vboot: push clear recovery mode switch until BS_WRITE_TABLES

Serves two purposes:

(1) On some platforms, FSP initialization may cause a reboot.
Push clearing the recovery mode switch until after FSP code runs,
so that a manual recovery request (three-finger salute) will
function correctly under this condition.

(2) The recovery mode switch value is needed at BS_WRITE_TABLES
for adding an event to elog.  (Previously this was done by
stashing the value in CBMEM_ID_EC_HOSTEVENT.)

BUG=b:124141368, b:35576380
TEST=make clean && make test-abuild
BRANCH=none

Change-Id: I30c02787c620b937e5a50a5ed94ac906e3112dad
Signed-off-by: Joel Kitching <kitching@google.com>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/38779
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Julius Werner <jwerner@chromium.org>

src/commonlib/include/commonlib/cbmem_id.h

@@ -72,7 +72,7 @@
 #define CBMEM_ID_VBOOT_WORKBUF	0x78007343
 #define CBMEM_ID_VPD		0x56504420
 #define CBMEM_ID_WIFI_CALIBRATION 0x57494649
-#define CBMEM_ID_EC_HOSTEVENT	0x63ccbbc3
+#define CBMEM_ID_EC_HOSTEVENT	0x63ccbbc3  /* deprecated */
 #define CBMEM_ID_EXT_VBT	0x69866684
 #define CBMEM_ID_ROM0		0x524f4d30
 #define CBMEM_ID_ROM1		0x524f4d31

src/ec/google/chromeec/ec.c

@@ -81,41 +81,6 @@ static const struct {
 	},
 };
 
-void log_recovery_mode_switch(void)
-{
-	uint64_t *events;
-
-	if (cbmem_find(CBMEM_ID_EC_HOSTEVENT))
-		return;
-
-	events = cbmem_add(CBMEM_ID_EC_HOSTEVENT, sizeof(*events));
-	if (!events)
-		return;
-
-	*events = google_chromeec_get_events_b();
-}
-
-static void google_chromeec_elog_add_recovery_event(void *unused)
-{
-	uint64_t *events = cbmem_find(CBMEM_ID_EC_HOSTEVENT);
-	uint8_t event_byte = EC_HOST_EVENT_KEYBOARD_RECOVERY;
-
-	if (!events)
-		return;
-
-	if (!(*events & EC_HOST_EVENT_MASK(EC_HOST_EVENT_KEYBOARD_RECOVERY)))
-		return;
-
-	if (*events &
-	    EC_HOST_EVENT_MASK(EC_HOST_EVENT_KEYBOARD_RECOVERY_HW_REINIT))
-		event_byte = EC_HOST_EVENT_KEYBOARD_RECOVERY_HW_REINIT;
-
-	elog_add_event_byte(ELOG_TYPE_EC_EVENT, event_byte);
-}
-
-BOOT_STATE_INIT_ENTRY(BS_WRITE_TABLES, BS_ON_ENTRY,
-		      google_chromeec_elog_add_recovery_event, NULL);
-
 uint8_t google_chromeec_calc_checksum(const uint8_t *data, int size)
 {
 	int csum;

src/ec/google/chromeec/switches.c

@@ -14,8 +14,8 @@
  */
 
 #include <bootmode.h>
-#include <cbmem.h>
 #include <ec/google/chromeec/ec.h>
+#include <elog.h>
 
 #if CONFIG(EC_GOOGLE_CHROMEEC_LPC)
 int get_lid_switch(void)
@@ -41,29 +41,33 @@ int get_recovery_mode_switch(void)
 
 int get_recovery_mode_retrain_switch(void)
 {
-	uint64_t events;
-	const uint64_t mask =
-		EC_HOST_EVENT_MASK(EC_HOST_EVENT_KEYBOARD_RECOVERY_HW_REINIT);
-
 	/*
 	 * Check if the EC has posted the keyboard recovery event with memory
 	 * retrain.
 	 */
-	events = google_chromeec_get_events_b();
+	return !!(google_chromeec_get_events_b() &
-
+		  EC_HOST_EVENT_MASK(EC_HOST_EVENT_KEYBOARD_RECOVERY_HW_REINIT));
-	if (cbmem_possibly_online()) {
-		const uint64_t *events_save;
-
-		events_save = cbmem_find(CBMEM_ID_EC_HOSTEVENT);
-		if (events_save != NULL)
-			events |= *events_save;
 }
 
-	return !!(events & mask);
+static void elog_add_recovery_mode_switch_event(void)
+{
+	uint64_t events = google_chromeec_get_events_b();
+	uint8_t event_byte = EC_HOST_EVENT_KEYBOARD_RECOVERY;
+
+	if (!(events & EC_HOST_EVENT_MASK(EC_HOST_EVENT_KEYBOARD_RECOVERY)))
+		return;
+
+	if (events & EC_HOST_EVENT_MASK(EC_HOST_EVENT_KEYBOARD_RECOVERY_HW_REINIT))
+		event_byte = EC_HOST_EVENT_KEYBOARD_RECOVERY_HW_REINIT;
+
+	elog_add_event_byte(ELOG_TYPE_EC_EVENT, event_byte);
 }
 
 int clear_recovery_mode_switch(void)
 {
+	/* Log elog event before clearing */
+	elog_add_recovery_mode_switch_event();
+
 	/* Clear all host event bits requesting recovery mode. */
 	return google_chromeec_clear_events_b(
 		EC_HOST_EVENT_MASK(EC_HOST_EVENT_KEYBOARD_RECOVERY) |

src/include/bootmode.h

@@ -22,7 +22,6 @@ int get_write_protect_state(void);
 int get_recovery_mode_switch(void);
 int get_recovery_mode_retrain_switch(void);
 int clear_recovery_mode_switch(void);
-void log_recovery_mode_switch(void);
 int get_wipeout_mode_switch(void);
 int get_lid_switch(void);
 

src/mainboard/intel/galileo/vboot.c

@@ -24,12 +24,6 @@
 #include "gen1.h"
 #include "gen2.h"
 
-int clear_recovery_mode_switch(void)
-{
-	/* Nothing to do */
-	return 0;
-}
-
 int get_recovery_mode_switch(void)
 {
 	return 0;
@@ -41,10 +35,6 @@ int get_write_protect_state(void)
 	return 0;
 }
 
-void log_recovery_mode_switch(void)
-{
-}
-
 void verstage_mainboard_init(void)
 {
 	const struct reg_script *script;

src/mainboard/intel/kblrvp/chromeos.c

@@ -62,16 +62,6 @@ int get_recovery_mode_switch(void)
 	return 0;
 }
 
-int clear_recovery_mode_switch(void)
-{
-	if (CONFIG(EC_GOOGLE_CHROMEEC))
-		/* Clear keyboard recovery event. */
-		return google_chromeec_clear_events_b(
-			EC_HOST_EVENT_MASK(EC_HOST_EVENT_KEYBOARD_RECOVERY));
-
-	return 0;
-}
-
 int get_write_protect_state(void)
 {
 	/* No write protect */

src/security/vboot/bootmode.c

@@ -101,14 +101,27 @@ int vboot_recovery_mode_enabled(void)
 
 int __weak clear_recovery_mode_switch(void)
 {
-	// Weak implementation. Nothing to do.
 	return 0;
 }
 
-void __weak log_recovery_mode_switch(void)
+static void do_clear_recovery_mode_switch(void *unused)
 {
-	// Weak implementation. Nothing to do.
+	if (vboot_get_context()->flags & VB2_CONTEXT_FORCE_RECOVERY_MODE)
+		clear_recovery_mode_switch();
 }
+/*
+ * The recovery mode switch (typically backed by EC) is not cleared until
+ * BS_WRITE_TABLES for two reasons:
+ *
+ * (1) On some platforms, FSP initialization may cause a reboot.  Push clearing
+ * the recovery mode switch until after FSP code runs, so that a manual recovery
+ * request (three-finger salute) will function correctly under this condition.
+ *
+ * (2) To give the implementation of clear_recovery_mode_switch a chance to
+ * add an event to elog.  See the function in chromeec/switches.c.
+ */
+BOOT_STATE_INIT_ENTRY(BS_WRITE_TABLES, BS_ON_ENTRY,
+		      do_clear_recovery_mode_switch, NULL);
 
 int __weak get_recovery_mode_retrain_switch(void)
 {

src/security/vboot/vboot_logic.c

@@ -248,26 +248,6 @@ static uint32_t extend_pcrs(struct vb2_context *ctx)
 		   vboot_extend_pcr(ctx, 1, HWID_DIGEST_PCR);
 }
 
-static void vboot_log_and_clear_recovery_mode_switch(int unused)
-{
-	/* Log the recovery mode switches if required, before clearing them. */
-	log_recovery_mode_switch();
-
-	/*
-	 * The recovery mode switch is cleared (typically backed by EC) here
-	 * to allow multiple queries to get_recovery_mode_switch() and have
-	 * them return consistent results during the verified boot path as well
-	 * as dram initialization. x86 systems ignore the saved dram settings
-	 * in the recovery path in order to start from a clean slate. Therefore
-	 * clear the state here since this function is called when memory
-	 * is known to be up.
-	 */
-	clear_recovery_mode_switch();
-}
-#if !CONFIG(VBOOT_STARTS_IN_ROMSTAGE)
-ROMSTAGE_CBMEM_INIT_HOOK(vboot_log_and_clear_recovery_mode_switch)
-#endif
-
 /**
  * Verify and select the firmware in the RW image
  *
@@ -428,11 +408,6 @@ void verstage_main(void)
 	       vboot_is_firmware_slot_a(ctx) ? 'A' : 'B');
 
  verstage_main_exit:
-	/* If CBMEM is not up yet, let the ROMSTAGE_CBMEM_INIT_HOOK take care
-	   of running this function. */
-	if (ENV_ROMSTAGE && CONFIG(VBOOT_STARTS_IN_ROMSTAGE))
-		vboot_log_and_clear_recovery_mode_switch(0);
-
 	/* Save recovery reason in case of unexpected reboots on x86. */
 	vboot_save_recovery_reason_vbnv();