rollback: Update and lock rollback block as part of rwsig verification

This is done at RO stage. If the rollback region is unprotected, update
it to match the version in the RW image.

If the rollback region is protected, we can't do that update, so we wait
for RW to unlock that region (presumably after AP has verified that image
is somewhat functional) before updating it.

BRANCH=none
BUG=b:35586219
TEST=flashwp true; reboot => hammer reboots twice
     flashinfo shows RO+rollback protected:
 Flags:   wp_gpio_asserted ro_at_boot ro_now rollback_at_boot rollback_now
 Protected now:
     YYYYYYYY YYYYYYYY Y....... ........
TEST=Hack version.c to add "+1" to rollback_version, check that RO updates
     ROLLBACK info block on first boot.
TEST=Use hack above, convert rwsig to separate task, add 5000 ms delay in
     rwsig just before rollback information is updated. Then:
        Quickly type: flashwp true; reboot; flashwp all; reboot
          => Wait for system to jump to RW
        rollbackinfo => minimum version 0
        flashwp norb; reboot; wait for jump to RW
        rollbackinfo => minimum version 1

Change-Id: I78e502315c611c5edaf34b8d70a12fedd3e57bdf
Reviewed-on: https://chromium-review.googlesource.com/452816
Commit-Ready: Nicolas Boichat <drinkcat@chromium.org>
Tested-by: Nicolas Boichat <drinkcat@chromium.org>
Reviewed-by: Vincent Palatin <vpalatin@chromium.org>

1 files changed, 7 insertions, 0 deletions

diff --git a/include/rollback.h b/include/rollback.h
index 7221691c1f..d9d79eb67d 100644
--- a/include/rollback.h
+++ b/include/rollback.h
@@ -27,6 +27,13 @@ int rollback_get_minimum_version(void);
  */
 int rollback_update(int32_t next_min_version);
 
+/**
+ * Lock rollback protection block, reboot if necessary.
+ *
+ * @return EC_SUCCESS if rollback was already protected.
+ */
+int rollback_lock(void);
+
 #endif
 
 #endif  /* __CROS_EC_ROLLBACK_H */