flash: Add ROLLBACK flash region, that can be protected separately

ROLLBACK region will be used to store rollback information, and
can be protected independently of RW (it can only be protected when
RO is protected, though).

This is only supported on stm32f0 currently.

BRANCH=none
BUG=chrome-os-partner:61671
TEST=on hammer (stm32f072)
     flashinfo => RO+RW not protected
     flashwp true; reboot => only RO protected
     flashwp all; reboot => RO+RW+RB protected
     flashwp noall; reboot => only RO protected
     flashwp rw; reboot => only RO+RW protected
     flashwp rb; reboot => RO+RW+RB protected
     flashwp norb; reboot => RO+RW protected
     flashwp all; reboot => RO+RW+RB protected
     flashwp norw; reboot => RO+RB protected
TEST=on reef, rb/norb commands not available

Change-Id: I45ffc66d91cf3699ecff025e5114c59a73dc8274
Reviewed-on: https://chromium-review.googlesource.com/430519
Commit-Ready: Nicolas Boichat <drinkcat@chromium.org>
Tested-by: Nicolas Boichat <drinkcat@chromium.org>
Reviewed-by: Randall Spangler <rspangler@chromium.org>

3 files changed, 29 insertions, 1 deletions

diff --git a/include/config.h b/include/config.h
index 129b1bd648..29625d201d 100644
--- a/include/config.h
+++ b/include/config.h
@@ -1113,6 +1113,15 @@
 #undef CONFIG_WP_STORAGE_SIZE
 
 /*
+ * Rollback protect region. If CONFIG_ROLLBACK is defined to enable the rollback
+ * protect region, CONFIG_ROLLBACK_OFF and CONFIG_ROLLBACK_SIZE must be defined
+ * too.
+ */
+#undef CONFIG_ROLLBACK
+#undef CONFIG_ROLLBACK_OFF
+#undef CONFIG_ROLLBACK_SIZE
+
+/*
  * Board Image ec.bin contains a RO firmware.  If not defined, the image will
  * only contain the RW firmware. The RO firmware comes from another board.
  */
diff --git a/include/ec_commands.h b/include/ec_commands.h
index 2a44a7dded..ed8c333cf4 100644
--- a/include/ec_commands.h
+++ b/include/ec_commands.h
@@ -1213,6 +1213,10 @@ struct __ec_align4 ec_params_flash_erase {
 #define EC_FLASH_PROTECT_RW_AT_BOOT         (1 << 7)
 /* RW flash code protected now. */
 #define EC_FLASH_PROTECT_RW_NOW             (1 << 8)
+/* Rollback information flash region protected when the EC boots */
+#define EC_FLASH_PROTECT_ROLLBACK_AT_BOOT   (1 << 9)
+/* Rollback information flash region protected now */
+#define EC_FLASH_PROTECT_ROLLBACK_NOW       (1 << 10)
 
 struct __ec_align4 ec_params_flash_protect {
 	uint32_t mask;   /* Bits in flags to apply */
diff --git a/include/flash.h b/include/flash.h
index 548f889e72..2d50708f8a 100644
--- a/include/flash.h
+++ b/include/flash.h
@@ -12,9 +12,13 @@
 #include "ec_commands.h"  /* For EC_FLASH_PROTECT_* flags */
 
 /* Number of physical flash banks */
+/*
+ * TODO(crosbug.com/p/62372): This assumes flash protection blocks are all of
+ * identical sizes, which is incorrect, for example, on STM32F091VC.
+ */
 #define PHYSICAL_BANKS (CONFIG_FLASH_SIZE / CONFIG_FLASH_BANK_SIZE)
 
-/*WP region offset and size in units of flash banks */
+/* WP region offset and size in units of flash banks */
 #define WP_BANK_OFFSET	(CONFIG_WP_STORAGE_OFF / CONFIG_FLASH_BANK_SIZE)
 #define WP_BANK_COUNT	(CONFIG_WP_STORAGE_SIZE / CONFIG_FLASH_BANK_SIZE)
 
@@ -26,10 +30,21 @@
 #define PSTATE_BANK_COUNT	0
 #endif
 
+#ifdef CONFIG_ROLLBACK
+/*
+ * ROLLBACK region offset and size in units of flash banks.
+ */
+#define ROLLBACK_BANK_OFFSET	(CONFIG_ROLLBACK_OFF / CONFIG_FLASH_BANK_SIZE)
+#define ROLLBACK_BANK_COUNT	(CONFIG_ROLLBACK_SIZE / CONFIG_FLASH_BANK_SIZE)
+#endif
+
 /* This enum is useful to identify different regions during verification. */
 enum flash_region {
 	FLASH_REGION_RW = 0,
 	FLASH_REGION_RO,
+#ifdef CONFIG_ROLLBACK
+	FLASH_REGION_ROLLBACK,
+#endif
 	FLASH_REGION_COUNT
 };