Add broken screen

In the new recovery process, a user will see 'broken' screen
instead of 'remove' screen, where usb stick presence is no longer
detected. A user instead has to hit esc+refresh+power to proceed
to recovery mode.

BUG=chromium:501060
BRANCH=tot
TEST=make runtests

Change-Id: Icd511c1ca892628b96befbb0a34c2c84b881c857
Reviewed-on: https://chromium-review.googlesource.com/304404
Commit-Ready: Daisuke Nojiri <dnojiri@chromium.org>
Tested-by: Daisuke Nojiri <dnojiri@chromium.org>
Reviewed-by: Randall Spangler <rspangler@chromium.org>

6 files changed, 28 insertions, 87 deletions

diff --git a/firmware/include/bmpblk_header.h b/firmware/include/bmpblk_header.h
index 4889a6a8..bdc118a0 100644
--- a/firmware/include/bmpblk_header.h
+++ b/firmware/include/bmpblk_header.h
@@ -93,6 +93,7 @@ typedef enum ScreenIndex {
 	SCREEN_DEVELOPER_TO_NORM,
 	SCREEN_WAIT,
 	SCREEN_TO_NORM_CONFIRMED,
+	SCREEN_OS_BROKEN,
 	MAX_VALID_SCREEN_INDEX,
 	SCREEN_BLANK = ~0UL,
 } ScreenIndex;
diff --git a/firmware/include/vboot_api.h b/firmware/include/vboot_api.h
index 7e94773e..4d2d616d 100644
--- a/firmware/include/vboot_api.h
+++ b/firmware/include/vboot_api.h
@@ -735,6 +735,8 @@ enum VbScreenType_t {
 	VB_SCREEN_WAIT              = 0x206,
 	/* Confirm after DEVELOPER_TO_NORM */
 	VB_SCREEN_TO_NORM_CONFIRMED = 0x207,
+	/* Broken screen shown after verification failure */
+	VB_SCREEN_OS_BROKEN         = 0x208,
 };
 
 /**
diff --git a/firmware/lib/vboot_api_kernel.c b/firmware/lib/vboot_api_kernel.c
index 312014bd..0456123b 100644
--- a/firmware/lib/vboot_api_kernel.c
+++ b/firmware/lib/vboot_api_kernel.c
@@ -464,63 +464,24 @@ VbError_t VbBootRecovery(VbCommonParams *cparams, LoadKernelParams *p)
 
 	/*
 	 * If the dev-mode switch is off and the user didn't press the recovery
-	 * button, require removal of all external media.
+	 * button (recovery was triggerred automatically), show 'broken' screen.
+	 * The user can either only shutdown to abort or hit esc+refresh+power
+	 * to initiate recovery as instructed on the screen.
 	 */
 	if (!(shared->flags & VBSD_BOOT_DEV_SWITCH_ON) &&
 	    !(shared->flags & VBSD_BOOT_REC_SWITCH_ON)) {
-		VbDiskInfo *disk_info = NULL;
-		uint32_t disk_count = 0;
-
-		VBDEBUG(("VbBootRecovery() forcing device removal\n"));
-
-		/* If no media is detected initially, delay and make one extra
-		 * attempt, in case devices appear later than expected. */
-		if (VBERROR_SUCCESS != VbExDiskGetInfo(&disk_info, &disk_count,
-						       VB_DISK_FLAG_REMOVABLE))
-			disk_count = 0;
-
-		VbExDiskFreeInfo(disk_info, NULL);
-		if (0 == disk_count)
-			VbExSleepMs(REC_MEDIA_INIT_DELAY);
-
+		VBDEBUG(("VbBootRecovery() waiting for manual recovery\n"));
+		VbDisplayScreen(cparams, VB_SCREEN_OS_BROKEN, 0, &vnc);
 		while (1) {
-			disk_info = NULL;
-			disk_count = 0;
-			if (VBERROR_SUCCESS !=
-			    VbExDiskGetInfo(&disk_info, &disk_count,
-					    VB_DISK_FLAG_REMOVABLE))
-				disk_count = 0;
-
-			VbExDiskFreeInfo(disk_info, NULL);
-
-			if (0 == disk_count) {
-				VbDisplayScreen(cparams, VB_SCREEN_BLANK,
-						0, &vnc);
-				break;
-			}
-
-			VBDEBUG(("VbBootRecovery() "
-				 "waiting for %d disks to be removed\n",
-				 (int)disk_count));
-
-			VbDisplayScreen(cparams, VB_SCREEN_RECOVERY_REMOVE,
-					0, &vnc);
-
-			/*
-			 * Scan keyboard more frequently than media, since x86
-			 * platforms don't like to scan USB too rapidly.
-			 */
-			for (i = 0; i < REC_DISK_DELAY; i += REC_KEY_DELAY) {
-				VbCheckDisplayKey(cparams, VbExKeyboardRead(),
-						  &vnc);
-				if (VbWantShutdown(cparams->gbb->flags))
-					return VBERROR_SHUTDOWN_REQUESTED;
-				VbExSleepMs(REC_KEY_DELAY);
-			}
+			VbCheckDisplayKey(cparams, VbExKeyboardRead(), &vnc);
+			if (VbWantShutdown(cparams->gbb->flags))
+				return VBERROR_SHUTDOWN_REQUESTED;
+			VbExSleepMs(REC_KEY_DELAY);
 		}
 	}
 
 	/* Loop and wait for a recovery image */
+	VBDEBUG(("VbBootRecovery() waiting for a recovery image\n"));
 	while (1) {
 		VBDEBUG(("VbBootRecovery() attempting to load kernel2\n"));
 		retval = VbTryLoadKernel(cparams, p, VB_DISK_FLAG_REMOVABLE);
diff --git a/firmware/lib/vboot_display.c b/firmware/lib/vboot_display.c
index edcb3ebf..311bc8ef 100644
--- a/firmware/lib/vboot_display.c
+++ b/firmware/lib/vboot_display.c
@@ -188,6 +188,9 @@ VbError_t VbDisplayScreenFromGBB(VbCommonParams *cparams, uint32_t screen,
 	case VB_SCREEN_TO_NORM_CONFIRMED:
 		screen_index = SCREEN_TO_NORM_CONFIRMED;
 		break;
+	case VB_SCREEN_OS_BROKEN:
+		screen_index = SCREEN_OS_BROKEN;
+		break;
 	case VB_SCREEN_BLANK:
 	case VB_SCREEN_DEVELOPER_EGG:
 	default:
diff --git a/tests/vboot_api_devmode_tests.c b/tests/vboot_api_devmode_tests.c
index 925a146b..62441f75 100644
--- a/tests/vboot_api_devmode_tests.c
+++ b/tests/vboot_api_devmode_tests.c
@@ -285,6 +285,9 @@ VbError_t VbExDisplayScreen(uint32_t screen_type) {
   case VB_SCREEN_RECOVERY_NO_GOOD:
     VBDEBUG(("VbExDisplayScreen(NO_GOOD)\n"));
     break;
+  case VB_SCREEN_OS_BROKEN:
+    VBDEBUG(("VbExDisplayScreen(BROKEN)\n"));
+    break;
   default:
     VBDEBUG(("VbExDisplayScreen(%d)\n", screen_type));
   }
diff --git a/tests/vboot_api_kernel2_tests.c b/tests/vboot_api_kernel2_tests.c
index fe0a46a7..6420d518 100644
--- a/tests/vboot_api_kernel2_tests.c
+++ b/tests/vboot_api_kernel2_tests.c
@@ -462,26 +462,8 @@ static void VbBootRecTest(void)
 
 	VbNvGet(VbApiKernelGetVnc(), VBNV_RECOVERY_REQUEST, &u);
 	TEST_EQ(u, 0, "  recovery reason");
-	TEST_EQ(screens_displayed[0], VB_SCREEN_BLANK,
-		"  blank screen");
-	TEST_EQ(screens_displayed[1], VB_SCREEN_RECOVERY_NO_GOOD,
-		"  no good screen");
-
-	/* Disk inserted after start */
-	ResetMocks();
-	vbtlk_retval = VBERROR_SUCCESS - VB_DISK_FLAG_REMOVABLE;
-	TEST_EQ(VbBootRecovery(&cparams, &lkp), 0, "Good");
-
-	/* No disk inserted */
-	ResetMocks();
-	vbtlk_retval = VBERROR_NO_DISK_FOUND - VB_DISK_FLAG_REMOVABLE;
-	shutdown_request_calls_left = 10;
-	TEST_EQ(VbBootRecovery(&cparams, &lkp), VBERROR_SHUTDOWN_REQUESTED,
-		"Bad disk");
-	TEST_EQ(screens_displayed[0], VB_SCREEN_BLANK,
-		"  blank screen");
-	TEST_EQ(screens_displayed[1], VB_SCREEN_RECOVERY_INSERT,
-		"  insert screen");
+	TEST_EQ(screens_displayed[0], VB_SCREEN_OS_BROKEN,
+		"  broken screen");
 
 	/* Remove disks */
 	ResetMocks();
@@ -492,14 +474,8 @@ static void VbBootRecTest(void)
 	vbtlk_retval = VBERROR_NO_DISK_FOUND - VB_DISK_FLAG_REMOVABLE;
 	TEST_EQ(VbBootRecovery(&cparams, &lkp), VBERROR_SHUTDOWN_REQUESTED,
 		"Remove");
-	TEST_EQ(screens_displayed[0], VB_SCREEN_RECOVERY_REMOVE,
-		"  remove screen");
-	TEST_EQ(screens_displayed[1], VB_SCREEN_RECOVERY_REMOVE,
-		"  remove screen");
-	TEST_EQ(screens_displayed[2], VB_SCREEN_BLANK,
-		"  blank screen");
-	TEST_EQ(screens_displayed[3], VB_SCREEN_RECOVERY_INSERT,
-		"  insert screen");
+	TEST_EQ(screens_displayed[0], VB_SCREEN_OS_BROKEN,
+		"  broken screen");
 
 	/* No removal if dev switch is on */
 	ResetMocks();
@@ -533,24 +509,19 @@ static void VbBootRecTest(void)
 	vbtlk_retval = VBERROR_NO_DISK_FOUND - VB_DISK_FLAG_REMOVABLE;
 	TEST_EQ(VbBootRecovery(&cparams, &lkp), VBERROR_SHUTDOWN_REQUESTED,
 		"Remove");
-	TEST_EQ(screens_displayed[0], VB_SCREEN_RECOVERY_REMOVE,
-		"  remove screen");
-	TEST_EQ(screens_displayed[1], VB_SCREEN_BLANK,
-		"  blank screen");
-	TEST_EQ(screens_displayed[2], VB_SCREEN_RECOVERY_INSERT,
-		"  insert screen");
+	TEST_EQ(screens_displayed[0], VB_SCREEN_OS_BROKEN,
+		"  broken screen");
 
 	/* Bad disk count doesn't require removal */
 	ResetMocks();
+	shutdown_request_calls_left = 100;
 	mock_num_disks[0] = -1;
 	vbtlk_retval = VBERROR_NO_DISK_FOUND - VB_DISK_FLAG_REMOVABLE;
 	shutdown_request_calls_left = 10;
 	TEST_EQ(VbBootRecovery(&cparams, &lkp), VBERROR_SHUTDOWN_REQUESTED,
 		"Bad disk count");
-	TEST_EQ(screens_displayed[0], VB_SCREEN_BLANK,
-		"  blank screen");
-	TEST_EQ(screens_displayed[1], VB_SCREEN_RECOVERY_INSERT,
-		"  insert screen");
+	TEST_EQ(screens_displayed[0], VB_SCREEN_OS_BROKEN,
+		"  broken screen");
 
 	/* Ctrl+D ignored for many reasons... */
 	ResetMocks();