diff options
| author | Jakub Czapiga <jacz@semihalf.com> | 2022-08-19 12:25:27 +0200 |
|---|---|---|
| committer | Julius Werner <jwerner@chromium.org> | 2022-11-08 23:03:49 +0000 |
| commit | 967a76bd811088b2a8bd7f008b2436e31ab4e5b3 (patch) | |
| tree | 1568d12f1aee56c85d2190559115f86547ad45b1 /src/lib | |
| parent | fe17a7d4d420763ef387e84256eaed0373c25725 (diff) | |
| download | coreboot-967a76bd811088b2a8bd7f008b2436e31ab4e5b3.tar.gz coreboot-967a76bd811088b2a8bd7f008b2436e31ab4e5b3.tar.bz2 coreboot-967a76bd811088b2a8bd7f008b2436e31ab4e5b3.zip | |
vboot: Add VBOOT_CBFS_INTEGRATION support
This patch introduces support signing and verification of firmware
slots using CBFS metadata hash verification method for faster initial
verification. To have complete verification, CBFS_VERIFICATION should
also be enabled, as metadata hash covers only files metadata, not their
contents.
This patch also adapts mainboards and SoCs to new vboot reset
requirements.
TEST=Google Volteer/Voxel boots with VBOOT_CBFS_INTEGRATION enabled
Signed-off-by: Jakub Czapiga <jacz@semihalf.com>
Change-Id: I40ae01c477c4e4f7a1c90e4026a8a868ae64b5ca
Reviewed-on: https://review.coreboot.org/c/coreboot/+/66909
Reviewed-by: Yu-Ping Wu <yupingso@google.com>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Diffstat (limited to 'src/lib')
| -rw-r--r-- | src/lib/cbfs.c | 14 |
1 files changed, 12 insertions, 2 deletions
diff --git a/src/lib/cbfs.c b/src/lib/cbfs.c index 4f2d9caea9d7..d2829d1d3eaf 100644 --- a/src/lib/cbfs.c +++ b/src/lib/cbfs.c @@ -12,6 +12,7 @@ #include <list.h> #include <metadata_hash.h> #include <security/tpm/tspi/crtm.h> +#include <security/vboot/vboot_common.h> #include <security/vboot/misc.h> #include <stdlib.h> #include <string.h> @@ -57,7 +58,10 @@ enum cb_err _cbfs_boot_lookup(const char *name, bool force_ro, RO CBFS would have been caught when building the mcache in cbfs_get boot_device(). (Note that TOCTOU_SAFETY implies !NO_CBFS_MCACHE.) */ assert(cbd == vboot_get_cbfs_boot_device()); - die("TODO: set metadata_hash to RW metadata hash here.\n"); + if (!CONFIG(VBOOT) + || vb2api_get_metadata_hash(vboot_get_context(), &metadata_hash) + != VB2_SUCCESS) + die("Failed to get RW metadata hash"); } err = cbfs_lookup(&cbd->rdev, name, mdata, &data_offset, metadata_hash); } @@ -160,8 +164,14 @@ static bool cbfs_file_hash_mismatch(const void *buffer, size_t size, ERROR("'%s' does not have a file hash!\n", mdata->h.filename); return true; } - if (vb2_hash_verify(vboot_hwcrypto_allowed(), buffer, size, hash)) { + + vb2_error_t rv = vb2_hash_verify(vboot_hwcrypto_allowed(), buffer, size, hash); + if (rv != VB2_SUCCESS) { ERROR("'%s' file hash mismatch!\n", mdata->h.filename); + if (CONFIG(VBOOT_CBFS_INTEGRATION) && !vboot_recovery_mode_enabled() + && vboot_logic_executed()) + vboot_fail_and_reboot(vboot_get_context(), VB2_RECOVERY_FW_BODY, + rv); return true; } } |