Don't use bogus gbb address when booting up rewriteable firmware.

https://gerrit.chromium.org/gerrit/11152 introduced a bug where the
gbb pointer used during rewriteable firmware boot is bogus.

The pointer is retrieved from the 'chromeos-config' section of the
device tree, but on x86 platform this memory area is never
initialized. The fix is to make sure that the proper gbb address in
the CPU address space is used before gbb contents are accessed.

What it boils down to is that when CONFIG_HARDWARE_MAPPED_SPI is set,
gbb address should be determined before setup_gbb_and_cdata() is
called.

To accomplish that fdt_decode_twostop_fmap() is being modified to
retrieve the flash base address among other things. Calling this
function before setup_gbb_and_cdata() allows to assign the gbb pointer
before it is used.

`google-binary-block' is not yet being removed from the cromeos-config
section of the device tree as this could break some tests.

BUG=chromium-os:22528
BUG=chrome-os-partner:7155
TEST=manual
  . build a new firmware image and program it on a Lumpy
  . verify that the device comes up as expected
  . modify the firmware to use read/write path as suggested by hungte@
     cd ~/trunk/src/platform/vboot_reference/scripts/image_signing
      ./resign_firmwarefd.sh /build/lumpy/firmware/image.bin \
          /build/lumpy/firmware/new_image.bin \
         ../../tests/devkeys/firmware_data_key.vbprivk \
         ../../tests/devkeys/firmware.keyblock \
         ../../tests/devkeys/firmware_data_key.vbprivk \
         ../../tests/devkeys/firmware.keyblock \
         ../../tests/devkeys/kernel_subkey.vbpubk \
         1 0
  . put new_image.bin into a lumpy flashrom
  . reboot the device
  . observe it come up, printing on the console
    'vboot_twostop: jump to readwrite main firmware at 0x1110000, size 0xdffc0'
    along the way

Change-Id: Ieeaadafdf31ee6199a6f1fce0b9684dd494a7602
Signed-off-by: Vadim Bendebury <vbendeb@chromium.org>
Reviewed-on: https://gerrit.chromium.org/gerrit/12969
Reviewed-by: Simon Glass <sjg@chromium.org>

1 files changed, 20 insertions, 8 deletions

diff --git a/common/cmd_vboot_twostop.c b/common/cmd_vboot_twostop.c
index bf19763d0f..8659b66b3a 100644
--- a/common/cmd_vboot_twostop.c
+++ b/common/cmd_vboot_twostop.c
@@ -661,9 +661,11 @@ twostop_main_firmware(struct twostop_fmap *fmap, void *gbb,
 }
 
 /**
- * Get address of the gbb and cdata, and optionally verify them.
+ * Get address of the cdata (and gbb, if not mapping SPI flash directly), and
+ * optionally verify them.
  *
- * @param gbb		returns pointer to GBB
+ * @param gbb returns pointer to GBB when SPI flash is not mapped directly.
+ *            Contains pointer to gbb otherwise.
  * @param cdata		returns pointer to crossystem data
  * @param verify	1 to verify data, 0 to skip this step
  * @return 0 if ok, -1 on error
@@ -676,11 +678,18 @@ static int setup_gbb_and_cdata(void **gbb, crossystem_data_t **cdata,
 #ifndef CONFIG_HARDWARE_MAPPED_SPI
 	*gbb = fdt_decode_chromeos_alloc_region(gd->blob,
 			"google-binary-block", &size);
+
+	if (!*gbb) {
+		VBDEBUG(PREFIX "google-binary-block missing "
+			"from fdt, or malloc failed\n");
+		return -1;
+	}
+
 #endif
 	*cdata = fdt_decode_chromeos_alloc_region(gd->blob, "cros-system-data",
 						 &size);
-	if (!*gbb || !*cdata) {
-		VBDEBUG(PREFIX "google-binary-block/cros-system-data missing "
+	if (!*cdata) {
+		VBDEBUG(PREFIX "cros-system-data missing "
 				"from fdt, or malloc failed\n");
 		return -1;
 	}
@@ -695,7 +704,7 @@ static int setup_gbb_and_cdata(void **gbb, crossystem_data_t **cdata,
 	}
 
 	if (verify && gbb_check_integrity(*gbb)) {
-		VBDEBUG(PREFIX "invalid gbb\n");
+		VBDEBUG(PREFIX "invalid gbb at %p\n", *gbb);
 		return -1;
 	}
 	return 0;
@@ -778,15 +787,18 @@ twostop_readwrite_main_firmware(void)
 	crossystem_data_t *cdata;
 	void *gbb;
 
-	if (setup_gbb_and_cdata(&gbb, &cdata, 1))
-		return VB_SELECT_ERROR;
-
 	if (fdt_decode_twostop_fmap(gd->blob, &fmap)) {
 		VBDEBUG(PREFIX "failed to decode fmap\n");
 		return VB_SELECT_ERROR;
 	}
 	dump_fmap(&fmap);
 
+#ifdef CONFIG_HARDWARE_MAPPED_SPI
+	gbb = (void *) (fmap.readonly.gbb.offset + fmap.flash_base);
+#endif
+	if (setup_gbb_and_cdata(&gbb, &cdata, 1))
+		return VB_SELECT_ERROR;
+
 	/*
 	 * VbSelectAndLoadKernel() assumes the TPM interface has already been
 	 * initialized by VbSelectFirmware(). Since we haven't called