flash: Add option to move pstate inside RO image

Currently, ECs with internal flash store the write protect state for
RO in a separate write/erase block of flash.  This is wasteful on
chips where there are not many blocks of flash.

Add a new CONFIG_FLASH_PSTATE_IN_BANK option which is defined by
default.  This is the old behavior, for compatibility.  (And we're
calling it 'bank' because that's what the existing code does, even if
the terminology is somewhat etymologically... bankrupt.)

If that config is #undef'd, then store the write protect flag directly
inside the RO image.  This uses only 4 bytes of the RO image, instead
of an entire erase block.  The magic numbers for the pstate values are
chosen such that when protecting RO, bits are only transitioned away
from their erased state.  Unprotecting RO once it's protected requires
reflashing RO; it's no longer possible to 'flashwp disable'.  But
that's ok, because realistically, the only reason to unprotect RO is
if you're about to flash the RO firmware anyway.

BUG=chromium:476659
BRANCH=none
TEST=Without undefining CONFIG_FLASH_PSTATE_IN_BANK, make sure everything
     still works on samus and samus_pd.  This ensures we didn't break the
     existing functionality:
         flashinfo -> no flags
         flashwp enable
         flashinfo -> ro_at_boot
         reboot
         flashinfo -> ro_at_boot
         flashwp disable
         flashinfo -> no flags
     Then recompile with #undef CONFIG_FLASH_PSTATE_IN_BANK and test:
         flashinfo -> no flags
         flashwp enable
         flashinfo -> ro_at_boot
         reboot
         flashinfo -> ro_at_boot
         flashwp disable -> fails with access denied
         flashinfo -> ro_at_boot
     Then reflash to verify that clears the ro_at_boot flag:
         flashinfo -> no flags

Change-Id: Ie794b8cfed2a10c50b0e36dcf185884070b04666
Signed-off-by: Randall Spangler <rspangler@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/266095
Reviewed-by: Alec Berg <alecaberg@chromium.org>
Reviewed-by: Vincent Palatin <vpalatin@chromium.org>
Trybot-Ready: Vincent Palatin <vpalatin@chromium.org>

1 files changed, 16 insertions, 4 deletions

diff --git a/include/config.h b/include/config.h
index 97460a88ac..6cc5687ea8 100644
--- a/include/config.h
+++ b/include/config.h
@@ -598,13 +598,25 @@
 #undef CONFIG_FLASH_PROTECT_NEXT_BOOT
 
 /*
- * Use a bank of flash to store its persistent write protect state.  This
- * allows ECs with internal flash to emulate something closer to a SPI flash
- * write protect register.  If this is not defined, write protect state is
- * maintained solely by the physical flash driver.
+ * Store persistent write protect for the flash inside the flash data itself.
+ * This allows ECs with internal flash to emulate something closer to a SPI
+ * flash write protect register.  If this is not defined, write protect state
+ * is maintained solely by the physical flash driver.
  */
 #define CONFIG_FLASH_PSTATE
 
+/*
+ * Store the pstate data in its own dedicated bank of flash.  This allows
+ * disabling the protect-RO-at-boot flag without rewriting the RO firmware,
+ * but costs a bank of flash.
+ *
+ * If this is not defined, the pstate data is stored inside the RO firmware
+ * image itself.  This is more space-efficient, but the only way to clear the
+ * flag once it's set is to rewrite the RO firmware (after removing the WP
+ * screw, of course).
+ */
+#define CONFIG_FLASH_PSTATE_BANK
+
 #undef CONFIG_FLASH_SIZE
 #undef CONFIG_FLASH_WRITE_IDEAL_SIZE
 #undef CONFIG_FLASH_WRITE_SIZE