ec_sync: Only do aux fw update if also doing EC update

Aux firmware updates have important caveats that we should be
careful about when we try to apply updates:

1) an update that fails once could continue to fail so the system
could get stuck in an update failure loop.

2) some devices have limited OTP space for updates so a continued
update failure could result in a completely unusable device.

Because of these concerns it seems safer to only attempt to update
the aux firmware when the EC is also being updated.  This way the
aux firmware update will only be attempted once for each overall
firmware update for the device.

Additionally, if the check to determine an update fails we can
skip the update and continue to boot so it does not end up in a
reboot loop if the device has a persistent failure.

BUG=b:74336712
BRANCH=eve
TEST=manual: ensure update is only attempted if EC is updated

Change-Id: I71425b09c341bf0556612390f97329447da5eac4
Reviewed-on: https://chromium-review.googlesource.com/985395
Reviewed-by: Duncan Laurie <dlaurie@google.com>
Commit-Queue: Duncan Laurie <dlaurie@google.com>
Tested-by: Duncan Laurie <dlaurie@google.com>
Trybot-Ready: Duncan Laurie <dlaurie@google.com>

2 files changed, 14 insertions, 4 deletions

diff --git a/firmware/lib/ec_sync.c b/firmware/lib/ec_sync.c
index cc50b3b4..03ef2716 100644
--- a/firmware/lib/ec_sync.c
+++ b/firmware/lib/ec_sync.c
@@ -449,8 +449,11 @@ VbError_t ec_sync_check_aux_fw(struct vb2_context *ctx,
 			       VbCommonParams *cparams,
 			       VbAuxFwUpdateSeverity_t *severity)
 {
+	struct vb2_shared_data *sd = vb2_get_sd(ctx);
+
 	/* If we're not updating the EC, skip aux fw syncs as well */
 	if (!ec_sync_allowed(ctx, cparams) ||
+	    !(sd->flags & VB2_SD_FLAG_ECSYNC_EC_RW) ||
 	    (cparams->gbb->flags & GBB_FLAG_DISABLE_PD_SOFTWARE_SYNC)) {
 		*severity = VB_AUX_FW_NO_UPDATE;
 		return VBERROR_SUCCESS;
diff --git a/firmware/lib/ec_sync_all.c b/firmware/lib/ec_sync_all.c
index aeec6079..d47b9137 100644
--- a/firmware/lib/ec_sync_all.c
+++ b/firmware/lib/ec_sync_all.c
@@ -24,12 +24,19 @@ VbError_t ec_sync_all(struct vb2_context *ctx, struct VbCommonParams *cparams)
 	VbAuxFwUpdateSeverity_t fw_update;
 	VbError_t rv;
 
-	rv = ec_sync_check_aux_fw(ctx, cparams, &fw_update);
-	if (rv)
-		return rv;
-
 	/* Do EC sync phase 1; this determines if we need an update */
 	VbError_t phase1_rv = ec_sync_phase1(ctx, cparams);
+
+	/*
+	 * Check for AUX firmware updates to be performed.
+	 * Continue on errors to prevent reboot loop on persistent failure.
+	 */
+	rv = ec_sync_check_aux_fw(ctx, cparams, &fw_update);
+	if (rv) {
+		VB2_DEBUG("Skipping AUX FW update.\n");
+		fw_update = VB_AUX_FW_NO_UPDATE;
+	}
+
 	int need_wait_screen = ec_will_update_slowly(ctx, cparams) ||
 		(fw_update == VB_AUX_FW_SLOW_UPDATE);