GNUBoot
/
coreboot-kgpe-d16
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

vboot: Drop argument to select slot from `vb2ex_ec_protect()` 

vboot code changes have eliminated the redundant call to WP the EC-RO
region as protecting RW flash implies protecting both RO and RW flash,
so the call to protect RO is redundant. google/rex currently takes
about 17 ms to lock down the EC.

Along with vboot changes, this patch drops argument to choose between
RO and RW slot to protect while calling into `vb2ex_ec_protect()`.
It ensures vb2ex_ec_protect() is explicitly meant for protecting RW
regions.

w/o this patch:

517:waiting for EC to allow higher power draw  846,196 (17,297)

w/ this patch:

517:waiting for EC to allow higher power draw  838,258 (9,719)

Additionally, update vboot submodule to upstream main to avoid the
compilation error.

Updating from commit id 35f50c3154e5:
   Fix build error when compiling without -DNDEBUG
to commit id 034907b279c9db:
   vboot_reference: eliminate redundant call to write protect EC-RO

Change-Id: I2974f0cb43ba800c2aaeac4876ebaa052b5ee793
Signed-off-by: Subrata Banik <subratabanik@google.com>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/75521
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Himanshu Sahdev <himanshu.sahdev@intel.com>
Reviewed-by: Harsha B R <harsha.b.r@intel.com>
Reviewed-by: Julius Werner <jwerner@chromium.org>
This commit is contained in:
Subrata Banik 2023-06-03 16:42:46 +05:30
parent 0c7292f993
commit 5b0929f9d7
2 changed files with 5 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
3rdparty/vboot vendored

@ -1 +1 @@
Subproject commit 35f50c3154e58821cc027bf13be2b949bc4c90f3
Subproject commit 034907b279c9db1faa7dd5633fa1140436433768

11
src/security/vboot/ec_sync.c
View File

@ -186,15 +186,12 @@ static vb2_error_t ec_hash_image(enum vb2_firmware_selection select,
/*
* Asks the EC to protect or unprotect the specified flash region.
*/
static vb2_error_t ec_protect_flash(enum vb2_firmware_selection select, int enable)
static vb2_error_t ec_protect_flash(int enable)
{
struct ec_response_flash_protect resp;
uint32_t protected_region = EC_FLASH_PROTECT_ALL_NOW;
const uint32_t mask = EC_FLASH_PROTECT_ALL_NOW | EC_FLASH_PROTECT_ALL_AT_BOOT;
if (select == VB_SELECT_FIRMWARE_READONLY)
protected_region = EC_FLASH_PROTECT_RO_NOW;
if (google_chromeec_flash_protect(mask, enable ? mask : 0, &resp) != 0)
return VB2_ERROR_UNKNOWN;
@ -331,7 +328,7 @@ static vb2_error_t ec_update_image(enum vb2_firmware_selection select)
size_t image_size;
/* Un-protect the flash region */
rv = ec_protect_flash(select, 0);
rv = ec_protect_flash(0);
if (rv != VB2_SUCCESS)
return rv;
@ -490,9 +487,9 @@ vb2_error_t vb2ex_ec_hash_image(enum vb2_firmware_selection select,
/*
* Vboot callback for EC flash protection.
*/
vb2_error_t vb2ex_ec_protect(enum vb2_firmware_selection select)
vb2_error_t vb2ex_ec_protect(void)
{
return ec_protect_flash(select, 1);
return ec_protect_flash(1);
}
/*