summaryrefslogtreecommitdiff
path: root/src/vendorcode/eltan/security/verified_boot/vboot_check.c
AgeCommit message (Collapse)Author
2019-11-16vendorcode/security/eltan: Allocate memory from bootmem to speed up hashingWim Vervoorn
The verified_boot_check_cbfsfile() will now try to allocate a buffer from bootmem if the item in the list has the VERIFIED_BOOT_COPY_BLOCK attribute set. For large payloads this speeds up the hash operation. BUG=N/A TEST=build Change-Id: Ifa0c93632c59d05ae6d32f8785009a3c3568abc5 Signed-off-by: Wim Vervoorn <wvervoorn@eltan.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/36822 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Frans Hendriks <fhendriks@eltan.com>
2019-11-15vendorcode/eltan/security: Cleanup prog_locate_hookWim Vervoorn
Cleanup of the prog_locate_hook routine so the actual coreboot flow is more clearly reflected in the code. Remove logging that is not really needed. BUG=N/A TEST=tested on fbg1701 Change-Id: Iab6c75beac35d043d296336021c0bce1f828cf34 Signed-off-by: Wim Vervoorn <wvervoorn@eltan.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/36846 Reviewed-by: Aaron Durbin <adurbin@chromium.org> Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2019-11-15vendorcode/eltan/security: Remove cbfs prepare and locateWim Vervoorn
The prepare functionality will be removed from cbfs support and the eltan verified boot is the only software using it. This is not really required as we can use the prog_locate_hook() for this functionality. BUG=N/A TEST=tested on fbg1701 Change-Id: I189cbad4b24bbbb0840ce6100c89a42a327c5456 Signed-off-by: Wim Vervoorn <wvervoorn@eltan.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/36821 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Aaron Durbin <adurbin@chromium.org> Reviewed-by: Frans Hendriks <fhendriks@eltan.com>
2019-11-15vendorcode/eltan/security: Add all verify_lists to include fileWim Vervoorn
Some of the verify lists were added to the include file while others are on vboot_check.c. Also added the ramstage_verify_list. BUG=N/A TEST=tested on fbg1701 Change-Id: If4f1d8b2278277d0af78e357ecce0d5bef441179 Signed-off-by: Wim Vervoorn <wvervoorn@eltan.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/36820 Reviewed-by: Frans Hendriks <fhendriks@eltan.com> Reviewed-by: Aaron Durbin <adurbin@chromium.org> Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2019-11-15vendor/eltan/security: Removed long lines from vboot_checkWim Vervoorn
Removed long lines from the verified_boot_check_buffer() function. BUG=N/A TEST=build Change-Id: I2ea0ae82bd531355111d6b45c67bdc2b1759b7bc Signed-off-by: Wim Vervoorn <wvervoorn@eltan.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/36849 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Frans Hendriks <fhendriks@eltan.com>
2019-11-14cbfs: Stop checking master headerJulius Werner
The CBFS master header is a legacy structure that just conveys the same information we already have from the FMAP these days. We're still including it to support older CBFS implementations in some payloads, but there's no need for coreboot itself to follow this indirection anymore. This patch simplifies the default CBFS locator to just return the CBFS offset and size from the FMAP directly. Change-Id: I6b00dd7f276364d62fa1f637efbaee0e80607c49 Signed-off-by: Julius Werner <jwerner@chromium.org> Reviewed-on: https://review.coreboot.org/c/coreboot/+/36688 Reviewed-by: Wim Vervoorn <wvervoorn@eltan.com> Reviewed-by: Aaron Durbin <adurbin@chromium.org> Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2019-11-14cbfs: Make cbfs_master_header_props() externally availableJulius Werner
This patch makes the CBFS default locator .locate() callback externally available so that code which overrides cbfs_master_header_locator can reuse or wrap it and doesn't have to copy&paste the whole thing. Use it for the Eltan vendorcode implementation which previously did this. Change-Id: I54dad5c8ea64ea0fc472217e275daa815736991e Signed-off-by: Julius Werner <jwerner@chromium.org> Reviewed-on: https://review.coreboot.org/c/coreboot/+/36797 Reviewed-by: Wim Vervoorn <wvervoorn@eltan.com> Reviewed-by: Aaron Durbin <adurbin@chromium.org> Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2019-11-08eltan/security: Replace __PRE_RAM__ with ENV_ROMSTAGE_OR_BEFOREKyösti Mälkki
Change-Id: Id56a63a67b7eb70dce6687bb9c2734a711f611b3 Signed-off-by: Kyösti Mälkki <kyosti.malkki@gmail.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/36635 Reviewed-by: Wim Vervoorn <wvervoorn@eltan.com> Reviewed-by: Frans Hendriks <fhendriks@eltan.com> Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2019-11-08eltan/security: Replace __BOOTBLOCK__ with ENV_BOOTBLOCKKyösti Mälkki
Change-Id: I6ec5a33cd6a6342adfe73c050e0c376bbefad96a Signed-off-by: Kyösti Mälkki <kyosti.malkki@gmail.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/36634 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Wim Vervoorn <wvervoorn@eltan.com> Reviewed-by: Frans Hendriks <fhendriks@eltan.com>
2019-11-08eltan/security: Remove some preprocessor guardsKyösti Mälkki
We generally let garbage-collection take care of unused functions. While at it, move some related variable declarations in to the header file and declare them const like they should be. Change-Id: I7c6fa15bd45f861f13b6123ccb14c55415e42bc7 Signed-off-by: Kyösti Mälkki <kyosti.malkki@gmail.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/36632 Reviewed-by: Wim Vervoorn <wvervoorn@eltan.com> Reviewed-by: Patrick Georgi <pgeorgi@google.com> Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2019-11-04vendorcode/eltan/security: Use custom hash for little endian onlyWim Vervoorn
Only use the custom hash routine when we need little endian. Rename the function as well as it is little endian only now. BUG=N/A TEST=tested on fbg1701 board. Change-Id: I037fa38c5961dab7a81e752c1685da2dc6b33d12 Signed-off-by: Wim Vervoorn <wvervoorn@eltan.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/36482 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Frans Hendriks <fhendriks@eltan.com>
2019-11-01vendorcode/eltan/security: Use vb2 public keyWim Vervoorn
Start using the vb2 public key format and process the signature verification using the vb2 routines. This allows us to use the futility to prepare the keys and eliminates the need for custom tools. BUG=N/A TEST=tested on fbg1701 board Change-Id: Id5d28595bbfb1f5ca5bca0fcfb06134bb1143f25 Signed-off-by: Wim Vervoorn <wvervoorn@eltan.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/36480 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Frans Hendriks <fhendriks@eltan.com>
2019-10-04vendorcode/eltan/security/verified_boot: Add verified boot supportFrans Hendriks
Create verified boot support, which includes verifiication of bootblock. This feature use the vendorcode/eltan/security/lib. cbfs_locator is used to init the verified boot support. vendor_secure_prepare() and vendor_secure_locate() are used to preform the required action in each stage. The next lists will be used for verification: * bootblock_verify_list * postcar_verify_list * romstage_verify_list * ramstage_verify_list BUG=N/A TEST=Created binary and verify logging on Facebook FBG-1701 Change-Id: If6c1423b0b4a309cefb7fe7a29d5100ba289e0b4 Signed-off-by: Frans Hendriks <fhendriks@eltan.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/30835 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Lance Zhao <lance.zhao@gmail.com> Reviewed-by: Philipp Deppenwiese <zaolin.daisuki@gmail.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-02 22:22:31 +0000