[coreboot-gerrit] Patch set updated for coreboot: vboot: provide a unified flow for separate verstage
Aaron Durbin (adurbin@chromium.org)
gerrit at coreboot.org
Wed Sep 30 03:03:05 CET 2015
Aaron Durbin (adurbin at chromium.org) just uploaded a new patch set to gerrit, which you can find at http://review.coreboot.org/11744
-gerrit
commit 5a526844a93a9cf5cc24b9a3b8a437f2700144f3
Author: Aaron Durbin <adurbin at chromium.org>
Date: Tue Sep 29 17:56:59 2015 -0500
vboot: provide a unified flow for separate verstage
The vboot verification in a stage proper is unified
replacing duplicate code in the tegra SoC code. The
original verstage.c file is renamed to reflect its
real purpose. The support for a single verstage flow
is added to the vboot2 directory proper.
BUG=chrome-os-partner:44827
BRANCH=None
TEST=Built glados.
Change-Id: I14593e1fc69a1654fa27b512eb4b612395b94ce5
Signed-off-by: Aaron Durbin <adurbin at chromium.org>
---
src/mainboard/google/foster/Makefile.inc | 1 -
src/mainboard/google/foster/verstage.c | 29 --
src/soc/nvidia/tegra132/include/soc/verstage.h | 2 +-
src/soc/nvidia/tegra132/verstage.c | 48 ---
src/soc/nvidia/tegra210/include/soc/verstage.h | 2 +-
src/soc/nvidia/tegra210/verstage.c | 45 ---
src/vendorcode/google/chromeos/vboot2/Makefile.inc | 3 +-
src/vendorcode/google/chromeos/vboot2/misc.h | 1 -
.../google/chromeos/vboot2/vboot_logic.c | 352 +++++++++++++++++++++
src/vendorcode/google/chromeos/vboot2/verstage.c | 339 ++------------------
src/vendorcode/google/chromeos/vboot_common.h | 6 +
11 files changed, 380 insertions(+), 448 deletions(-)
diff --git a/src/mainboard/google/foster/Makefile.inc b/src/mainboard/google/foster/Makefile.inc
index 7b2329e..51208c7 100644
--- a/src/mainboard/google/foster/Makefile.inc
+++ b/src/mainboard/google/foster/Makefile.inc
@@ -32,7 +32,6 @@ bootblock-y += bootblock.c
bootblock-y += pmic.c
bootblock-y += reset.c
-verstage-y += verstage.c
verstage-y += chromeos.c
verstage-y += reset.c
diff --git a/src/mainboard/google/foster/verstage.c b/src/mainboard/google/foster/verstage.c
deleted file mode 100644
index d5bcd44..0000000
--- a/src/mainboard/google/foster/verstage.c
+++ /dev/null
@@ -1,29 +0,0 @@
-/*
- * This file is part of the coreboot project.
- *
- * Copyright 2014 Google Inc.
- * Copyright (c) 2015, NVIDIA CORPORATION. All rights reserved.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; version 2 of the License.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc.
- */
-
-#include <soc/addressmap.h>
-#include <soc/funitcfg.h>
-#include <soc/padconfig.h>
-#include <soc/verstage.h>
-#include <soc/nvidia/tegra/i2c.h>
-
-void verstage_mainboard_init(void)
-{
-}
diff --git a/src/soc/nvidia/tegra132/include/soc/verstage.h b/src/soc/nvidia/tegra132/include/soc/verstage.h
index df6a386..d54a111 100644
--- a/src/soc/nvidia/tegra132/include/soc/verstage.h
+++ b/src/soc/nvidia/tegra132/include/soc/verstage.h
@@ -20,6 +20,6 @@
#ifndef __SOC_NVIDIA_TEGRA132_SOC_VERSTAGE_H__
#define __SOC_NVIDIA_TEGRA132_SOC_VERSTAGE_H__
-void verstage_mainboard_init(void);
+#include <vendorcode/google/chromeos/chromeos.h>
#endif /* __SOC_NVIDIA_TEGRA132_SOC_VERSTAGE_H__ */
diff --git a/src/soc/nvidia/tegra132/verstage.c b/src/soc/nvidia/tegra132/verstage.c
deleted file mode 100644
index d6eba9a..0000000
--- a/src/soc/nvidia/tegra132/verstage.c
+++ /dev/null
@@ -1,48 +0,0 @@
-/*
- * This file is part of the coreboot project.
- *
- * Copyright 2014 Google Inc.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; version 2 of the License.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc.
- */
-
-#include <arch/cache.h>
-#include <arch/exception.h>
-#include <arch/hlt.h>
-#include <arch/stages.h>
-#include <console/console.h>
-#include <soc/verstage.h>
-#include <program_loading.h>
-#include <timestamp.h>
-
-void __attribute__((weak)) verstage_mainboard_init(void)
-{
- /* Default empty implementation. */
-}
-
-static void verstage(void)
-{
- console_init();
- timestamp_add_now(TS_START_VBOOT);
- exception_init();
- verstage_mainboard_init();
-
- run_romstage();
-}
-
-void main(void)
-{
- verstage();
- hlt();
-}
diff --git a/src/soc/nvidia/tegra210/include/soc/verstage.h b/src/soc/nvidia/tegra210/include/soc/verstage.h
index 6c37218..d6564c9 100644
--- a/src/soc/nvidia/tegra210/include/soc/verstage.h
+++ b/src/soc/nvidia/tegra210/include/soc/verstage.h
@@ -20,6 +20,6 @@
#ifndef __SOC_NVIDIA_TEGRA210_SOC_VERSTAGE_H__
#define __SOC_NVIDIA_TEGRA210_SOC_VERSTAGE_H__
-void verstage_mainboard_init(void);
+#include <vendorcode/google/chromeos/chromeos.h>
#endif /* __SOC_NVIDIA_TEGRA210_SOC_VERSTAGE_H__ */
diff --git a/src/soc/nvidia/tegra210/verstage.c b/src/soc/nvidia/tegra210/verstage.c
deleted file mode 100644
index 6a4df29..0000000
--- a/src/soc/nvidia/tegra210/verstage.c
+++ /dev/null
@@ -1,45 +0,0 @@
-/*
- * This file is part of the coreboot project.
- *
- * Copyright 2014 Google Inc.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; version 2 of the License.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc.
- */
-
-#include <arch/cache.h>
-#include <arch/exception.h>
-#include <arch/hlt.h>
-#include <soc/verstage.h>
-#include <console/console.h>
-#include <program_loading.h>
-
-void __attribute__((weak)) verstage_mainboard_init(void)
-{
- /* Default empty implementation. */
-}
-
-static void verstage(void)
-{
- console_init();
- exception_init();
- verstage_mainboard_init();
-
- run_romstage();
-}
-
-void main(void)
-{
- verstage();
- hlt();
-}
diff --git a/src/vendorcode/google/chromeos/vboot2/Makefile.inc b/src/vendorcode/google/chromeos/vboot2/Makefile.inc
index 21613ba..c2ee868 100644
--- a/src/vendorcode/google/chromeos/vboot2/Makefile.inc
+++ b/src/vendorcode/google/chromeos/vboot2/Makefile.inc
@@ -31,8 +31,9 @@ romstage-y += ../vboot_common.c
ramstage-y += ../vboot_common.c
bootblock-y += common.c
-libverstage-y += verstage.c
+libverstage-y += vboot_logic.c
verstage-y += common.c
+verstage-y += verstage.c
ifeq (${CONFIG_VBOOT2_MOCK_SECDATA},y)
libverstage-y += secdata_mock.c
else
diff --git a/src/vendorcode/google/chromeos/vboot2/misc.h b/src/vendorcode/google/chromeos/vboot2/misc.h
index d4f9f48..305d0da 100644
--- a/src/vendorcode/google/chromeos/vboot2/misc.h
+++ b/src/vendorcode/google/chromeos/vboot2/misc.h
@@ -23,7 +23,6 @@
#include "../vboot_common.h"
void vboot_fill_handoff(void);
-void verstage_main(void);
void *vboot_load_stage(int stage_index,
struct region *fw_main,
struct vboot_components *fw_info);
diff --git a/src/vendorcode/google/chromeos/vboot2/vboot_logic.c b/src/vendorcode/google/chromeos/vboot2/vboot_logic.c
new file mode 100644
index 0000000..76355ec
--- /dev/null
+++ b/src/vendorcode/google/chromeos/vboot2/vboot_logic.c
@@ -0,0 +1,352 @@
+/*
+ * This file is part of the coreboot project.
+ *
+ * Copyright 2014 Google Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc.
+ */
+
+#include <antirollback.h>
+#include <arch/exception.h>
+#include <assert.h>
+#include <console/console.h>
+#include <console/vtxprintf.h>
+#include <delay.h>
+#include <string.h>
+#include <timestamp.h>
+#include <vb2_api.h>
+
+#include "../chromeos.h"
+#include "misc.h"
+
+#define TODO_BLOCK_SIZE 1024
+
+static int is_slot_a(struct vb2_context *ctx)
+{
+ return !(ctx->flags & VB2_CONTEXT_FW_SLOT_B);
+}
+
+/* exports */
+
+void vb2ex_printf(const char *func, const char *fmt, ...)
+{
+ va_list args;
+
+ printk(BIOS_INFO, "VB2:%s() ", func);
+ va_start(args, fmt);
+ do_printk_va_list(BIOS_INFO, fmt, args);
+ va_end(args);
+
+ return;
+}
+
+int vb2ex_tpm_clear_owner(struct vb2_context *ctx)
+{
+ uint32_t rv;
+ printk(BIOS_INFO, "Clearing TPM owner\n");
+ rv = tpm_clear_and_reenable();
+ if (rv)
+ return VB2_ERROR_EX_TPM_CLEAR_OWNER;
+ return VB2_SUCCESS;
+}
+
+int vb2ex_read_resource(struct vb2_context *ctx,
+ enum vb2_resource_index index,
+ uint32_t offset,
+ void *buf,
+ uint32_t size)
+{
+ struct region_device rdev;
+ const char *name;
+
+ switch (index) {
+ case VB2_RES_GBB:
+ name = "GBB";
+ break;
+ case VB2_RES_FW_VBLOCK:
+ if (is_slot_a(ctx))
+ name = "VBLOCK_A";
+ else
+ name = "VBLOCK_B";
+ break;
+ default:
+ return VB2_ERROR_EX_READ_RESOURCE_INDEX;
+ }
+
+ if (vboot_named_region_device(name, &rdev))
+ return VB2_ERROR_EX_READ_RESOURCE_SIZE;
+
+ if (rdev_readat(&rdev, buf, offset, size) != size)
+ return VB2_ERROR_EX_READ_RESOURCE_SIZE;
+
+ return VB2_SUCCESS;
+}
+
+/* No-op stubs that can be overridden by SoCs with hardware crypto support. */
+__attribute__((weak))
+int vb2ex_hwcrypto_digest_init(enum vb2_hash_algorithm hash_alg,
+ uint32_t data_size)
+{
+ return VB2_ERROR_EX_HWCRYPTO_UNSUPPORTED;
+}
+
+__attribute__((weak))
+int vb2ex_hwcrypto_digest_extend(const uint8_t *buf, uint32_t size)
+{
+ BUG(); /* Should never get called if init() returned an error. */
+ return VB2_ERROR_UNKNOWN;
+}
+
+__attribute__((weak))
+int vb2ex_hwcrypto_digest_finalize(uint8_t *digest, uint32_t digest_size)
+{
+ BUG(); /* Should never get called if init() returned an error. */
+ return VB2_ERROR_UNKNOWN;
+}
+
+static int hash_body(struct vb2_context *ctx, struct region_device *fw_main)
+{
+ uint64_t load_ts;
+ uint32_t expected_size;
+ uint8_t block[TODO_BLOCK_SIZE];
+ size_t block_size = sizeof(block);
+ size_t offset;
+ int rv;
+
+ /*
+ * Since loading the firmware and calculating its hash is intertwined,
+ * we use this little trick to measure them separately and pretend it
+ * was first loaded and then hashed in one piece with the timestamps.
+ * (This split won't make sense with memory-mapped media like on x86.)
+ */
+ load_ts = timestamp_get();
+ timestamp_add(TS_START_HASH_BODY, load_ts);
+
+ expected_size = region_device_sz(fw_main);
+ offset = 0;
+
+ /* Start the body hash */
+ rv = vb2api_init_hash(ctx, VB2_HASH_TAG_FW_BODY, &expected_size);
+ if (rv)
+ return rv;
+
+ /* Extend over the body */
+ while (expected_size) {
+ uint64_t temp_ts;
+ if (block_size > expected_size)
+ block_size = expected_size;
+
+ temp_ts = timestamp_get();
+ if (rdev_readat(fw_main, block, offset, block_size) < 0)
+ return VB2_ERROR_UNKNOWN;
+ load_ts += timestamp_get() - temp_ts;
+
+ rv = vb2api_extend_hash(ctx, block, block_size);
+ if (rv)
+ return rv;
+
+ expected_size -= block_size;
+ offset += block_size;
+ }
+
+ timestamp_add(TS_DONE_LOADING, load_ts);
+ timestamp_add_now(TS_DONE_HASHING);
+
+ /* Check the result (with RSA signature verification) */
+ rv = vb2api_check_hash(ctx);
+ if (rv)
+ return rv;
+
+ timestamp_add_now(TS_END_HASH_BODY);
+
+ return VB2_SUCCESS;
+}
+
+static int locate_firmware(struct vb2_context *ctx,
+ struct region_device *fw_main)
+{
+ const char *name;
+
+ if (is_slot_a(ctx))
+ name = "FW_MAIN_A";
+ else
+ name = "FW_MAIN_B";
+
+ return vboot_named_region_device(name, fw_main);
+}
+
+/**
+ * Save non-volatile and/or secure data if needed.
+ */
+static void save_if_needed(struct vb2_context *ctx)
+{
+ if (ctx->flags & VB2_CONTEXT_NVDATA_CHANGED) {
+ printk(BIOS_INFO, "Saving nvdata\n");
+ save_vbnv(ctx->nvdata);
+ ctx->flags &= ~VB2_CONTEXT_NVDATA_CHANGED;
+ }
+ if (ctx->flags & VB2_CONTEXT_SECDATA_CHANGED) {
+ printk(BIOS_INFO, "Saving secdata\n");
+ antirollback_write_space_firmware(ctx);
+ ctx->flags &= ~VB2_CONTEXT_SECDATA_CHANGED;
+ }
+}
+
+static uint32_t extend_pcrs(struct vb2_context *ctx)
+{
+ return tpm_extend_pcr(ctx, 0, BOOT_MODE_PCR) ||
+ tpm_extend_pcr(ctx, 1, HWID_DIGEST_PCR);
+}
+
+static void init_vb2_working_data(void)
+{
+ struct vb2_working_data *wd;
+ size_t work_size;
+
+ work_size = vb2_working_data_size();
+ wd = vboot_get_working_data();
+ memset(wd, 0, work_size);
+ /*
+ * vboot prefers 16-byte alignment. This takes away 16 bytes
+ * from the VBOOT2_WORK region, but the vboot devs said that's okay.
+ */
+ wd->buffer_offset = ALIGN_UP(sizeof(*wd), 16);
+ wd->buffer_size = work_size - wd->buffer_offset;
+}
+
+/**
+ * Verify and select the firmware in the RW image
+ *
+ * TODO: Avoid loading a stage twice (once in hash_body & again in load_stage).
+ * when per-stage verification is ready.
+ */
+void verstage_main(void)
+{
+ struct vb2_context ctx;
+ struct region_device fw_main;
+ struct vb2_working_data *wd;
+ int rv;
+ init_vb2_working_data();
+ wd = vboot_get_working_data();
+ timestamp_add_now(TS_START_VBOOT);
+
+ /* Set up context and work buffer */
+ memset(&ctx, 0, sizeof(ctx));
+ ctx.workbuf = vboot_get_work_buffer(wd);
+ ctx.workbuf_size = wd->buffer_size;
+
+ /* Read nvdata from a non-volatile storage */
+ read_vbnv(ctx.nvdata);
+
+ /* Read secdata from TPM. Initialize TPM if secdata not found. We don't
+ * check the return value here because vb2api_fw_phase1 will catch
+ * invalid secdata and tell us what to do (=reboot). */
+ timestamp_add_now(TS_START_TPMINIT);
+ antirollback_read_space_firmware(&ctx);
+ timestamp_add_now(TS_END_TPMINIT);
+
+ if (!IS_ENABLED(CONFIG_VIRTUAL_DEV_SWITCH) &&
+ get_developer_mode_switch())
+ ctx.flags |= VB2_CONTEXT_FORCE_DEVELOPER_MODE;
+
+ if (get_recovery_mode_switch()) {
+ clear_recovery_mode_switch();
+ ctx.flags |= VB2_CONTEXT_FORCE_RECOVERY_MODE;
+ if (IS_ENABLED(CONFIG_VBOOT_DISABLE_DEV_ON_RECOVERY))
+ ctx.flags |= VB2_DISABLE_DEVELOPER_MODE;
+ }
+
+ if (IS_ENABLED(CONFIG_WIPEOUT_SUPPORTED) && get_wipeout_mode_switch())
+ ctx.flags |= VB2_CONTEXT_FORCE_WIPEOUT_MODE;
+
+ if (IS_ENABLED(CONFIG_LID_SWITCH) && !get_lid_switch())
+ ctx.flags |= VB2_CONTEXT_NOFAIL_BOOT;
+
+ /* Do early init (set up secdata and NVRAM, load GBB) */
+ printk(BIOS_INFO, "Phase 1\n");
+ rv = vb2api_fw_phase1(&ctx);
+
+ if (rv) {
+ /*
+ * If vb2api_fw_phase1 fails, check for return value.
+ * If it is set to VB2_ERROR_API_PHASE1_RECOVERY, then continue
+ * into recovery mode.
+ * For any other error code, save context if needed and reboot.
+ */
+ if (rv == VB2_ERROR_API_PHASE1_RECOVERY) {
+ printk(BIOS_INFO, "Recovery requested (%x)\n", rv);
+ save_if_needed(&ctx);
+ extend_pcrs(&ctx); /* ignore failures */
+ timestamp_add_now(TS_END_VBOOT);
+ return;
+ }
+
+ printk(BIOS_INFO, "Reboot reqested (%x)\n", rv);
+ save_if_needed(&ctx);
+ vboot_reboot();
+ }
+
+ /* Determine which firmware slot to boot (based on NVRAM) */
+ printk(BIOS_INFO, "Phase 2\n");
+ rv = vb2api_fw_phase2(&ctx);
+ if (rv) {
+ printk(BIOS_INFO, "Reboot requested (%x)\n", rv);
+ save_if_needed(&ctx);
+ vboot_reboot();
+ }
+
+ /* Try that slot (verify its keyblock and preamble) */
+ printk(BIOS_INFO, "Phase 3\n");
+ timestamp_add_now(TS_START_VERIFY_SLOT);
+ rv = vb2api_fw_phase3(&ctx);
+ timestamp_add_now(TS_END_VERIFY_SLOT);
+ if (rv) {
+ printk(BIOS_INFO, "Reboot requested (%x)\n", rv);
+ save_if_needed(&ctx);
+ vboot_reboot();
+ }
+
+ printk(BIOS_INFO, "Phase 4\n");
+ rv = locate_firmware(&ctx, &fw_main);
+ if (rv)
+ die("Failed to read FMAP to locate firmware");
+
+ rv = hash_body(&ctx, &fw_main);
+ save_if_needed(&ctx);
+ if (rv) {
+ printk(BIOS_INFO, "Reboot requested (%x)\n", rv);
+ vboot_reboot();
+ }
+
+ rv = extend_pcrs(&ctx);
+ if (rv) {
+ printk(BIOS_WARNING, "Failed to extend TPM PCRs (%#x)\n", rv);
+ vb2api_fail(&ctx, VB2_RECOVERY_RO_TPM_U_ERROR, rv);
+ save_if_needed(&ctx);
+ vboot_reboot();
+ }
+
+ /* Lock TPM */
+ rv = antirollback_lock_space_firmware();
+ if (rv) {
+ printk(BIOS_INFO, "Failed to lock TPM (%x)\n", rv);
+ vb2api_fail(&ctx, VB2_RECOVERY_RO_TPM_L_ERROR, 0);
+ save_if_needed(&ctx);
+ vboot_reboot();
+ }
+
+ printk(BIOS_INFO, "Slot %c is selected\n", is_slot_a(&ctx) ? 'A' : 'B');
+ vb2_set_selected_region(wd, &fw_main);
+ timestamp_add_now(TS_END_VBOOT);
+}
diff --git a/src/vendorcode/google/chromeos/vboot2/verstage.c b/src/vendorcode/google/chromeos/vboot2/verstage.c
index 7803d39..9556359 100644
--- a/src/vendorcode/google/chromeos/vboot2/verstage.c
+++ b/src/vendorcode/google/chromeos/vboot2/verstage.c
@@ -1,7 +1,7 @@
/*
* This file is part of the coreboot project.
*
- * Copyright 2014 Google Inc.
+ * Copyright 2015 Google Inc.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@@ -9,7 +9,7 @@
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
@@ -17,333 +17,30 @@
* Foundation, Inc.
*/
-#include <antirollback.h>
#include <arch/exception.h>
-#include <assert.h>
+#include <arch/hlt.h>
#include <console/console.h>
-#include <console/vtxprintf.h>
-#include <delay.h>
-#include <string.h>
-#include <timestamp.h>
-#include <vb2_api.h>
+#include <program_loading.h>
+#include "../vboot_common.h"
-#include "../chromeos.h"
-#include "misc.h"
-
-#define TODO_BLOCK_SIZE 1024
-
-static int is_slot_a(struct vb2_context *ctx)
-{
- return !(ctx->flags & VB2_CONTEXT_FW_SLOT_B);
-}
-
-/* exports */
-
-void vb2ex_printf(const char *func, const char *fmt, ...)
+void __attribute__((weak)) verstage_mainboard_init(void)
{
- va_list args;
-
- printk(BIOS_INFO, "VB2:%s() ", func);
- va_start(args, fmt);
- do_printk_va_list(BIOS_INFO, fmt, args);
- va_end(args);
-
- return;
-}
-
-int vb2ex_tpm_clear_owner(struct vb2_context *ctx)
-{
- uint32_t rv;
- printk(BIOS_INFO, "Clearing TPM owner\n");
- rv = tpm_clear_and_reenable();
- if (rv)
- return VB2_ERROR_EX_TPM_CLEAR_OWNER;
- return VB2_SUCCESS;
+ /* Default empty implementation. */
}
-int vb2ex_read_resource(struct vb2_context *ctx,
- enum vb2_resource_index index,
- uint32_t offset,
- void *buf,
- uint32_t size)
+void verstage(void)
{
- struct region_device rdev;
- const char *name;
-
- switch (index) {
- case VB2_RES_GBB:
- name = "GBB";
- break;
- case VB2_RES_FW_VBLOCK:
- if (is_slot_a(ctx))
- name = "VBLOCK_A";
- else
- name = "VBLOCK_B";
- break;
- default:
- return VB2_ERROR_EX_READ_RESOURCE_INDEX;
- }
-
- if (vboot_named_region_device(name, &rdev))
- return VB2_ERROR_EX_READ_RESOURCE_SIZE;
-
- if (rdev_readat(&rdev, buf, offset, size) != size)
- return VB2_ERROR_EX_READ_RESOURCE_SIZE;
-
- return VB2_SUCCESS;
-}
-
-/* No-op stubs that can be overridden by SoCs with hardware crypto support. */
-__attribute__((weak))
-int vb2ex_hwcrypto_digest_init(enum vb2_hash_algorithm hash_alg,
- uint32_t data_size)
-{
- return VB2_ERROR_EX_HWCRYPTO_UNSUPPORTED;
-}
-
-__attribute__((weak))
-int vb2ex_hwcrypto_digest_extend(const uint8_t *buf, uint32_t size)
-{
- BUG(); /* Should never get called if init() returned an error. */
- return VB2_ERROR_UNKNOWN;
-}
-
-__attribute__((weak))
-int vb2ex_hwcrypto_digest_finalize(uint8_t *digest, uint32_t digest_size)
-{
- BUG(); /* Should never get called if init() returned an error. */
- return VB2_ERROR_UNKNOWN;
-}
-
-static int hash_body(struct vb2_context *ctx, struct region_device *fw_main)
-{
- uint64_t load_ts;
- uint32_t expected_size;
- uint8_t block[TODO_BLOCK_SIZE];
- size_t block_size = sizeof(block);
- size_t offset;
- int rv;
-
- /*
- * Since loading the firmware and calculating its hash is intertwined,
- * we use this little trick to measure them separately and pretend it
- * was first loaded and then hashed in one piece with the timestamps.
- * (This split won't make sense with memory-mapped media like on x86.)
- */
- load_ts = timestamp_get();
- timestamp_add(TS_START_HASH_BODY, load_ts);
-
- expected_size = region_device_sz(fw_main);
- offset = 0;
-
- /* Start the body hash */
- rv = vb2api_init_hash(ctx, VB2_HASH_TAG_FW_BODY, &expected_size);
- if (rv)
- return rv;
-
- /* Extend over the body */
- while (expected_size) {
- uint64_t temp_ts;
- if (block_size > expected_size)
- block_size = expected_size;
-
- temp_ts = timestamp_get();
- if (rdev_readat(fw_main, block, offset, block_size) < 0)
- return VB2_ERROR_UNKNOWN;
- load_ts += timestamp_get() - temp_ts;
-
- rv = vb2api_extend_hash(ctx, block, block_size);
- if (rv)
- return rv;
-
- expected_size -= block_size;
- offset += block_size;
- }
-
- timestamp_add(TS_DONE_LOADING, load_ts);
- timestamp_add_now(TS_DONE_HASHING);
-
- /* Check the result (with RSA signature verification) */
- rv = vb2api_check_hash(ctx);
- if (rv)
- return rv;
-
- timestamp_add_now(TS_END_HASH_BODY);
-
- return VB2_SUCCESS;
-}
-
-static int locate_firmware(struct vb2_context *ctx,
- struct region_device *fw_main)
-{
- const char *name;
-
- if (is_slot_a(ctx))
- name = "FW_MAIN_A";
- else
- name = "FW_MAIN_B";
-
- return vboot_named_region_device(name, fw_main);
-}
-
-/**
- * Save non-volatile and/or secure data if needed.
- */
-static void save_if_needed(struct vb2_context *ctx)
-{
- if (ctx->flags & VB2_CONTEXT_NVDATA_CHANGED) {
- printk(BIOS_INFO, "Saving nvdata\n");
- save_vbnv(ctx->nvdata);
- ctx->flags &= ~VB2_CONTEXT_NVDATA_CHANGED;
- }
- if (ctx->flags & VB2_CONTEXT_SECDATA_CHANGED) {
- printk(BIOS_INFO, "Saving secdata\n");
- antirollback_write_space_firmware(ctx);
- ctx->flags &= ~VB2_CONTEXT_SECDATA_CHANGED;
- }
-}
-
-static uint32_t extend_pcrs(struct vb2_context *ctx)
-{
- return tpm_extend_pcr(ctx, 0, BOOT_MODE_PCR) ||
- tpm_extend_pcr(ctx, 1, HWID_DIGEST_PCR);
-}
-
-static void init_vb2_working_data(void)
-{
- struct vb2_working_data *wd;
- size_t work_size;
-
- work_size = vb2_working_data_size();
- wd = vboot_get_working_data();
- memset(wd, 0, work_size);
- /*
- * vboot prefers 16-byte alignment. This takes away 16 bytes
- * from the VBOOT2_WORK region, but the vboot devs said that's okay.
- */
- wd->buffer_offset = ALIGN_UP(sizeof(*wd), 16);
- wd->buffer_size = work_size - wd->buffer_offset;
-}
-
-/**
- * Verify and select the firmware in the RW image
- *
- * TODO: Avoid loading a stage twice (once in hash_body & again in load_stage).
- * when per-stage verification is ready.
- */
-void verstage_main(void)
-{
- struct vb2_context ctx;
- struct region_device fw_main;
- struct vb2_working_data *wd;
- int rv;
- init_vb2_working_data();
- wd = vboot_get_working_data();
- timestamp_add_now(TS_START_VBOOT);
-
- /* Set up context and work buffer */
- memset(&ctx, 0, sizeof(ctx));
- ctx.workbuf = vboot_get_work_buffer(wd);
- ctx.workbuf_size = wd->buffer_size;
-
- /* Read nvdata from a non-volatile storage */
- read_vbnv(ctx.nvdata);
-
- /* Read secdata from TPM. Initialize TPM if secdata not found. We don't
- * check the return value here because vb2api_fw_phase1 will catch
- * invalid secdata and tell us what to do (=reboot). */
- timestamp_add_now(TS_START_TPMINIT);
- antirollback_read_space_firmware(&ctx);
- timestamp_add_now(TS_END_TPMINIT);
-
- if (!IS_ENABLED(CONFIG_VIRTUAL_DEV_SWITCH) &&
- get_developer_mode_switch())
- ctx.flags |= VB2_CONTEXT_FORCE_DEVELOPER_MODE;
-
- if (get_recovery_mode_switch()) {
- clear_recovery_mode_switch();
- ctx.flags |= VB2_CONTEXT_FORCE_RECOVERY_MODE;
- if (IS_ENABLED(CONFIG_VBOOT_DISABLE_DEV_ON_RECOVERY))
- ctx.flags |= VB2_DISABLE_DEVELOPER_MODE;
- }
-
- if (IS_ENABLED(CONFIG_WIPEOUT_SUPPORTED) && get_wipeout_mode_switch())
- ctx.flags |= VB2_CONTEXT_FORCE_WIPEOUT_MODE;
-
- if (IS_ENABLED(CONFIG_LID_SWITCH) && !get_lid_switch())
- ctx.flags |= VB2_CONTEXT_NOFAIL_BOOT;
-
- /* Do early init (set up secdata and NVRAM, load GBB) */
- printk(BIOS_INFO, "Phase 1\n");
- rv = vb2api_fw_phase1(&ctx);
- if (rv) {
- printk(BIOS_INFO, "Recovery requested (%x)\n", rv);
- /* If we need recovery mode, leave firmware selection now */
- save_if_needed(&ctx);
- extend_pcrs(&ctx); /* ignore failures */
- timestamp_add_now(TS_END_VBOOT);
- return;
- }
-
- /* Determine which firmware slot to boot (based on NVRAM) */
- printk(BIOS_INFO, "Phase 2\n");
- rv = vb2api_fw_phase2(&ctx);
- if (rv) {
- printk(BIOS_INFO, "Reboot requested (%x)\n", rv);
- save_if_needed(&ctx);
- vboot_reboot();
- }
-
- /* Try that slot (verify its keyblock and preamble) */
- printk(BIOS_INFO, "Phase 3\n");
- timestamp_add_now(TS_START_VERIFY_SLOT);
- rv = vb2api_fw_phase3(&ctx);
- timestamp_add_now(TS_END_VERIFY_SLOT);
- if (rv) {
- printk(BIOS_INFO, "Reboot requested (%x)\n", rv);
- save_if_needed(&ctx);
- vboot_reboot();
- }
-
- printk(BIOS_INFO, "Phase 4\n");
- rv = locate_firmware(&ctx, &fw_main);
- if (rv)
- die("Failed to read FMAP to locate firmware");
-
- rv = hash_body(&ctx, &fw_main);
- save_if_needed(&ctx);
- if (rv) {
- printk(BIOS_INFO, "Reboot requested (%x)\n", rv);
- vboot_reboot();
- }
-
- rv = extend_pcrs(&ctx);
- if (rv) {
- printk(BIOS_WARNING, "Failed to extend TPM PCRs (%#x)\n", rv);
- vb2api_fail(&ctx, VB2_RECOVERY_RO_TPM_U_ERROR, rv);
- save_if_needed(&ctx);
- vboot_reboot();
- }
+ console_init();
+ exception_init();
+ verstage_mainboard_init();
- /* Lock TPM */
- rv = antirollback_lock_space_firmware();
- if (rv) {
- printk(BIOS_INFO, "Failed to lock TPM (%x)\n", rv);
- vb2api_fail(&ctx, VB2_RECOVERY_RO_TPM_L_ERROR, 0);
- save_if_needed(&ctx);
- vboot_reboot();
+ if (IS_ENABLED(CONFIG_RETURN_FROM_VERSTAGE)) {
+ verstage_main();
+ } else {
+ run_romstage();
+ hlt();
}
-
- printk(BIOS_INFO, "Slot %c is selected\n", is_slot_a(&ctx) ? 'A' : 'B');
- vb2_set_selected_region(wd, &fw_main);
- timestamp_add_now(TS_END_VBOOT);
}
-#if IS_ENABLED(CONFIG_RETURN_FROM_VERSTAGE)
-void main(void)
-{
- console_init();
- exception_init();
- verstage_main();
-}
-#endif
+/* This is for boards that rely on main() for an entry point of a stage. */
+void main(void) __attribute__((alias ("verstage")));
diff --git a/src/vendorcode/google/chromeos/vboot_common.h b/src/vendorcode/google/chromeos/vboot_common.h
index f4d5e11..3a9c89b 100644
--- a/src/vendorcode/google/chromeos/vboot_common.h
+++ b/src/vendorcode/google/chromeos/vboot_common.h
@@ -48,4 +48,10 @@ int vboot_enable_developer(void);
void vboot_reboot(void);
+/* Main logic for verified boot. verstage() is the stage entry point
+ * while the verstage_main() is just the core logic. */
+void verstage_main(void);
+void verstage_mainboard_init(void);
+void verstage(void);
+
#endif /* VBOOT_COMMON_H */
More information about the coreboot-gerrit
mailing list