ec_sync: Go to recovery on aux fw update failure

If an aux firmware update fails enter recovery with a specific
reason code so we can identify systems that fail.

Also handle the case where the update succeeds and requests a
cold reset of the EC, first clearing the oprom flag if
necessary in order to prevent a second reset.

BUG=b:74336712
BRANCH=eve
TEST=manual: force update to fail and ensure it goes to recovery
mode, and after successful update check that the option rom flag
is cleared before the EC reset happens.

Change-Id: I35a93892a0f8bb16eac0925ada5dfbc5c3144f8d
Signed-off-by: Duncan Laurie <dlaurie@google.com>
Reviewed-on: https://chromium-review.googlesource.com/985396

3 files changed, 55 insertions, 18 deletions

diff --git a/firmware/lib/ec_sync.c b/firmware/lib/ec_sync.c
index 03ef2716..f5ceb110 100644
--- a/firmware/lib/ec_sync.c
+++ b/firmware/lib/ec_sync.c
@@ -461,6 +461,20 @@ VbError_t ec_sync_check_aux_fw(struct vb2_context *ctx,
 	return VbExCheckAuxFw(severity);
 }
 
+VbError_t ec_sync_update_aux_fw(struct vb2_context *ctx)
+{
+	VbError_t rv = VbExUpdateAuxFw();
+	if (rv) {
+		if (rv == VBERROR_EC_REBOOT_TO_RO_REQUIRED) {
+			VB2_DEBUG("AUX firmware update requires RO reboot.\n");
+		} else {
+			VB2_DEBUG("AUX firmware update/protect failed.\n");
+			request_recovery(ctx, VB2_RECOVERY_AUX_FW_UPDATE);
+		}
+	}
+	return rv;
+}
+
 VbError_t ec_sync_phase2(struct vb2_context *ctx, VbCommonParams *cparams)
 {
 	if (!ec_sync_allowed(ctx, cparams))
diff --git a/firmware/lib/ec_sync_all.c b/firmware/lib/ec_sync_all.c
index d47b9137..45da682b 100644
--- a/firmware/lib/ec_sync_all.c
+++ b/firmware/lib/ec_sync_all.c
@@ -17,6 +17,28 @@
 #include "vboot_display.h"
 #include "vboot_kernel.h"
 
+static VbError_t ec_sync_unload_oprom(struct vb2_context *ctx,
+				      VbSharedDataHeader *shared,
+				      int need_wait_screen)
+{
+	/*
+	 * Reboot to unload VGA Option ROM if:
+	 * - we displayed the wait screen
+	 * - the system has slow EC update flag set
+	 * - the VGA Option ROM was needed and loaded
+	 * - the system is NOT in developer mode (that'll also need the ROM)
+	 */
+	if (need_wait_screen &&
+	    (shared->flags & VBSD_OPROM_MATTERS) &&
+	    (shared->flags & VBSD_OPROM_LOADED) &&
+	    !(shared->flags & VBSD_BOOT_DEV_SWITCH_ON)) {
+		VB2_DEBUG("Reboot to unload VGA Option ROM\n");
+		vb2_nv_set(ctx, VB2_NV_OPROM_NEEDED, 0);
+		return VBERROR_VGA_OPROM_MISMATCH;
+	}
+	return VBERROR_SUCCESS;
+}
+
 VbError_t ec_sync_all(struct vb2_context *ctx, struct VbCommonParams *cparams)
 {
 	VbSharedDataHeader *shared =
@@ -76,28 +98,21 @@ VbError_t ec_sync_all(struct vb2_context *ctx, struct VbCommonParams *cparams)
 		return rv;
 
 	/*
-	 * Do software sync for devices tunneled throught the EC.
+	 * Do Aux FW software sync and protect devices tunneled through the EC.
+	 * Aux FW update may request RO reboot to force EC cold reset so also
+	 * unload the option ROM if needed to prevent a second reboot.
 	 */
-	rv = VbExUpdateAuxFw();
-	if (rv)
+	rv = ec_sync_update_aux_fw(ctx);
+	if (rv) {
+		ec_sync_unload_oprom(ctx, shared, need_wait_screen);
 		return rv;
-
-	/*
-	 * Reboot to unload VGA Option ROM if:
-	 * - we displayed the wait screen
-	 * - the system has slow EC update flag set
-	 * - the VGA Option ROM was needed and loaded
-	 * - the system is NOT in developer mode (that'll also need the ROM)
-	 */
-	if (need_wait_screen &&
-	    (shared->flags & VBSD_OPROM_MATTERS) &&
-	    (shared->flags & VBSD_OPROM_LOADED) &&
-	    !(shared->flags & VBSD_BOOT_DEV_SWITCH_ON)) {
-		VB2_DEBUG("Reboot to unload VGA Option ROM\n");
-		vb2_nv_set(ctx, VB2_NV_OPROM_NEEDED, 0);
-		return VBERROR_VGA_OPROM_MISMATCH;
 	}
 
+	/* Reboot to unload VGA Option ROM if needed. */
+	rv = ec_sync_unload_oprom(ctx, shared, need_wait_screen);
+	if (rv)
+		return rv;
+
 	/* Do EC sync phase 3; this completes sync and handles battery cutoff */
 	rv = ec_sync_phase3(ctx, cparams);
 	if (rv)
diff --git a/firmware/lib/include/ec_sync.h b/firmware/lib/include/ec_sync.h
index 78b08a20..a5960a9f 100644
--- a/firmware/lib/include/ec_sync.h
+++ b/firmware/lib/include/ec_sync.h
@@ -55,6 +55,14 @@ VbError_t ec_sync_check_aux_fw(struct vb2_context *ctx,
 			       VbAuxFwUpdateSeverity_t *severity);
 
 /**
+ * Update and protect auxiliary firmware.
+ *
+ * @param ctx		Vboot2 context
+ * @return VBERROR_SUCCESS or non-zero error code.
+ */
+VbError_t ec_sync_update_aux_fw(struct vb2_context *ctx);
+
+/**
  * EC sync, phase 2
  *
  * This updates the EC if necessary, makes sure it has protected its image(s),