sravan/system76-coreboot
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

vboot: Add VBOOT_CBFS_INTEGRATION support

Browse Source 
This patch introduces support signing and verification of firmware
slots using CBFS metadata hash verification method for faster initial
verification. To have complete verification, CBFS_VERIFICATION should
also be enabled, as metadata hash covers only files metadata, not their
contents.

This patch also adapts mainboards and SoCs to new vboot reset
requirements.

TEST=Google Volteer/Voxel boots with VBOOT_CBFS_INTEGRATION enabled

Signed-off-by: Jakub Czapiga <jacz@semihalf.com>
Change-Id: I40ae01c477c4e4f7a1c90e4026a8a868ae64b5ca
Reviewed-on: https://review.coreboot.org/c/coreboot/+/66909
Reviewed-by: Yu-Ping Wu <yupingso@google.com>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
This commit is contained in:
Jakub Czapiga
2022-08-19 12:25:27 +02:00
committed by Julius Werner
parent fe17a7d4d4
commit 967a76bd81
13 changed files with 102 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
src/security/vboot/vboot_loader.c
View File

@@ -28,15 +28,32 @@ int vboot_executed;
static void after_verstage(void)
{
struct vb2_hash *metadata_hash = NULL;
struct vb2_context *ctx = NULL;
if (CONFIG(VBOOT_CBFS_INTEGRATION)) {
ctx = vboot_get_context();
vb2_error_t rv = vb2api_get_metadata_hash(ctx, &metadata_hash);
if (rv)
vboot_fail_and_reboot(ctx, VB2_RECOVERY_FW_PREAMBLE, rv);
}
vboot_executed = 1; /* Mark verstage execution complete. */
const struct cbfs_boot_device *cbd = vboot_get_cbfs_boot_device();
if (!cbd) /* Can't initialize RW CBFS in recovery mode. */
return;
enum cb_err err = cbfs_init_boot_device(cbd, NULL); /* TODO: RW hash */
if (err && err != CB_CBFS_CACHE_FULL) /* TODO: -> recovery? */
die("RW CBFS initialization failure: %d", err);
enum cb_err err = cbfs_init_boot_device(cbd, metadata_hash);
if (err && err != CB_CBFS_CACHE_FULL) {
if (CONFIG(VBOOT_CBFS_INTEGRATION)) {
printk(BIOS_ERR, "RW CBFS initialization failed: %d\n", err);
/* CBFS error code does not fit in subcode. Use only lowest byte. */
vboot_fail_and_reboot(ctx, VB2_RECOVERY_FW_BODY, err & 0xFF);
} else {
die("RW CBFS initialization failure: %d", err);
}
}
}
void vboot_run_logic(void)