vboot: simplify ec_sync code to only handle one device

Remove devidx argument from internal and external functions.
Rename external API functions to vboot2 scheme (vb2ex_...).
Rename external EC-related data types to vboot2 scheme (vb2_...).

BUG=b:124141368, chromium:1016688, chromium:1017093, b:112198832, b:143094352
TEST=make clean && make runtests
BRANCH=none

Cq-Depend: chromium:1910562
Change-Id: I4ca9858a0f91a0365288c04cdb90aad0efdd7647
Signed-off-by: Joel Kitching <kitching@google.com>
Signed-off-by: Tim Wawrzynczak <twawrzynczak@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/1872255
Reviewed-by: Julius Werner <jwerner@chromium.org>
(cherry picked from commit 35edb575304447c68be8c7298610203ee98d94e0)
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/1924291
Reviewed-by: Shelley Chen <shchen@chromium.org>
Commit-Queue: Shelley Chen <shchen@chromium.org>
Tested-by: Shelley Chen <shchen@chromium.org>

8 files changed, 139 insertions, 172 deletions

diff --git a/firmware/2lib/2ec_sync.c b/firmware/2lib/2ec_sync.c
index cf57a12b..897ddfd2 100644
--- a/firmware/2lib/2ec_sync.c
+++ b/firmware/2lib/2ec_sync.c
@@ -15,19 +15,9 @@
 #include "vboot_display.h"
 #include "vboot_kernel.h"
 
-#define VB2_SD_FLAG_ECSYNC_RW VB2_SD_FLAG_ECSYNC_EC_RW
-#define VB2_SD_FLAG_ECSYNC_ANY					\
-	(VB2_SD_FLAG_ECSYNC_EC_RO | VB2_SD_FLAG_ECSYNC_RW)
-#define VB2_SD_FLAG_ECSYNC_IN_RW VB2_SD_FLAG_ECSYNC_EC_IN_RW
-
-#define IN_RW(devidx)							\
-	((devidx) ? 0 : VB2_SD_FLAG_ECSYNC_EC_IN_RW)
-
-#define WHICH_EC(devidx, select) \
-	((select) == VB_SELECT_FIRMWARE_READONLY ? VB2_SD_FLAG_ECSYNC_EC_RO : \
-	 ((devidx) ? 0 : VB2_SD_FLAG_ECSYNC_EC_RW))
-
-#define RW_AB(devidx) ((devidx) ? 0 : VB2_CONTEXT_EC_EFS)
+#define SYNC_FLAG(select) \
+	((select) == VB_SELECT_FIRMWARE_READONLY ? \
+	 VB2_SD_FLAG_ECSYNC_EC_RO : VB2_SD_FLAG_ECSYNC_EC_RW)
 
 static void request_recovery(struct vb2_context *ctx, uint32_t recovery_request)
 {
@@ -37,17 +27,17 @@ static void request_recovery(struct vb2_context *ctx, uint32_t recovery_request)
 }
 
 /**
- * Wrapper around VbExEcProtect() which sets recovery reason on error.
+ * Wrapper around vb2ex_ec_protect() which sets recovery reason on error.
  */
-static vb2_error_t protect_ec(struct vb2_context *ctx, int devidx,
-			      enum VbSelectFirmware_t select)
+static vb2_error_t protect_ec(struct vb2_context *ctx,
+			      enum vb2_firmware_selection select)
 {
-	vb2_error_t rv = VbExEcProtect(devidx, select);
+	vb2_error_t rv = vb2ex_ec_protect(select);
 
 	if (rv == VBERROR_EC_REBOOT_TO_RO_REQUIRED) {
-		VB2_DEBUG("VbExEcProtect() needs reboot\n");
+		VB2_DEBUG("vb2ex_ec_protect() needs reboot\n");
 	} else if (rv != VB2_SUCCESS) {
-		VB2_DEBUG("VbExEcProtect() returned %d\n", rv);
+		VB2_DEBUG("vb2ex_ec_protect() returned %d\n", rv);
 		request_recovery(ctx, VB2_RECOVERY_EC_PROTECT);
 	}
 	return rv;
@@ -71,7 +61,7 @@ static void print_hash(const uint8_t *hash, uint32_t hash_size,
 	VB2_DEBUG_RAW("\n");
 }
 
-static const char *image_name_to_string(enum VbSelectFirmware_t select)
+static const char *image_name_to_string(enum vb2_firmware_selection select)
 {
 	switch (select) {
 	case VB_SELECT_FIRMWARE_READONLY:
@@ -89,22 +79,20 @@ static const char *image_name_to_string(enum VbSelectFirmware_t select)
  * Check if the hash of the EC code matches the expected hash.
  *
  * @param ctx		Vboot2 context
- * @param devidx	Index of EC device to check
  * @param select	Which firmware image to check
  * @return VB2_SUCCESS, or non-zero error code.
  */
-static vb2_error_t check_ec_hash(struct vb2_context *ctx, int devidx,
-				 enum VbSelectFirmware_t select)
+static vb2_error_t check_ec_hash(struct vb2_context *ctx,
+				 enum vb2_firmware_selection select)
 {
 	struct vb2_shared_data *sd = vb2_get_sd(ctx);
 
 	/* Get current EC hash. */
 	const uint8_t *ec_hash = NULL;
 	int ec_hash_size;
-	vb2_error_t rv = VbExEcHashImage(devidx, select, &ec_hash,
-					 &ec_hash_size);
+	vb2_error_t rv = vb2ex_ec_hash_image(select, &ec_hash, &ec_hash_size);
 	if (rv) {
-		VB2_DEBUG("VbExEcHashImage() returned %d\n", rv);
+		VB2_DEBUG("vb2ex_ec_hash_image() returned %d\n", rv);
 		request_recovery(ctx, VB2_RECOVERY_EC_HASH_FAILED);
 		return VB2_ERROR_EC_HASH_IMAGE;
 	}
@@ -113,9 +101,9 @@ static vb2_error_t check_ec_hash(struct vb2_context *ctx, int devidx,
 	/* Get expected EC hash. */
 	const uint8_t *hash = NULL;
 	int hash_size;
-	rv = VbExEcGetExpectedImageHash(devidx, select, &hash, &hash_size);
+	rv = vb2ex_ec_get_expected_image_hash(select, &hash, &hash_size);
 	if (rv) {
-		VB2_DEBUG("VbExEcGetExpectedImageHash() returned %d\n", rv);
+		VB2_DEBUG("vb2ex_ec_get_expected_image_hash() returned %d\n", rv);
 		request_recovery(ctx, VB2_RECOVERY_EC_EXPECTED_HASH);
 		return VB2_ERROR_EC_HASH_EXPECTED;
 	}
@@ -128,7 +116,7 @@ static vb2_error_t check_ec_hash(struct vb2_context *ctx, int devidx,
 
 	if (vb2_safe_memcmp(ec_hash, hash, hash_size)) {
 		print_hash(hash, hash_size, "Expected");
-		sd->flags |= WHICH_EC(devidx, select);
+		sd->flags |= SYNC_FLAG(select);
 	}
 
 	return VB2_SUCCESS;
@@ -138,12 +126,11 @@ static vb2_error_t check_ec_hash(struct vb2_context *ctx, int devidx,
  * Update the specified EC and verify the update succeeded
  *
  * @param ctx		Vboot2 context
- * @param devidx	Index of EC device to check
  * @param select	Which firmware image to check
  * @return VB2_SUCCESS, or non-zero error code.
  */
-static vb2_error_t update_ec(struct vb2_context *ctx, int devidx,
-			     enum VbSelectFirmware_t select)
+static vb2_error_t update_ec(struct vb2_context *ctx,
+			     enum vb2_firmware_selection select)
 {
 	struct vb2_shared_data *sd = vb2_get_sd(ctx);
 
@@ -152,18 +139,17 @@ static vb2_error_t update_ec(struct vb2_context *ctx, int devidx,
 	/* Get expected EC image */
 	const uint8_t *want = NULL;
 	int want_size;
-	vb2_error_t rv = VbExEcGetExpectedImage(devidx, select, &want,
-						&want_size);
+	vb2_error_t rv = vb2ex_ec_get_expected_image(select, &want, &want_size);
 	if (rv) {
-		VB2_DEBUG("VbExEcGetExpectedImage() returned %d\n", rv);
+		VB2_DEBUG("vb2ex_ec_get_expected_image() returned %d\n", rv);
 		request_recovery(ctx, VB2_RECOVERY_EC_EXPECTED_IMAGE);
 		return rv;
 	}
 	VB2_DEBUG("image len = %d\n", want_size);
 
-	rv = VbExEcUpdateImage(devidx, select, want, want_size);
+	rv = vb2ex_ec_update_image(select, want, want_size);
 	if (rv != VB2_SUCCESS) {
-		VB2_DEBUG("VbExEcUpdateImage() returned %d\n", rv);
+		VB2_DEBUG("vb2ex_ec_update_image() returned %d\n", rv);
 
 		/*
 		 * The EC may know it needs a reboot.  It may need to
@@ -181,10 +167,10 @@ static vb2_error_t update_ec(struct vb2_context *ctx, int devidx,
 	}
 
 	/* Verify the EC was updated properly */
-	sd->flags &= ~WHICH_EC(devidx, select);
-	if (check_ec_hash(ctx, devidx, select) != VB2_SUCCESS)
+	sd->flags &= ~SYNC_FLAG(select);
+	if (check_ec_hash(ctx, select) != VB2_SUCCESS)
 		return VBERROR_EC_REBOOT_TO_RO_REQUIRED;
-	if (sd->flags & WHICH_EC(devidx, select)) {
+	if (sd->flags & SYNC_FLAG(select)) {
 		VB2_DEBUG("Failed to update\n");
 		request_recovery(ctx, VB2_RECOVERY_EC_UPDATE);
 		return VBERROR_EC_REBOOT_TO_RO_REQUIRED;
@@ -194,32 +180,31 @@ static vb2_error_t update_ec(struct vb2_context *ctx, int devidx,
 }
 
 /**
- * Set IN_RW flag for a EC
+ * Set VB2_SD_FLAG_ECSYNC_EC_IN_RW flag for a EC
  *
  * @param ctx		Vboot2 context
- * @param devidx	Which device (EC=0)
+ * @return VB2_SUCCESS, or non-zero if error.
  */
-static vb2_error_t check_ec_active(struct vb2_context *ctx, int devidx)
+static vb2_error_t check_ec_active(struct vb2_context *ctx)
 {
 	struct vb2_shared_data *sd = vb2_get_sd(ctx);
 	int in_rw = 0;
 	/*
-	 * We don't use VbExTrustEC, which checks EC_IN_RW. It is controlled by
-	 * cr50 but on some platforms, cr50 can't know when a EC resets. So, we
-	 * trust what EC-RW says. If it lies it's in RO, we'll flash RW while
-	 * it's in RW.
+	 * We don't use vb2ex_ec_trusted, which checks EC_IN_RW. It is
+	 * controlled by cr50 but on some platforms, cr50 can't know when a EC
+	 * resets. So, we trust what EC-RW says. If it lies it's in RO, we'll
+	 * flash RW while it's in RW.
 	 */
-	vb2_error_t rv = VbExEcRunningRW(devidx, &in_rw);
-
+	vb2_error_t rv = vb2ex_ec_running_rw(&in_rw);
 	/* If we couldn't determine where the EC was, reboot to recovery. */
 	if (rv != VB2_SUCCESS) {
-		VB2_DEBUG("VbExEcRunningRW() returned %d\n", rv);
+		VB2_DEBUG("vb2ex_ec_running_rw() returned %d\n", rv);
 		request_recovery(ctx, VB2_RECOVERY_EC_UNKNOWN_IMAGE);
 		return VBERROR_EC_REBOOT_TO_RO_REQUIRED;
 	}
 
 	if (in_rw)
-		sd->flags |= IN_RW(devidx);
+		sd->flags |= VB2_SD_FLAG_ECSYNC_EC_IN_RW;
 
 	return VB2_SUCCESS;
 }
@@ -227,26 +212,25 @@ static vb2_error_t check_ec_active(struct vb2_context *ctx, int devidx)
 #define RO_RETRIES 2  /* Maximum times to retry flashing RO */
 
 /**
- * Sync, jump, and protect one EC device
+ * Sync, jump, and protect EC device
  *
  * @param ctx		Vboot2 context
- * @param devidx	Which device (EC=0)
  * @return VB2_SUCCESS, or non-zero if error.
  */
-static vb2_error_t sync_one_ec(struct vb2_context *ctx, int devidx)
+static vb2_error_t sync_ec(struct vb2_context *ctx)
 {
 	struct vb2_shared_data *sd = vb2_get_sd(ctx);
-	int is_rw_ab = ctx->flags & RW_AB(devidx);
+	int is_rw_ab = ctx->flags & VB2_CONTEXT_EC_EFS;
 	vb2_error_t rv;
 
-	const enum VbSelectFirmware_t select_rw = is_rw_ab ?
+	const enum vb2_firmware_selection select_rw = is_rw_ab ?
 			VB_SELECT_FIRMWARE_EC_UPDATE :
 			VB_SELECT_FIRMWARE_EC_ACTIVE;
-	VB2_DEBUG("devidx=%d select_rw=%d\n", devidx, select_rw);
+	VB2_DEBUG("select_rw=%d\n", select_rw);
 
 	/* Update the RW Image */
-	if (sd->flags & WHICH_EC(devidx, select_rw)) {
-		if (VB2_SUCCESS != update_ec(ctx, devidx, select_rw))
+	if (sd->flags & SYNC_FLAG(select_rw)) {
+		if (VB2_SUCCESS != update_ec(ctx, select_rw))
 			return VBERROR_EC_REBOOT_TO_RO_REQUIRED;
 		/* Updated successfully. Cold reboot to switch to the new RW.
 		 * TODO: Switch slot and proceed if EC is still in RO. */
@@ -257,16 +241,16 @@ static vb2_error_t sync_one_ec(struct vb2_context *ctx, int devidx)
 	}
 
 	/* Tell EC to jump to its RW image */
-	if (!(sd->flags & IN_RW(devidx))) {
+	if (!(sd->flags & VB2_SD_FLAG_ECSYNC_EC_IN_RW)) {
 		VB2_DEBUG("jumping to EC-RW\n");
-		rv = VbExEcJumpToRW(devidx);
+		rv = vb2ex_ec_jump_to_rw();
 		if (rv != VB2_SUCCESS) {
-			VB2_DEBUG("VbExEcJumpToRW() returned %x\n", rv);
+			VB2_DEBUG("vb2ex_ec_jump_to_rw() returned %x\n", rv);
 
 			/*
-			 * If a previous AP boot has called VbExEcStayInRO(),
-			 * we need to reboot the EC to unlock the ability to
-			 * jump to the RW firmware.
+			 * If a previous AP boot has called
+			 * vb2ex_ec_disable_jump(), we need to reboot the EC to
+			 * unlock the ability to jump to the RW firmware.
 			 *
 			 * All other errors trigger recovery mode.
 			 */
@@ -298,7 +282,7 @@ static vb2_error_t sync_one_ec(struct vb2_context *ctx, int devidx)
 		int num_tries;
 		for (num_tries = 0; num_tries < RO_RETRIES; num_tries++) {
 			if (VB2_SUCCESS ==
-			    update_ec(ctx, devidx, VB_SELECT_FIRMWARE_READONLY))
+			    update_ec(ctx, VB_SELECT_FIRMWARE_READONLY))
 				break;
 		}
 		if (num_tries == RO_RETRIES) {
@@ -314,18 +298,18 @@ static vb2_error_t sync_one_ec(struct vb2_context *ctx, int devidx)
 	}
 
 	/* Protect RO flash */
-	rv = protect_ec(ctx, devidx, VB_SELECT_FIRMWARE_READONLY);
+	rv = protect_ec(ctx, VB_SELECT_FIRMWARE_READONLY);
 	if (rv != VB2_SUCCESS)
 		return rv;
 
 	/* Protect RW flash */
-	rv = protect_ec(ctx, devidx, select_rw);
+	rv = protect_ec(ctx, select_rw);
 	if (rv != VB2_SUCCESS)
 		return rv;
 
-	rv = VbExEcDisableJump(devidx);
+	rv = vb2ex_ec_disable_jump();
 	if (rv != VB2_SUCCESS) {
-		VB2_DEBUG("VbExEcDisableJump() returned %d\n", rv);
+		VB2_DEBUG("vb2ex_ec_disable_jump() returned %d\n", rv);
 		request_recovery(ctx, VB2_RECOVERY_EC_SOFTWARE_SYNC);
 		return VBERROR_EC_REBOOT_TO_RO_REQUIRED;
 	}
@@ -344,19 +328,16 @@ vb2_error_t ec_sync_phase1(struct vb2_context *ctx)
 	if (gbb->flags & VB2_GBB_FLAG_DISABLE_EC_SOFTWARE_SYNC)
 		return VB2_SUCCESS;
 
-	/* Set IN_RW flags */
-	if (check_ec_active(ctx, 0))
+	/* Set VB2_SD_FLAG_ECSYNC_EC_IN_RW flag */
+	if (check_ec_active(ctx))
 		return VBERROR_EC_REBOOT_TO_RO_REQUIRED;
 
 	/* Check if we need to update RW.  Failures trigger recovery mode. */
-	if (check_ec_hash(ctx, 0, VB_SELECT_FIRMWARE_EC_ACTIVE))
+	if (check_ec_hash(ctx, VB_SELECT_FIRMWARE_EC_ACTIVE))
 		return VBERROR_EC_REBOOT_TO_RO_REQUIRED;
-
-	/*
-	 * See if we need to update EC-RO (devidx=0).
-	 */
+	/* See if we need to update EC-RO. */
 	if (vb2_nv_get(ctx, VB2_NV_TRY_RO_SYNC) &&
-	    check_ec_hash(ctx, 0, VB_SELECT_FIRMWARE_READONLY)) {
+	    check_ec_hash(ctx, VB_SELECT_FIRMWARE_READONLY)) {
 		return VBERROR_EC_REBOOT_TO_RO_REQUIRED;
 	}
 
@@ -367,8 +348,8 @@ vb2_error_t ec_sync_phase1(struct vb2_context *ctx)
 	 * If EC supports RW-A/B slots, we can proceed but we need
 	 * to jump to the new RW version later.
 	 */
-	if ((sd->flags & VB2_SD_FLAG_ECSYNC_RW) &&
-	    (sd->flags & VB2_SD_FLAG_ECSYNC_IN_RW) &&
+	if ((sd->flags & VB2_SD_FLAG_ECSYNC_EC_RW) &&
+	    (sd->flags & VB2_SD_FLAG_ECSYNC_EC_IN_RW) &&
 	    !(ctx->flags & VB2_CONTEXT_EC_EFS)) {
 		return VBERROR_EC_REBOOT_TO_RO_REQUIRED;
 	}
@@ -380,7 +361,8 @@ int ec_will_update_slowly(struct vb2_context *ctx)
 {
 	struct vb2_shared_data *sd = vb2_get_sd(ctx);
 
-	return ((sd->flags & VB2_SD_FLAG_ECSYNC_ANY) &&
+	return (((sd->flags & VB2_SD_FLAG_ECSYNC_EC_RO) ||
+		 (sd->flags & VB2_SD_FLAG_ECSYNC_EC_RW)) &&
 		(ctx->flags & VB2_CONTEXT_EC_SYNC_SLOW));
 }
 
@@ -407,7 +389,7 @@ static int ec_sync_allowed(struct vb2_context *ctx)
 }
 
 vb2_error_t ec_sync_check_aux_fw(struct vb2_context *ctx,
-				 VbAuxFwUpdateSeverity_t *severity)
+				 enum vb2_auxfw_update_severity *severity)
 {
 	struct vb2_gbb_header *gbb = vb2_get_gbb(ctx);
 
@@ -418,12 +400,12 @@ vb2_error_t ec_sync_check_aux_fw(struct vb2_context *ctx,
 		return VB2_SUCCESS;
 	}
 
-	return VbExCheckAuxFw(severity);
+	return vb2ex_auxfw_check(severity);
 }
 
 vb2_error_t ec_sync_update_aux_fw(struct vb2_context *ctx)
 {
-	vb2_error_t rv = VbExUpdateAuxFw();
+	vb2_error_t rv = vb2ex_auxfw_update();
 	if (rv) {
 		if (rv == VBERROR_EC_REBOOT_TO_RO_REQUIRED) {
 			VB2_DEBUG("AUX firmware update requires RO reboot.\n");
@@ -441,19 +423,13 @@ vb2_error_t ec_sync_phase2(struct vb2_context *ctx)
 		return VB2_SUCCESS;
 
 	/* Handle updates and jumps for EC */
-	vb2_error_t retval = sync_one_ec(ctx, 0);
-	if (retval != VB2_SUCCESS)
-		return retval;
-
-	return VB2_SUCCESS;
+	return sync_ec(ctx);
 }
 
 vb2_error_t ec_sync_phase3(struct vb2_context *ctx)
 {
-	struct vb2_shared_data *sd = vb2_get_sd(ctx);
-
 	/* EC verification (and possibly updating / jumping) is done */
-	vb2_error_t rv = VbExEcVbootDone(!!sd->recovery_reason);
+	vb2_error_t rv = vb2ex_ec_vboot_done(ctx);
 	if (rv)
 		return rv;
 
@@ -464,7 +440,7 @@ vb2_error_t ec_sync_phase3(struct vb2_context *ctx)
 		vb2_nv_set(ctx, VB2_NV_BATTERY_CUTOFF_REQUEST, 0);
 		/* May lose power immediately, so commit our update now. */
 		vb2_nv_commit(ctx);
-		VbExEcBatteryCutOff();
+		vb2ex_ec_battery_cutoff();
 		return VBERROR_SHUTDOWN_REQUESTED;
 	}
 
@@ -489,7 +465,7 @@ static void display_wait_screen(struct vb2_context *ctx, const char *fw_name)
 
 vb2_error_t ec_sync_all(struct vb2_context *ctx)
 {
-	VbAuxFwUpdateSeverity_t fw_update = VB_AUX_FW_NO_UPDATE;
+	enum vb2_auxfw_update_severity fw_update = VB_AUX_FW_NO_UPDATE;
 	vb2_error_t rv;
 
 	/* Phase 1; this determines if we need an update */
diff --git a/firmware/2lib/include/2ec_sync.h b/firmware/2lib/include/2ec_sync.h
index ebefb9b6..69ca2154 100644
--- a/firmware/2lib/include/2ec_sync.h
+++ b/firmware/2lib/include/2ec_sync.h
@@ -44,7 +44,7 @@ int ec_will_update_slowly(struct vb2_context *ctx);
  * @return VB2_SUCCESS or non-zero error code.
  */
 vb2_error_t ec_sync_check_aux_fw(struct vb2_context *ctx,
-			       VbAuxFwUpdateSeverity_t *severity);
+				 enum vb2_auxfw_update_severity *severity);
 
 /**
  * Update and protect auxiliary firmware.
diff --git a/firmware/include/vboot_api.h b/firmware/include/vboot_api.h
index b0b08f52..374bf85b 100644
--- a/firmware/include/vboot_api.h
+++ b/firmware/include/vboot_api.h
@@ -81,7 +81,7 @@ typedef struct VbSharedDataHeader VbSharedDataHeader;
  * VbSelectFirmwareParams.selected_firmware.  Note that we store these in a
  * uint32_t because enum maps to int, which isn't fixed-size.
  */
-enum VbSelectFirmware_t {
+enum vb2_firmware_selection {
 	/* Read only firmware for normal or developer path. */
 	VB_SELECT_FIRMWARE_READONLY = 3,
 	/* Rewritable EC firmware currently set active */
@@ -634,19 +634,13 @@ uint32_t VbExGetSwitches(uint32_t request_mask);
 /*****************************************************************************/
 /* Embedded controller (EC) */
 
-/*
- * All these functions take a devidx parameter, which indicates which embedded
- * processor the call applies to.  At present, only devidx=0 is valid, but
- * upcoming CLs will add support for multiple devices.
- */
-
 /**
  * This is called only if the system implements a keyboard-based (virtual)
  * developer switch. It must return true only if the system has an embedded
  * controller which is provably running in its RO firmware at the time the
  * function is called.
  */
-int VbExTrustEC(int devidx);
+int vb2ex_ec_trusted(void);
 
 /**
  * Check if the EC is currently running rewritable code.
@@ -654,60 +648,59 @@ int VbExTrustEC(int devidx);
  * If the EC is in RO code, sets *in_rw=0.
  * If the EC is in RW code, sets *in_rw non-zero.
  * If the current EC image is unknown, returns error. */
-vb2_error_t VbExEcRunningRW(int devidx, int *in_rw);
+vb2_error_t vb2ex_ec_running_rw(int *in_rw);
 
 /**
  * Request the EC jump to its rewritable code.  If successful, returns when the
  * EC has booting its RW code far enough to respond to subsequent commands.
  * Does nothing if the EC is already in its rewritable code.
  */
-vb2_error_t VbExEcJumpToRW(int devidx);
+vb2_error_t vb2ex_ec_jump_to_rw(void);
 
 /**
  * Tell the EC to refuse another jump until it reboots. Subsequent calls to
- * VbExEcJumpToRW() in this boot will fail.
+ * vb2ex_ec_jump_to_rw() in this boot will fail.
  */
-vb2_error_t VbExEcDisableJump(int devidx);
+vb2_error_t vb2ex_ec_disable_jump(void);
 
 /**
  * Read the SHA-256 hash of the selected EC image.
  *
- * @param devidx    Device index. 0: EC
  * @param select    Image to get hash of. RO or RW.
  * @param hash      Pointer to the hash.
  * @param hash_size Pointer to the hash size.
- * @return          VBERROR_... error, VB2_SUCCESS on success.
+ * @return VB2_SUCCESS, or error code on error.
  */
-vb2_error_t VbExEcHashImage(int devidx, enum VbSelectFirmware_t select,
-			    const uint8_t **hash, int *hash_size);
+vb2_error_t vb2ex_ec_hash_image(enum vb2_firmware_selection select,
+				const uint8_t **hash, int *hash_size);
 
 /**
  * Get the expected contents of the EC image associated with the main firmware
  * specified by the "select" argument.
  */
-vb2_error_t VbExEcGetExpectedImage(int devidx, enum VbSelectFirmware_t select,
-				   const uint8_t **image, int *image_size);
+vb2_error_t vb2ex_ec_get_expected_image(enum vb2_firmware_selection select,
+					const uint8_t **image, int *image_size);
 
 /**
  * Read the SHA-256 hash of the expected contents of the EC image associated
  * with the main firmware specified by the "select" argument.
  */
-vb2_error_t VbExEcGetExpectedImageHash(int devidx,
-				       enum VbSelectFirmware_t select,
-				       const uint8_t **hash, int *hash_size);
+vb2_error_t vb2ex_ec_get_expected_image_hash(enum vb2_firmware_selection select,
+					     const uint8_t **hash,
+					     int *hash_size);
 
 /**
  * Update the selected EC image.
  */
-vb2_error_t VbExEcUpdateImage(int devidx, enum VbSelectFirmware_t select,
-			      const uint8_t *image, int image_size);
+vb2_error_t vb2ex_ec_update_image(enum vb2_firmware_selection select,
+				  const uint8_t *image, int image_size);
 
 /**
- * Lock the selected EC code to prevent updates until the EC is rebooted.
- * Subsequent calls to VbExEcUpdateImage() with the same region this boot will
- * fail.
+ * Lock the EC code to prevent updates until the EC is rebooted.
+ * Subsequent calls to vb2ex_ec_update_image() with the same region this
+ * boot will fail.
  */
-vb2_error_t VbExEcProtect(int devidx, enum VbSelectFirmware_t select);
+vb2_error_t vb2ex_ec_protect(enum vb2_firmware_selection select);
 
 /**
  * Perform EC post-verification / updating / jumping actions.
@@ -717,20 +710,20 @@ vb2_error_t VbExEcProtect(int devidx, enum VbSelectFirmware_t select);
  * run for the duration of boot). These actions include verifying that
  * enough power is available to continue with boot.
  *
- * @param in_recovery	1 if recovery mode is selected by the AP, 0 otherwise.
- * @return VBERROR_... error, VB2_SUCCESS on success.
+ * @param ctx		Pointer to vboot context.
+ * @return VB2_SUCCESS, or error code on error.
  */
-vb2_error_t VbExEcVbootDone(int in_recovery);
+vb2_error_t vb2ex_ec_vboot_done(struct vb2_context *ctx);
 
 /**
  * Request EC to stop discharging and cut-off battery.
  */
-vb2_error_t VbExEcBatteryCutOff(void);
+vb2_error_t vb2ex_ec_battery_cutoff(void);
 
 /*
  * severity levels for an auxiliary firmware update request
  */
-typedef enum {
+enum vb2_auxfw_update_severity {
 	/* no update needed and no protection needed */
 	VB_AUX_FW_NO_DEVICE = 0,
 	/* no update needed */
@@ -739,7 +732,7 @@ typedef enum {
 	VB_AUX_FW_FAST_UPDATE = 2,
 	/* update needed, "this would take a while..." */
 	VB_AUX_FW_SLOW_UPDATE = 3,
-} VbAuxFwUpdateSeverity_t;
+};
 
 /**
  * Perform auxiliary firmware checks.
@@ -751,10 +744,10 @@ typedef enum {
  *			0: no update needed
  *			1: fast update needed
  *			2: slow update needed
- * @return VBERROR_... error, VB2_SUCCESS on success.
+ * @return VB2_SUCCESS, or error code on error.
  */
 
-vb2_error_t VbExCheckAuxFw(VbAuxFwUpdateSeverity_t *severity);
+vb2_error_t vb2ex_auxfw_check(enum vb2_auxfw_update_severity *severity);
 
 /**
  * Perform auxiliary firmware update(s).
@@ -762,10 +755,10 @@ vb2_error_t VbExCheckAuxFw(VbAuxFwUpdateSeverity_t *severity);
  * This is called after the EC has been updated and is intended to
  * update additional firmware blobs such as TCPCs.
  *
- * @return VBERROR_... error, VB2_SUCCESS on success.
+ * @return VB2_SUCCESS, or error code on error.
  */
 
-vb2_error_t VbExUpdateAuxFw(void);
+vb2_error_t vb2ex_auxfw_update(void);
 
 /*****************************************************************************/
 /* Misc */
diff --git a/firmware/lib/vboot_common.c b/firmware/lib/vboot_common.c
index c77141dd..839964b0 100644
--- a/firmware/lib/vboot_common.c
+++ b/firmware/lib/vboot_common.c
@@ -112,7 +112,7 @@ int vb2_allow_recovery(struct vb2_context *ctx)
 	 * return false (=RW). That's ok because if recovery is manual, we will
 	 * get the right signal and that's the case we care about.
 	 */
-	if (!VbExTrustEC(0))
+	if (!vb2ex_ec_trusted())
 		return 0;
 
 	/* Now we confidently check the recovery switch state at boot */
diff --git a/firmware/stub/vboot_api_stub.c b/firmware/stub/vboot_api_stub.c
index 770be359..c2b4e593 100644
--- a/firmware/stub/vboot_api_stub.c
+++ b/firmware/stub/vboot_api_stub.c
@@ -64,29 +64,29 @@ uint32_t VbExIsShutdownRequested(void)
 	return 0;
 }
 
-int VbExTrustEC(int devidx)
+int vb2ex_ec_trusted(void)
 {
 	return 1;
 }
 
-vb2_error_t VbExEcRunningRW(int devidx, int *in_rw)
+vb2_error_t vb2ex_ec_running_rw(int *in_rw)
 {
 	*in_rw = 0;
 	return VB2_SUCCESS;
 }
 
-vb2_error_t VbExEcJumpToRW(int devidx)
+vb2_error_t vb2ex_ec_jump_to_rw(void)
 {
 	return VB2_SUCCESS;
 }
 
-vb2_error_t VbExEcDisableJump(int devidx)
+vb2_error_t vb2ex_ec_disable_jump(void)
 {
 	return VB2_SUCCESS;
 }
 
-vb2_error_t VbExEcHashImage(int devidx, enum VbSelectFirmware_t select,
-			    const uint8_t **hash, int *hash_size)
+vb2_error_t vb2ex_ec_hash_image(enum vb2_firmware_selection select,
+				const uint8_t **hash, int *hash_size)
 {
 	static const uint8_t fake_hash[32] = {1, 2, 3, 4};
 
@@ -95,8 +95,8 @@ vb2_error_t VbExEcHashImage(int devidx, enum VbSelectFirmware_t select,
 	return VB2_SUCCESS;
 }
 
-vb2_error_t VbExEcGetExpectedImage(int devidx, enum VbSelectFirmware_t select,
-				   const uint8_t **image, int *image_size)
+vb2_error_t vb2ex_ec_get_expected_image(enum vb2_firmware_selection select,
+					const uint8_t **image, int *image_size)
 {
 	static uint8_t fake_image[64] = {5, 6, 7, 8};
 	*image = fake_image;
@@ -104,9 +104,8 @@ vb2_error_t VbExEcGetExpectedImage(int devidx, enum VbSelectFirmware_t select,
 	return VB2_SUCCESS;
 }
 
-vb2_error_t VbExEcGetExpectedImageHash(int devidx,
-				       enum VbSelectFirmware_t select,
-				       const uint8_t **hash, int *hash_size)
+vb2_error_t vb2ex_ec_get_expected_image_hash(enum vb2_firmware_selection select,
+					     const uint8_t **hash, int *hash_size)
 {
 	static const uint8_t fake_hash[32] = {1, 2, 3, 4};
 
@@ -115,34 +114,34 @@ vb2_error_t VbExEcGetExpectedImageHash(int devidx,
 	return VB2_SUCCESS;
 }
 
-vb2_error_t VbExEcUpdateImage(int devidx, enum VbSelectFirmware_t select,
-			      const uint8_t *image, int image_size)
+vb2_error_t vb2ex_ec_update_image(enum vb2_firmware_selection select,
+				  const uint8_t *image, int image_size)
 {
 	return VB2_SUCCESS;
 }
 
-vb2_error_t VbExEcProtect(int devidx, enum VbSelectFirmware_t select)
+vb2_error_t vb2ex_ec_protect(enum vb2_firmware_selection select)
 {
 	return VB2_SUCCESS;
 }
 
-vb2_error_t VbExEcVbootDone(int in_recovery)
+vb2_error_t vb2ex_ec_vboot_done(struct vb2_context *ctx)
 {
 	return VB2_SUCCESS;
 }
 
-vb2_error_t VbExEcBatteryCutOff(void)
+vb2_error_t vb2ex_ec_battery_cutoff(void)
 {
 	return VB2_SUCCESS;
 }
 
-vb2_error_t VbExCheckAuxFw(VbAuxFwUpdateSeverity_t *severity)
+vb2_error_t vb2ex_auxfw_check(enum vb2_auxfw_update_severity *severity)
 {
 	*severity = VB_AUX_FW_NO_UPDATE;
 	return VB2_SUCCESS;
 }
 
-vb2_error_t VbExUpdateAuxFw(void)
+vb2_error_t vb2ex_auxfw_update(void)
 {
 	return VB2_SUCCESS;
 }
diff --git a/tests/vb2_ec_sync_tests.c b/tests/vb2_ec_sync_tests.c
index a9060b00..e668480c 100644
--- a/tests/vb2_ec_sync_tests.c
+++ b/tests/vb2_ec_sync_tests.c
@@ -59,8 +59,8 @@ static uint32_t screens_count = 0;
 
 static vb2_error_t ec_aux_fw_retval;
 static int ec_aux_fw_update_req;
-static VbAuxFwUpdateSeverity_t ec_aux_fw_mock_severity;
-static VbAuxFwUpdateSeverity_t ec_aux_fw_update_severity;
+static enum vb2_auxfw_update_severity ec_aux_fw_mock_severity;
+static enum vb2_auxfw_update_severity ec_aux_fw_update_severity;
 static int ec_aux_fw_protected;
 
 /* Reset mock data (for use before each test) */
@@ -136,18 +136,18 @@ uint32_t VbExIsShutdownRequested(void)
 	return 0;
 }
 
-int VbExTrustEC(int devidx)
+int vb2ex_ec_trusted(void)
 {
 	return !mock_in_rw;
 }
 
-vb2_error_t VbExEcRunningRW(int devidx, int *in_rw)
+vb2_error_t vb2ex_ec_running_rw(int *in_rw)
 {
 	*in_rw = mock_in_rw;
 	return in_rw_retval;
 }
 
-vb2_error_t VbExEcProtect(int devidx, enum VbSelectFirmware_t select)
+vb2_error_t vb2ex_ec_protect(enum vb2_firmware_selection select)
 {
 	if (select == VB_SELECT_FIRMWARE_READONLY)
 		ec_ro_protected = 1;
@@ -156,20 +156,20 @@ vb2_error_t VbExEcProtect(int devidx, enum VbSelectFirmware_t select)
 	return protect_retval;
 }
 
-vb2_error_t VbExEcDisableJump(int devidx)
+vb2_error_t vb2ex_ec_disable_jump(void)
 {
 	return run_retval;
 }
 
-vb2_error_t VbExEcJumpToRW(int devidx)
+vb2_error_t vb2ex_ec_jump_to_rw(void)
 {
 	ec_run_image = 1;
 	mock_in_rw = 1;
 	return run_retval;
 }
 
-vb2_error_t VbExEcHashImage(int devidx, enum VbSelectFirmware_t select,
-			    const uint8_t **hash, int *hash_size)
+vb2_error_t vb2ex_ec_hash_image(enum vb2_firmware_selection select,
+				const uint8_t **hash, int *hash_size)
 {
 	*hash = select == VB_SELECT_FIRMWARE_READONLY ?
 		mock_ec_ro_hash : mock_ec_rw_hash;
@@ -178,8 +178,8 @@ vb2_error_t VbExEcHashImage(int devidx, enum VbSelectFirmware_t select,
 	return *hash_size ? VB2_SUCCESS : VB2_ERROR_MOCK;
 }
 
-vb2_error_t VbExEcGetExpectedImage(int devidx, enum VbSelectFirmware_t select,
-				   const uint8_t **image, int *image_size)
+vb2_error_t vb2ex_ec_get_expected_image(enum vb2_firmware_selection select,
+					const uint8_t **image, int *image_size)
 {
 	static uint8_t fake_image[64] = {5, 6, 7, 8};
 	*image = fake_image;
@@ -187,9 +187,8 @@ vb2_error_t VbExEcGetExpectedImage(int devidx, enum VbSelectFirmware_t select,
 	return get_expected_retval;
 }
 
-vb2_error_t VbExEcGetExpectedImageHash(int devidx,
-				       enum VbSelectFirmware_t select,
-				       const uint8_t **hash, int *hash_size)
+vb2_error_t vb2ex_ec_get_expected_image_hash(enum vb2_firmware_selection select,
+					     const uint8_t **hash, int *hash_size)
 {
 	*hash = want_ec_hash;
 	*hash_size = want_ec_hash_size;
@@ -197,8 +196,8 @@ vb2_error_t VbExEcGetExpectedImageHash(int devidx,
 	return want_ec_hash_size ? VB2_SUCCESS : VB2_ERROR_MOCK;
 }
 
-vb2_error_t VbExEcUpdateImage(int devidx, enum VbSelectFirmware_t select,
-			      const uint8_t *image, int image_size)
+vb2_error_t vb2ex_ec_update_image(enum vb2_firmware_selection select,
+				  const uint8_t *image, int image_size)
 {
 	if (select == VB_SELECT_FIRMWARE_READONLY) {
 		ec_ro_updated = 1;
@@ -219,14 +218,14 @@ vb2_error_t VbDisplayScreen(struct vb2_context *c, uint32_t screen, int force,
 	return VB2_SUCCESS;
 }
 
-vb2_error_t VbExCheckAuxFw(VbAuxFwUpdateSeverity_t *severity)
+vb2_error_t vb2ex_auxfw_check(enum vb2_auxfw_update_severity *severity)
 {
 	*severity = ec_aux_fw_mock_severity;
 	ec_aux_fw_update_severity = ec_aux_fw_mock_severity;
 	return VB2_SUCCESS;
 }
 
-vb2_error_t VbExUpdateAuxFw()
+vb2_error_t vb2ex_auxfw_update()
 {
 	if (ec_aux_fw_update_severity != VB_AUX_FW_NO_DEVICE &&
 	    ec_aux_fw_update_severity != VB_AUX_FW_NO_UPDATE)
@@ -234,7 +233,7 @@ vb2_error_t VbExUpdateAuxFw()
 	return ec_aux_fw_retval;
 }
 
-vb2_error_t VbExEcVbootDone(int in_recovery)
+vb2_error_t vb2ex_ec_vboot_done(struct vb2_context *c)
 {
 	ec_aux_fw_protected = ec_aux_fw_update_severity != VB_AUX_FW_NO_DEVICE;
 	return ec_aux_fw_retval;
diff --git a/tests/vboot_api_kernel2_tests.c b/tests/vboot_api_kernel2_tests.c
index 2017b419..50ee0752 100644
--- a/tests/vboot_api_kernel2_tests.c
+++ b/tests/vboot_api_kernel2_tests.c
@@ -223,7 +223,7 @@ vb2_error_t VbExDiskFreeInfo(VbDiskInfo *infos,
 	return VB2_SUCCESS;
 }
 
-int VbExTrustEC(int devidx)
+int vb2ex_ec_trusted(void)
 {
 	return trust_ec;
 }
diff --git a/tests/vboot_detach_menu_tests.c b/tests/vboot_detach_menu_tests.c
index 7ff49ee8..f0440cfb 100644
--- a/tests/vboot_detach_menu_tests.c
+++ b/tests/vboot_detach_menu_tests.c
@@ -189,7 +189,7 @@ vb2_error_t VbExLegacy(enum VbAltFwIndex_t _altfw_num)
 	return 0;
 }
 
-int VbExTrustEC(int devidx)
+int vb2ex_ec_trusted(void)
 {
 	return trust_ec;
 }