GNUBoot
/
coreboot-kgpe-d16
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

device/pci_device.c: Use verified boot to check oprom 

Before oprom is executed, no check is performed if rom passes verification.
Add call to verified_boot_should_run_oprom() to verify the oprom.

verified_boot_should_run_oprom() expects and rom address as input pointer.
*rom is added as input parameter to should_run_oprom() which must be parsed
to verified_boot_should_run_oprom()..

BUG=N/A
TEST=Created verified binary and verify logging on Facebook FBG1701

Change-Id: Iec5092e85d34940ea3a3bb1192ea49f3bc3e5b27
Signed-off-by: Frans Hendriks <fhendriks@eltan.com>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/30810
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Philipp Deppenwiese <zaolin.daisuki@gmail.com>
This commit is contained in:
Frans Hendriks 2019-10-04 14:06:33 +02:00 committed by Patrick Georgi
parent 9d68cb2144
commit b71181adc3
2 changed files with 9 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
src/device/pci_device.c
View File

@ -679,10 +679,15 @@ void pci_dev_set_subsystem(struct device *dev, unsigned int vendor,
} }
} }
static int should_run_oprom(struct device *dev) static int should_run_oprom(struct device *dev, struct rom_header *rom)
{ {
static int should_run = -1; static int should_run = -1;
if (CONFIG(VENDORCODE_ELTAN_VBOOT))
if (rom != NULL)
if (!verified_boot_should_run_oprom(rom))
return 0;
if (should_run >= 0) if (should_run >= 0)
return should_run; return should_run;
@ -711,7 +716,7 @@ static int should_load_oprom(struct device *dev)
return 0; return 0;
if (CONFIG(ALWAYS_LOAD_OPROM)) if (CONFIG(ALWAYS_LOAD_OPROM))
return 1; return 1;
if (should_run_oprom(dev)) if (should_run_oprom(dev, NULL))
return 1; return 1;
return 0; return 0;
@ -742,7 +747,7 @@ void pci_dev_init(struct device *dev)
return; return;
timestamp_add_now(TS_OPROM_COPY_END); timestamp_add_now(TS_OPROM_COPY_END);
if (!should_run_oprom(dev)) if (!should_run_oprom(dev, rom))
return; return;
run_bios(dev, (unsigned long)ram); run_bios(dev, (unsigned long)ram);

1
src/include/device/pci_rom.h
View File

@ -47,4 +47,5 @@ void pci_rom_ssdt(struct device *device);
u32 map_oprom_vendev(u32 vendev); u32 map_oprom_vendev(u32 vendev);
int verified_boot_should_run_oprom(struct rom_header *rom_header);
#endif #endif