puff: prevent AP boot when there isn't enough power

The common x86 state machine does this, but the EC-controlled sequencing
did not. Since trying to boot the AP without enough power will cause
the system to brown out, we need to do it too.

TEST=boot prevented on hardware
BRANCH=none
BUG=b:146515963

Change-Id: I7dbe6ab962fbe47d4d866be98d4174291c757c72
Signed-off-by: Peter Marheine <pmarheine@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/ec/+/1980104
Reviewed-by: Andrew McRae <amcrae@chromium.org>

3 files changed, 61 insertions, 37 deletions

diff --git a/power/cometlake-discrete.c b/power/cometlake-discrete.c
index 5ab923499c..94b4723d33 100644
--- a/power/cometlake-discrete.c
+++ b/power/cometlake-discrete.c
@@ -286,6 +286,11 @@ enum power_state power_handle_state(enum power_state state)
 
 	switch (state) {
 	case POWER_G3S5:
+		if (intel_x86_wait_power_up_ok() != EC_SUCCESS) {
+			chipset_force_shutdown(
+				CHIPSET_SHUTDOWN_BATTERY_INHIBIT);
+			return POWER_G3;
+		}
 		/* Power-up steps 2a-2h. */
 #ifdef CONFIG_POWER_PP5000_CONTROL
 		power_5v_enable(task_get_current(), 1);
diff --git a/power/intel_x86.c b/power/intel_x86.c
index c60c1f94e3..ecf36268cb 100644
--- a/power/intel_x86.c
+++ b/power/intel_x86.c
@@ -432,47 +432,11 @@ enum power_state common_intel_x86_power_handle_state(enum power_state state)
 #endif
 
 	case POWER_G3S5:
-#ifdef CONFIG_CHARGER
-		{
-		int tries = 0;
-
-		/*
-		 * Allow charger to be initialized for upto defined tries,
-		 * in case we're trying to boot the AP with no battery.
-		 */
-		while ((tries < CHARGER_INITIALIZED_TRIES) &&
-		       is_power_up_inhibited()) {
-			msleep(CHARGER_INITIALIZED_DELAY_MS);
-			tries++;
-		}
-
-		/*
-		 * Return to G3 if battery level is too low. Set
-		 * power_up_inhibited in order to check the eligibility to boot
-		 * AP up after battery SOC changes.
-		 */
-		if (tries == CHARGER_INITIALIZED_TRIES) {
-			CPRINTS("power-up inhibited");
-			power_up_inhibited = 1;
+		if (intel_x86_wait_power_up_ok() != EC_SUCCESS) {
 			chipset_force_shutdown(
 				CHIPSET_SHUTDOWN_BATTERY_INHIBIT);
 			return POWER_G3;
 		}
-
-		power_up_inhibited = 0;
-		}
-#endif
-
-#ifdef CONFIG_VBOOT_EFS
-		/*
-		 * We have to test power readiness here (instead of S5->S3)
-		 * because when entering S5, EC enables EC_ROP_SLP_SUS pin
-		 * which causes (short-powered) system to brown out.
-		 */
-		while (!system_can_boot_ap())
-			msleep(200);
-#endif
-
 #ifdef CONFIG_CHIPSET_HAS_PRE_INIT_CALLBACK
 		/*
 		 * Callback to do pre-initialization within the context of
@@ -743,3 +707,45 @@ void chipset_reset(enum chipset_reset_reason reason)
 	udelay(32 * MSEC);
 	gpio_set_level(GPIO_SYS_RESET_L, 1);
 }
+
+enum ec_error_list intel_x86_wait_power_up_ok(void)
+{
+#ifdef CONFIG_CHARGER
+	int tries = 0;
+
+	/*
+	 * Allow charger to be initialized for up to defined tries,
+	 * in case we're trying to boot the AP with no battery.
+	 */
+	while ((tries < CHARGER_INITIALIZED_TRIES) &&
+	       is_power_up_inhibited()) {
+		msleep(CHARGER_INITIALIZED_DELAY_MS);
+		tries++;
+	}
+
+	/*
+	 * Return to G3 if battery level is too low. Set
+	 * power_up_inhibited in order to check the eligibility to boot
+	 * AP up after battery SOC changes.
+	 */
+	if (tries == CHARGER_INITIALIZED_TRIES) {
+		CPRINTS("power-up inhibited");
+		power_up_inhibited = 1;
+		return EC_ERROR_TIMEOUT;
+	}
+
+	power_up_inhibited = 0;
+#endif
+
+#ifdef CONFIG_VBOOT_EFS
+	/*
+	 * We have to test power readiness here (instead of S5->S3)
+	 * because when entering S5, EC enables EC_ROP_SLP_SUS pin
+	 * which causes (short-powered) system to brown out.
+	 */
+	while (!system_can_boot_ap())
+		msleep(200);
+#endif
+
+	return EC_SUCCESS;
+}
diff --git a/power/intel_x86.h b/power/intel_x86.h
index b1e60bd17f..3f4d8ff6f0 100644
--- a/power/intel_x86.h
+++ b/power/intel_x86.h
@@ -62,4 +62,17 @@ enum power_state chipset_force_g3(void);
  */
 enum power_state common_intel_x86_power_handle_state(enum power_state state);
 
+/**
+ * Wait for power-up to be allowed based on available power.
+ *
+ * This delays G3->S5 until there is enough power to boot the AP, waiting
+ * first until the charger (if any) is ready, then for there to be sufficient
+ * power.
+ *
+ * In case of error, the caller should not allow power-up past G3.
+ *
+ * @return EC_SUCCESS if OK.
+ */
+enum ec_error_list intel_x86_wait_power_up_ok(void);
+
 #endif /* __CROS_EC_INTEL_X86_H */