From 5b0929f9d7e6ec4339471be365416a1991baae33 Mon Sep 17 00:00:00 2001 From: Subrata Banik Date: Sat, 3 Jun 2023 16:42:46 +0530 Subject: vboot: Drop argument to select slot from `vb2ex_ec_protect()` MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit vboot code changes have eliminated the redundant call to WP the EC-RO region as protecting RW flash implies protecting both RO and RW flash, so the call to protect RO is redundant. google/rex currently takes about 17 ms to lock down the EC. Along with vboot changes, this patch drops argument to choose between RO and RW slot to protect while calling into `vb2ex_ec_protect()`. It ensures vb2ex_ec_protect() is explicitly meant for protecting RW regions. w/o this patch: 517:waiting for EC to allow higher power draw 846,196 (17,297) w/ this patch: 517:waiting for EC to allow higher power draw 838,258 (9,719) Additionally, update vboot submodule to upstream main to avoid the compilation error. Updating from commit id 35f50c3154e5: Fix build error when compiling without -DNDEBUG to commit id 034907b279c9db: vboot_reference: eliminate redundant call to write protect EC-RO Change-Id: I2974f0cb43ba800c2aaeac4876ebaa052b5ee793 Signed-off-by: Subrata Banik Reviewed-on: https://review.coreboot.org/c/coreboot/+/75521 Tested-by: build bot (Jenkins) Reviewed-by: Himanshu Sahdev Reviewed-by: Harsha B R Reviewed-by: Julius Werner --- src/security/vboot/ec_sync.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) (limited to 'src/security/vboot') diff --git a/src/security/vboot/ec_sync.c b/src/security/vboot/ec_sync.c index 47a6dbd350..ac65dbd189 100644 --- a/src/security/vboot/ec_sync.c +++ b/src/security/vboot/ec_sync.c @@ -186,15 +186,12 @@ static vb2_error_t ec_hash_image(enum vb2_firmware_selection select, /* * Asks the EC to protect or unprotect the specified flash region. */ -static vb2_error_t ec_protect_flash(enum vb2_firmware_selection select, int enable) +static vb2_error_t ec_protect_flash(int enable) { struct ec_response_flash_protect resp; uint32_t protected_region = EC_FLASH_PROTECT_ALL_NOW; const uint32_t mask = EC_FLASH_PROTECT_ALL_NOW | EC_FLASH_PROTECT_ALL_AT_BOOT; - if (select == VB_SELECT_FIRMWARE_READONLY) - protected_region = EC_FLASH_PROTECT_RO_NOW; - if (google_chromeec_flash_protect(mask, enable ? mask : 0, &resp) != 0) return VB2_ERROR_UNKNOWN; @@ -331,7 +328,7 @@ static vb2_error_t ec_update_image(enum vb2_firmware_selection select) size_t image_size; /* Un-protect the flash region */ - rv = ec_protect_flash(select, 0); + rv = ec_protect_flash(0); if (rv != VB2_SUCCESS) return rv; @@ -490,9 +487,9 @@ vb2_error_t vb2ex_ec_hash_image(enum vb2_firmware_selection select, /* * Vboot callback for EC flash protection. */ -vb2_error_t vb2ex_ec_protect(enum vb2_firmware_selection select) +vb2_error_t vb2ex_ec_protect(void) { - return ec_protect_flash(select, 1); + return ec_protect_flash(1); } /* -- cgit v1.2.3