firmware: replace recovery mode flag with physical presence

vboot can query the physical presence flag instead of the recovery
mode flag.  In general, the physical presence flag will map
to the recovery mode button if a board has it, and otherwise will
map to the physical presence button (usually the power button).

Cq-Depend: chromium:1580454
BUG=b:129471321
BRANCH=None
TEST=make runtests.  Built firmware and slashed on sarien.  Verified
that displayed text references power button and that pressing power
button initiates dev mode (vs. powering off the system).

Change-Id: I22f29de192da67b8eece27cbdd5aa64e97717bfc
Signed-off-by: Matt Delco <delco@google.com>
Reviewed-on: https://chromium-review.googlesource.com/1580472
Commit-Ready: Matt Delco <delco@chromium.org>
Tested-by: Matt Delco <delco@chromium.org>
Reviewed-by: Matt Delco <delco@chromium.org>

3 files changed, 37 insertions, 25 deletions

diff --git a/firmware/include/vboot_api.h b/firmware/include/vboot_api.h
index 682e7fc5..c5b382ac 100644
--- a/firmware/include/vboot_api.h
+++ b/firmware/include/vboot_api.h
@@ -204,8 +204,6 @@ typedef struct VbCommonParams {
 } VbCommonParams;
 
 /* Flags for VbExGetSwitches() */
-/* Recovery button was pressed at boot time. */
-#define VB_SWITCH_FLAG_REC_BUTTON_PRESSED	0x00000002
 /* Report if user is currently present (typically via power button) */
 #define VB_SWITCH_FLAG_PHYS_PRESENCE_PRESSED	0x00000004
 /* Allow USB boot on transition to dev */
diff --git a/firmware/lib/include/vboot_kernel.h b/firmware/lib/include/vboot_kernel.h
index 7a8087e4..fe8d7023 100644
--- a/firmware/lib/include/vboot_kernel.h
+++ b/firmware/lib/include/vboot_kernel.h
@@ -93,4 +93,9 @@ uint32_t vb2_get_fwmp_flags(void);
  */
 void vb2_nv_commit(struct vb2_context *ctx);
 
+/**
+ * Reinitialize global state. This should only need to be called by init tests.
+ */
+void vb2_init_ui(void);
+
 #endif  /* VBOOT_REFERENCE_VBOOT_KERNEL_H_ */
diff --git a/firmware/lib/vboot_ui.c b/firmware/lib/vboot_ui.c
index 6009d90d..60afadc9 100644
--- a/firmware/lib/vboot_ui.c
+++ b/firmware/lib/vboot_ui.c
@@ -28,11 +28,15 @@
 #include "vboot_ui_common.h"
 
 /* Global variables */
-static int power_button_released;
+enum {
+	POWER_BUTTON_HELD_SINCE_BOOT = 0,
+	POWER_BUTTON_RELEASED,
+	POWER_BUTTON_PRESSED, /* must have been previously released */
+} power_button_state;
 
-static void vb2_init_ui(void)
+void vb2_init_ui(void)
 {
-	power_button_released = 0;
+	power_button_state = POWER_BUTTON_HELD_SINCE_BOOT;
 }
 
 static void VbAllowUsbBoot(struct vb2_context *ctx)
@@ -58,13 +62,17 @@ static int VbWantShutdown(struct vb2_context *ctx, uint32_t key)
 	/*
 	 * Ignore power button push until after we have seen it released.
 	 * This avoids shutting down immediately if the power button is still
-	 * being held on startup.
+	 * being held on startup. After we've recognized a valid power button
+	 * push then don't report the event until after the button is released.
 	 */
 	if (shutdown_request & VB_SHUTDOWN_REQUEST_POWER_BUTTON) {
-		if (!power_button_released)
-			shutdown_request &= ~VB_SHUTDOWN_REQUEST_POWER_BUTTON;
+		shutdown_request &= ~VB_SHUTDOWN_REQUEST_POWER_BUTTON;
+		if (power_button_state == POWER_BUTTON_RELEASED)
+			power_button_state = POWER_BUTTON_PRESSED;
 	} else {
-		power_button_released = 1;
+		if (power_button_state == POWER_BUTTON_PRESSED)
+			shutdown_request |= VB_SHUTDOWN_REQUEST_POWER_BUTTON;
+		power_button_state = POWER_BUTTON_RELEASED;
 	}
 
 	if (key == VB_BUTTON_POWER_SHORT_PRESS)
@@ -107,15 +115,15 @@ int VbUserConfirms(struct vb2_context *ctx, uint32_t confirm_flags)
 	uint32_t key;
 	uint32_t key_flags;
 	uint32_t btn;
-	int rec_button_was_pressed = 0;
+	int phys_presence_button_was_pressed = 0;
+	int shutdown_requested = 0;
 
 	VB2_DEBUG("Entering(%x)\n", confirm_flags);
 
 	/* Await further instructions */
-	while (1) {
+	do {
 		key = VbExKeyboardReadWithFlags(&key_flags);
-		if (VbWantShutdown(ctx, key))
-			return -1;
+		shutdown_requested = VbWantShutdown(ctx, key);
 		switch (key) {
 		case VB_KEY_ENTER:
 			/* If we require a trusted keyboard for confirmation,
@@ -145,26 +153,28 @@ int VbUserConfirms(struct vb2_context *ctx, uint32_t confirm_flags)
 			return 0;
 			break;
 		default:
-			/* If the recovery button is physical, and is pressed,
-			 * this is also a YES, but must wait for release.
+			/* If the physical presence button is physical, and is
+			 * pressed, this is also a YES, but must wait for
+			 * release.
 			 */
 			btn = VbExGetSwitches(
-				VB_SWITCH_FLAG_REC_BUTTON_PRESSED);
+				VB_SWITCH_FLAG_PHYS_PRESENCE_PRESSED);
 			if (!(shared->flags & VBSD_BOOT_REC_SWITCH_VIRTUAL)) {
 				if (btn) {
-					VB2_DEBUG("Rec button pressed\n");
-					rec_button_was_pressed = 1;
-				} else if (rec_button_was_pressed) {
-					VB2_DEBUG("Rec button (1)\n");
+					VB2_DEBUG("Presence button pressed, "
+						  "awaiting release\n");
+					phys_presence_button_was_pressed = 1;
+				} else if (phys_presence_button_was_pressed) {
+					VB2_DEBUG("Presence button released "
+						  "(1)\n");
 					return 1;
 				}
 			}
 			VbCheckDisplayKey(ctx, key, NULL);
 		}
 		VbExSleepMs(CONFIRM_KEY_DELAY);
-	}
+	} while (!shutdown_requested);
 
-	/* Not reached, but compiler will complain without it */
 	return -1;
 }
 
@@ -888,9 +898,9 @@ static VbError_t recovery_ui(struct vb2_context *ctx)
 				if (!(shared->flags &
 				      VBSD_BOOT_REC_SWITCH_VIRTUAL) &&
 				    VbExGetSwitches(
-				    VB_SWITCH_FLAG_REC_BUTTON_PRESSED)) {
+				    VB_SWITCH_FLAG_PHYS_PRESENCE_PRESSED)) {
 					/*
-					 * Is the recovery button stuck?  In
+					 * Is the presence button stuck?  In
 					 * any case we don't like this.  Beep
 					 * and ignore.
 					 */
@@ -949,7 +959,6 @@ static VbError_t recovery_ui(struct vb2_context *ctx)
 
 VbError_t VbBootRecovery(struct vb2_context *ctx)
 {
-	vb2_init_ui();
 	VbError_t retval = recovery_ui(ctx);
 	VbDisplayScreen(ctx, VB_SCREEN_BLANK, 0, NULL);
 	return retval;