hammer runs its own upgradable firmware (base EC, running EC codebase on STM32F072), is attached to a touchpad, with its own upgradeable FW.
Touchpad FW is too large to fit into base EC flash, so it needs to be sent over from the AP. For security reasons, we need to have base EC verify touchpad FW integrity before updating it.
We ship hashes of touchpad FW in base EC RW (so the checksums are verified as part of EC RW verification), then base EC verifies blocks one by one before flashing them.
We split the touchpad FW into blocks of X kb (currently X=1), which can, individually, easily fit in EC RAM. For each of these blocks, we compute a SHA-256 checksum (32-byte per block, so 1536 bytes in total for a 48kb image with X=1).
We ship the checksums as part of the base EC RW image, so that they are signed/verified as part of the verified boot process of base EC.
To update touchpad FW, we follow these steps:
Updating the touchpad FW image requires extra care, as it needs to be provided both in the firmware branch (to compute the hashes to be embedded in the EC image), and in the release branch (so that hammerd can read the touchpad FW image and send it to base EC).
On firmware branch (note that if
USE=bootimage is set, firmware branch steps should first be followed on the release branch):
/firmware/hammer/<product_id>_<firmware_version>.bin(this filename matches current touch firmware updater convention. Also, this ebuild must create a symlink from
/firmware/hammer/touchpad.binto the actual touchpad firmware above.
chromeos-ecebuild picks up the new touchpad FW (CL:643006), and EC build system will generate hashes (CL:615321), to be included in hammer EC image (this is what allows hammer to check touchpad FW validity at runtime).
firmware_from_source.tar.bz2tarball that contains
/firmware/hammer/<product_id>_<firmware_version>.binand the symlink
On release branch:
chromeos-firmware-hammerebuild to install the new EC image (
/lib/firmware/hammer.fw), as well as the new touchpad firmware (
/opt/google/touchpad/firmware/<product_id>_<firmware_version>.bin), both coming from firmware branch builder artifacts (similar to CL:*438992). The ebuild also creates a symlink from
/lib/firmware/hammer-touchpad.fwto the actual touchpad firmware above. Doing this update in one single CL avoids possible mismatch between touchpad FW provided in release image and stored hashes in EC image.