOT_HASH_ALGORITHM;
-	/* Validity check signature offset and data size. */
-	if (sig->sig_offset < sizeof(*sig))
-		return EC_ERROR_VBOOT_SIG_OFFSET;
-	if (sig->sig_offset + RSANUMBYTES > CONFIG_RW_SIG_SIZE)
-		return EC_ERROR_VBOOT_SIG_OFFSET;
-	if (sig->data_size > CONFIG_RW_SIZE - CONFIG_RW_SIG_SIZE)
-		return EC_ERROR_VBOOT_DATA_SIZE;
-	return EC_SUCCESS;
-}
-
-const struct vb21_packed_key *vb21_get_packed_key(void)
-{
-	return (const struct vb21_packed_key *)(CONFIG_RO_PUBKEY_ADDR);
-}
-
-static void read_rwsig_info(struct ec_response_rwsig_info *r)
-{
-
-	const struct vb21_packed_key *vb21_key;
-	int rv;
-
-	vb21_key = vb21_get_packed_key();
-
-	r->sig_alg = vb21_key->sig_alg;
-	r->hash_alg = vb21_key->hash_alg;
-	r->key_version = vb21_key->key_version;
-	{ BUILD_ASSERT(sizeof(r->key_id) == sizeof(vb21_key->id),
-		       "key ID sizes must match"); }
-	{ BUILD_ASSERT(sizeof(vb21_key->id) == sizeof(vb21_key->id.raw),
-		       "key ID sizes must match"); }
-	memcpy(r->key_id, vb21_key->id.raw, sizeof(r->key_id));
-
-	rv = vb21_is_packed_key_valid(vb21_key);
-	r->key_is_valid = (rv == EC_SUCCESS);
-}
-
-static int command_rwsig_info(int argc, char **argv)
-{
-	int i;
-	struct ec_response_rwsig_info r;
-
-	read_rwsig_info(&r);
-
-	ccprintf("sig_alg: %d\n", r.sig_alg);
-	ccprintf("key_version: %d\n", r.key_version);
-	ccprintf("hash_alg: %d\n", r.hash_alg);
-	ccprintf("key_is_valid: %d\n", r.key_is_valid);
-
-	ccprintf("key_id: ");
-	for (i = 0; i < sizeof(r.key_id); i++)
-		ccprintf("%x", r.key_id[i]);
-	ccprintf("\n");
-
-	return EC_SUCCESS;
-}
-DECLARE_CONSOLE_COMMAND(rwsiginfo, command_rwsig_info, NULL,
-			"Display rwsig info on console.");
-
-static enum ec_status
-host_command_rwsig_info(struct host_cmd_handler_args *args)
-{
-	struct ec_response_rwsig_info *r = args->response;
-
-	read_rwsig_info(r);
-	args->response_size = sizeof(*r);
-
-	return EC_RES_SUCCESS;
-}
-
-DECLARE_HOST_COMMAND(EC_CMD_RWSIG_INFO, host_command_rwsig_info,
-		     EC_VER_MASK(EC_VER_RWSIG_INFO));
diff --git a/common/vboot/vboot.c b/common/vboot/vboot.c
deleted file mode 100644
index 910156335d..0000000000
--- a/common/vboot/vboot.c
+++ /dev/null
@@ -1,228 +0,0 @@
-/* Copyright 2017 The Chromium OS Authors. All rights reserved.
- * Use of this source code is governed by a BSD-style license that can be
- * found in the LICENSE file.
- */
-
-/*
- * Verify and jump to a RW image if power supply is not sufficient.
- */
-
-#include "battery.h"
-#include "charge_manager.h"
-#include "chipset.h"
-#include "clock.h"
-#include "console.h"
-#include "flash.h"
-#include "hooks.h"
-#include "host_command.h"
-#include "rsa.h"
-#include "rwsig.h"
-#include "stdbool.h"
-#include "sha256.h"
-#include "shared_mem.h"
-#include "system.h"
-#include "usb_pd.h"
-#include "vboot.h"
-#include "vb21_struct.h"
-
-#define CPRINTS(format, args...) cprints(CC_VBOOT,"VB " format, ## args)
-#define CPRINTF(format, args...) cprintf(CC_VBOOT,"VB " format, ## args)
-
-static int has_matrix_keyboard(void)
-{
-	return 0;
-}
-
-static int verify_slot(enum ec_image slot)
-{
-	const struct vb21_packed_key *vb21_key;
-	const struct vb21_signature *vb21_sig;
-	const struct rsa_public_key *key;
-	const uint8_t *sig;
-	const uint8_t *data;
-	int len;
-	int rv;
-
-	CPRINTS("Verifying %s", ec_image_to_string(slot));
-
-	vb21_key = (const struct vb21_packed_key *)(
-			CONFIG_MAPPED_STORAGE_BASE +
-			CONFIG_EC_PROTECTED_STORAGE_OFF +
-			CONFIG_RO_PUBKEY_STORAGE_OFF);
-	rv = vb21_is_packed_key_valid(vb21_key);
-	if (rv) {
-		CPRINTS("Invalid key (%d)", rv);
-		return EC_ERROR_VBOOT_KEY;
-	}
-	key = (const struct rsa_public_key *)
-		((const uint8_t *)vb21_key + vb21_key->key_offset);
-
-	if (slot == EC_IMAGE_RW_A) {
-		data = (const uint8_t *)(CONFIG_MAPPED_STORAGE_BASE +
-				CONFIG_EC_WRITABLE_STORAGE_OFF +
-				CONFIG_RW_A_STORAGE_OFF);
-		vb21_sig = (const struct vb21_signature *)(
-				CONFIG_MAPPED_STORAGE_BASE +
-				CONFIG_EC_WRITABLE_STORAGE_OFF +
-				CONFIG_RW_A_SIGN_STORAGE_OFF);
-	} else {
-		data = (const uint8_t *)(CONFIG_MAPPED_STORAGE_BASE +
-				CONFIG_EC_WRITABLE_STORAGE_OFF +
-				CONFIG_RW_B_STORAGE_OFF);
-		vb21_sig = (const struct vb21_signature *)(
-				CONFIG_MAPPED_STORAGE_BASE +
-				CONFIG_EC_WRITABLE_STORAGE_OFF +
-				CONFIG_RW_B_SIGN_STORAGE_OFF);
-	}
-
-	rv = vb21_is_signature_valid(vb21_sig, vb21_key);
-	if (rv) {
-		CPRINTS("Invalid signature (%d)", rv);
-		return EC_ERROR_INVAL;
-	}
-	sig = (const uint8_t *)vb21_sig + vb21_sig->sig_offset;
-	len = vb21_sig->data_size;
-
-	if (vboot_is_padding_valid(data, len,
-				   CONFIG_RW_SIZE - CONFIG_RW_SIG_SIZE)) {
-		CPRINTS("Invalid padding");
-		return EC_ERROR_INVAL;
-	}
-
-	rv = vboot_verify(data, len, key, sig);
-	if (rv) {
-		CPRINTS("Invalid data (%d)", rv);
-		return EC_ERROR_INVAL;
-	}
-
-	CPRINTS("Verified %s", ec_image_to_string(slot));
-
-	return EC_SUCCESS;
-}
-
-static enum ec_status hc_verify_slot(struct host_cmd_handler_args *args)
-{
-	const struct ec_params_efs_verify *p = args->params;
-	enum ec_image slot;
-
-	switch (p->region) {
-	case EC_FLASH_REGION_ACTIVE:
-		slot = system_get_active_copy();
-		break;
-	case EC_FLASH_REGION_UPDATE:
-		slot = system_get_update_copy();
-		break;
-	default:
-		return EC_RES_INVALID_PARAM;
-	}
-	return verify_slot(slot) ? EC_RES_ERROR : EC_RES_SUCCESS;
-}
-DECLARE_HOST_COMMAND(EC_CMD_EFS_VERIFY, hc_verify_slot, EC_VER_MASK(0));
-
-static int verify_and_jump(void)
-{
-	enum ec_image slot;
-	int rv;
-
-	/* 1. Decide which slot to try */
-	slot = system_get_active_copy();
-
-	/* 2. Verify the slot */
-	rv = verify_slot(slot);
-	if (rv) {
-		if (rv == EC_ERROR_VBOOT_KEY)
-			/* Key error. The other slot isn't worth trying. */
-			return rv;
-		slot = system_get_update_copy();
-		/* TODO(chromium:767050): Skip reading key again. */
-		rv = verify_slot(slot);
-		if (rv)
-			/* Both slots failed */
-			return rv;
-
-		/* Proceed with the other slot. If this slot isn't expected, AP
-		 * will catch it and request recovery after a few attempts. */
-		if (system_set_active_copy(slot))
-			CPRINTS("Failed to activate %s",
-				ec_image_to_string(slot));
-	}
-
-	/* 3. Jump (and reboot) */
-	rv = system_run_image_copy(slot);
-	CPRINTS("Failed to jump (%d)", rv);
-
-	return rv;
-}
-
-/* Request more power: charging battery or more powerful AC adapter */
-__overridable void show_power_shortage(void)
-{
-	CPRINTS("%s", __func__);
-}
-
-__overridable void show_critical_error(void)
-{
-	CPRINTS("%s", __func__);
-}
-
-static bool pd_comm_enabled;
-
-bool vboot_allow_usb_pd(void)
-{
-	return pd_comm_enabled;
-}
-
-void vboot_main(void)
-{
-	CPRINTS("Main");
-
-	if (system_is_in_rw()) {
-		/*
-		 * We come here and immediately return. LED shows power shortage
-		 * but it will be immediately corrected if the adapter can
-		 * provide enough power.
-		 */
-		CPRINTS("Already in RW. Wait for power...");
-		show_power_shortage();
-		return;
-	}
-
-	if (!(crec_flash_get_protect() & EC_FLASH_PROTECT_GPIO_ASSERTED)) {
-		/*
-		 * If hardware WP is disabled, PD communication is enabled.
-		 * We can return and wait for more power.
-		 * Note: If software WP is disabled, we still perform EFS even
-		 * though PD communication is enabled.
-		 */
-		CPRINTS("HW-WP not asserted.");
-		show_power_shortage();
-		return;
-	}
-
-	if (system_is_manual_recovery() ||
-	    (system_get_reset_flags() & EC_RESET_FLAG_STAY_IN_RO)) {
-		if (system_is_manual_recovery())
-			CPRINTS("Manual recovery");
-
-		if (battery_is_present() || has_matrix_keyboard()) {
-			show_power_shortage();
-			return;
-		}
-		/* We don't request_power because we don't want to assume all
-		 * devices support a non type-c charger. We open up a security
-		 * hole by allowing EC-RO to do PD negotiation but attackers
-		 * don't gain meaningful advantage on devices without a matrix
-		 * keyboard */
-		CPRINTS("Enable PD comm");
-		pd_comm_enabled = true;
-		return;
-	}
-
-	clock_enable_module(MODULE_FAST_CPU, 1);
-	/* If successful, this won't return. */
-	verify_and_jump();
-	clock_enable_module(MODULE_FAST_CPU, 0);
-
-	/* Failed to jump. Need recovery. */
-	show_critical_error();
-}