/*
 * Copyright (c) 2013 The Chromium OS Authors. All rights reserved.
 * Use of this source code is governed by a BSD-style license that can be
 * found in the LICENSE file.
 *
 * Alternatively, this software may be distributed under the terms of the
 * GNU General Public License ("GPL") version 2 as published by the Free
 * Software Foundation.
 */

#ifndef __VBOOT_H
#define __VBOOT_H

#include <common.h>
#include <crossystem_data.h>
#include <firmware_storage.h>
#include <gbb_header.h>
#include <vboot_api.h>
#include <vboot_flag.h>
#include <cros/common.h>

/* Magic number in the vboot persist header */
#define VBOOT_PERSIST_MAGIC	0xfeed1a3b

/* These values indicate which firmwares have been tried */
enum vboot_persist_flags_t {
	VBOOT_PERSISTF_TRIED_A	= 1 << VB_SELECT_FIRMWARE_A,
	VBOOT_PERSISTF_TRIED_B	= 1 << VB_SELECT_FIRMWARE_B,
};

/**
 * Header for the information that persists in SRAM.
 *
 * This is set up on boot by the RO U-Boot, with the flags set to 0.
 * When an RW SPL fails to verify U-Boot, it sets a flag indicating this and
 * reboots. At that point RO U-Boot can see which firmware has been tried, in
 * VbExHashFirmwareBody(), and fail it before irrevocably jumping to its SPL
 * and then needing to reboot again (and again...).
 *
 * The information is cleared in RW U-Boot, since by then we know we have
 * succeeded in loading our RW firmware. So it only persists across reboot in
 * the case where we are failing. This will happen if the firmware updater
 * updates SPL but does not get around to updating the associated U-Boot.
 */
struct vboot_persist {
	uint32_t magic;		/* VBOOT_PERSIST_MAGIC */
	uint32_t flags;		/* enum vboot_persist_flags_t */
};

/* Signature for the stashed RW SPL */
#define VBOOT_SPL_SIGNATURE	0xf005ba11

/* Header for a stashed RW SPL */
struct vboot_spl_hdr {
	uint32_t signature;	/* VBOOT_SPL_SIGNATURE */
	uint32_t size;		/* Size excluding header */
	uint32_t crc32;		/* crc32 of contents */
	uint32_t spare;		/* Spare word */
};

/**
 * Information about each firmware type. We expect to have read-only (used for
 * RO-normal if enabled), read-write A, read-write B and recovery. Recovery
 * is the same as RO-normal unless EFS is enabled, in which case RO-normal
 * is a small, low-feature version incapable of running recovery, and we
 * have a separate recovery image.
 *
 * @vblock: Pointer to the vblock if loaded - this is NULL except for RW-A and
 *	RW-B
 * @size: Size of firmware in bytes (this is the compressed size if the
 *	firmware is compressed)
 * @cache: Firmware data, if loaded
 * @uncomp_size: Uncompressed size of firmware. Same as @size if it is not
 *	compressed
 * @fw_entry: Pointer to the firmware entry in the fmap - there are three
 *	possible ones: RO, RW-A and RW-B. Note that RO includes recovery if
 *	this is a separate U-Boot from the RO U-Boot.
 * @entry: Pointer to the firmware entry that we plan to load and run.
 *	Normally this is U-Boot, but with EFS it is SPL, since it is the SPL
 *	that is signed by the signer, verified by vboot and jumped to by
 *	RO U-Boot.
 */
struct vboot_fw_info {
	void *vblock;
	uint32_t size;
	void *cache;
	size_t uncomp_size;
	struct fmap_firmware_entry *fw_entry;
	struct fmap_entry *entry;
};

/**
 * Main verified boot data structure
 *
 * @wpsw: Write protect switch information - write-protects the SPI flash
 * @recw: Recovery switch information - forces recovery mode
 * @devw: Developer switch information - forces developer mode
 * @oprom: Option ROM switch information
 * @file: Method for accessing the firmware (SPI / MMC)
 * @gbb_size: Size of GBB region in bytes
 * @oprom_matters: 1 if the option ROM must be loaded
 * @fmap: Flash map layout (tells us where all the images are)
 * @cparams: Common params passed to Vboot library
 * @fparams: Firmware params passed to Vboot library
 * @kparams: Kernel params passed to Vboot library
 * @iparams: Initial params passed to Vboot library
 * @selected_firmware: The firmware that VbSelectFirmware() asks that we boot
 * @firmware_type: String passed to RW U-Boot and the kernel to indicate
 *	our firmware type ("normal", "developer", "recovery")
 * @nvcontext_method: Pointer to method to use to store rhw non-volatile
 *	context. This is typically 16-bytes and stored in the EC. It is fairly
 *	non-volatile, although losing it not critical (e.g. it tells us to
 *	enter recovery mode)
 * @nvcontext_lba: Logical block address (sector number) of NV context when
 *	it is on disk/eMMC.
 * @nvcontext_offset: Offset within that block of the NV context
 * @nvcontext_size: Size of nvcontext
 * @fw_dest: Place where the firmware will be copied for execution
 * @vb_error: Vboot library error, if any
 * @fw: Information about RO, recovery, RW-A and RW-B firmware
 * @valid: false if this structure is not yet set up, true if it is
 * @use_efs: true to use Early Firmware Selection, where the RO firmware is
 *	small and runs from on-chip SRAM. The RW firmware can then initialize
 *	(or re-init) the SDRAM if required
 * @early_firmware_verification: With EFS, load and verify SPL, then load and
 *	verify the U-Boot that SPL will load against the hash in SPL, before
 *	deciding that the SPL is good. Without this option, only the SPL is
 *	verified, and that is left to (later) decide if the U-Boot is good.
 *	See vboot_persist for how this works.
 * @legacy_vboot: Indicates that vboot_twostop is being used
 *	(crosbug.com/p/21810)
 * @persist: Persistent information about firmware we have tried.
 * @fw_size: Size of firmware image in bytes - this starts off as the number
 *	of bytes in the section containing the firmware, but may be smaller if
 *	the vblock indicates that not all of that data was signed.
 * @active_ec_firmware: Indicates if the EC is in RO/RW (ACTIVE_EC_FIRMWARE_..)
 * @readonly_firmware_id: Firmware ID read from RO firmware
 * @firmware_id: Firmware ID of selected RO/RW firmware
 * @hardware_id: Hardware ID
 * @vb_shared_data: Information set up by the vboot library which we must
 *	preserve across calls to this library.
 */
struct vboot_info {
	struct vboot_flag_details wpsw, recsw, devsw, oprom;
	firmware_storage_t file;
	size_t gbb_size;
	int oprom_matters;
	struct twostop_fmap fmap;
	VbCommonParams cparams;
	VbSelectFirmwareParams fparams;
	VbSelectAndLoadKernelParams kparams;
	VbInitParams iparams;
	enum VbSelectFirmware_t selected_firmware;
	const char *firmware_type;
	struct nvstorage_method *nvcontext_method;
	uint64_t nvcontext_lba;
	uint16_t nvcontext_offset;
	uint16_t nvcontext_size;
	void *fw_dest;

	enum VbErrorPredefined_t vb_error;
	struct vboot_fw_info fw[VB_SELECT_FIRMWARE_COUNT];
	bool valid;
	bool use_efs;
	bool early_firmware_verification;
#ifdef CONFIG_CROS_LEGACY_VBOOT
	bool legacy_vboot;
#endif
	struct vboot_persist *persist;
	uint32_t fw_size;
	uint8_t active_ec_firmware;
	char readonly_firmware_id[ID_LEN];
	char firmware_id[ID_LEN];
	char hardware_id[ID_LEN];
	uint8_t vb_shared_data[VB_SHARED_DATA_MIN_SIZE];
};

/**
 * Set up the common params for the vboot library
 *
 * @vboot: Pointer to vboot structure
 * @cparams: Pointer to params structure to set up
 */
void vboot_init_cparams(struct vboot_info *vboot, VbCommonParams *cparams);

/**
 * Tell the EC to reboot and start up in RO.
 *
 * In recovery mode we need the EC to be in RO, so this function ensures that
 * it is. It requires rebooting the AP also.
 */
int vboot_request_ec_reboot_to_ro(void);

/**
 * Make a note of an error in the verified boot processs
 *
 * @vboot: Pointer to vboot structure
 * @stage: Name of vboot stage whic hfailed
 * @err: Number of error that occurred
 * @return -1 (always, so that caller can return it)
 */
int vboot_set_error(struct vboot_info *vboot, const char *stage,
		    enum VbErrorPredefined_t err);

/**
 * Read the vboot data from an FDT
 *
 * This is used in RW U-Boot to read state left behind by RO U-Boot
 *
 * @vboot: Pointer to vboot structure
 * @blob: Pointer to device tree blob containing the data
 */
int vboot_read_from_fdt(struct vboot_info *vboot, const void *blob);

/**
 * Write the vboot data to the FDT
 *
 * RO U-Boot uses this function to write out data for use by RW U-Boot. It
 * is also used to write out data to pass to the kernel.
 *
 * @vboot: Pointer to vboot structure
 * @blob: Pointer to device tree to update
 * @return 0 if OK, -ve on error
 */
int vboot_write_to_fdt(const struct vboot_info *vboot, void *blob);

/**
 * Update ACPI data
 *
 * For x86 systems, this writes a basic level of information in binary to
 * the ACPI tables for use by the kernel.
 *
 * @vboot: Pointer to vboot structure
 * @return 0 if OK, -ve on error
 */
int vboot_update_acpi(struct vboot_info *vboot);

/**
 * Dump vboot status information to the console
 *
 * @vboot: Pointer to vboot structure
 */
int vboot_dump(struct vboot_info *vboot);

/**
 * Get a pointer to the vboot structure
 *
 * @vboot: Pointer to vboot structure, if valid, else NULL
 */
struct vboot_info *vboot_get(void);

/**
 * Get a pointer to the vboot structure
 *
 * @vboot: Pointer to vboot structure (there is only one)
 */
struct vboot_info *vboot_get_nocheck(void);

/*
 * For the functions below, there are three combinations (thanks clchiou@):
 *
 * CONFIG_CROS_LEGACY_VBOOT defined and vboot->legacy_vboot == true
 * CONFIG_CROS_LEGACY_VBOOT defined and vboot->legacy_vboot == false
 * CONFIG_CROS_LEGACY_VBOOT is not defined
 *
 * The purpose of the first two cases is to allow the legacy and the new
 * vboot code paths to both be present in U-Boot so that U-Boot may run
 * either legacy or new vboot.
 *
 * Ultimately we will remove the legacy vboot, but in the meantime this
 * ability to boot either is valuable for testing and verification.
 *
 * The functions below allow the compiler/linker to optimize away the
 * legacy code when it is not needed.
 */

/**
 * @return true if we are running in legacy mode (vboot_twostop)
 */
static inline bool vboot_is_legacy(void)
{
#ifdef CONFIG_CROS_LEGACY_VBOOT
	struct vboot_info *vboot = vboot_get_nocheck();

	return vboot->legacy_vboot;
#else
	return false;
#endif
}

/**
 * Set whether we are in legacy mode or not
 *
 * @legacy: Set legacy mode to true/false
 */
static inline void vboot_set_legacy(bool legacy)
{
#ifdef CONFIG_CROS_LEGACY_VBOOT
	struct vboot_info *vboot = vboot_get_nocheck();

	vboot->legacy_vboot = legacy;
#endif
}

/**
 * Run the legacy vboot_twostop command
 *
 * @return 0 if OK, -ve on error
 */
int run_legacy_vboot_twostop(void);

/**
 * Load configuration for vboot, to control how it operates.
 *
 * @blob: Device tree blob containing the '/chromeos-config' node
 * @vboot: Pointer to vboot structure to update
 */
int vboot_load_config(const void *blob, struct vboot_info *vboot);

/**
 * Dump out information about the vboot persist information to the console
 *
 * @name: Name of this dump (for tracing)
 * @vboot: Pointer to vboot structure to dump
 */
void vboot_persist_dump(const char *name, struct vboot_info *vboot);

/**
 * Clear the vboot persist region
 *
 * Clear out any data in the persist region
 *
 * @vboot: Pointer to vboot structure
 */
void vboot_persist_clear(struct vboot_info *vboot);

/**
 * Set up the persist region if it does not already exist
 *
 * If there is a persist region, return it. If not, create it and then
 * return it.
 *
 * @blob: Pointer to device tree block containing config information
 * @vboot: Pointer to vboot structure
 */
int vboot_persist_init(const void *blob, struct vboot_info *vboot);

#endif