diff options
| author | Jakub Czapiga <jacz@semihalf.com> | 2022-07-25 14:24:06 +0200 |
|---|---|---|
| committer | Martin L Roth <gaumless@tutanota.com> | 2022-07-30 18:29:25 +0000 |
| commit | 190afda543d2a23b6ab3b4e0d8c9b3090875e707 (patch) | |
| tree | 42b2dc12973bc9b08db952dc48dc121ca0844eca | |
| parent | ae157d38e3eb91302d250c0826977fe8b5e43e9c (diff) | |
security/vboot: Simplify image signing
futility now supports image truncation and signing of whole images with
a single command invocation. Use it for vboot-enabled coreboot images.
TEST=Build and run coreboot on google/volteer
Signed-off-by: Jakub Czapiga <jacz@semihalf.com>
Change-Id: I49eb7e977b635ccb9f6c1b76e53c36e82be1d795
Reviewed-on: https://review.coreboot.org/c/coreboot/+/66127
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Julius Werner <jwerner@chromium.org>
Reviewed-by: Yu-Ping Wu <yupingso@google.com>
| -rw-r--r-- | src/security/vboot/Makefile.inc | 44 |
1 files changed, 13 insertions, 31 deletions
diff --git a/src/security/vboot/Makefile.inc b/src/security/vboot/Makefile.inc index 2caeb17434..252a91efe5 100644 --- a/src/security/vboot/Makefile.inc +++ b/src/security/vboot/Makefile.inc @@ -344,39 +344,21 @@ files_added:: $(FUTILITY) $(obj)/coreboot.rom endif -# Extract FW_MAIN_? region and minimize it if the last file is empty, so it -# doesn't contain this empty file (that can have a significant size), -# improving a lot on hash times due to a smaller amount of data loaded from -# firmware storage. -# When passing the minimized image to vbutil_firmware, its length is recorded -# in the keyblock, and coreboot's vboot code clips the region_device to match, -# which prevents any potential extension attacks. -$(obj)/FW_MAIN_%.bin: $(obj)/coreboot.rom - $(CBFSTOOL) $< truncate -r $(basename $(notdir $@)) > $@.tmp.size - $(CBFSTOOL) $< read -r $(basename $(notdir $@)) -f $@.tmp - head -c $$( printf "%d" $$(cat $@.tmp.size)) $@.tmp > $@.tmp2 - mv $@.tmp2 $@ - rm -f $@.tmp $@.tmp.size - -$(obj)/VBLOCK_%.bin: $(obj)/FW_MAIN_%.bin $(FUTILITY) - $(FUTILITY) vbutil_firmware \ - --vblock $@ \ - --keyblock "$(CONFIG_VBOOT_KEYBLOCK)" \ +ifneq (,$(filter y,$(CONFIG_VBOOT_SLOTS_RW_A) $(CONFIG_VBOOT_SLOTS_RW_AB))) +files_added:: $(obj)/coreboot.rom $(FUTILITY) $(CBFSTOOL) + CBFSTOOL="$(CBFSTOOL)" \ + $(FUTILITY) sign \ --signprivate "$(CONFIG_VBOOT_FIRMWARE_PRIVKEY)" \ - --version $(CONFIG_VBOOT_KEYBLOCK_VERSION) \ - --fv $< \ + --keyblock "$(CONFIG_VBOOT_KEYBLOCK)" \ --kernelkey "$(CONFIG_VBOOT_KERNEL_KEY)" \ - --flags $(CONFIG_VBOOT_KEYBLOCK_PREAMBLE_FLAGS) - -ifeq ($(CONFIG_VBOOT_SLOTS_RW_AB),y) -files_added:: $(obj)/VBLOCK_A.bin $(obj)/VBLOCK_B.bin - $(CBFSTOOL) $(obj)/coreboot.rom write -u -r VBLOCK_A -f $(obj)/VBLOCK_A.bin - $(CBFSTOOL) $(obj)/coreboot.rom write -u -r VBLOCK_B -f $(obj)/VBLOCK_B.bin - @printf " FLASHMAP Layout generated for RO, A and B partition.\n" -else ifeq ($(CONFIG_VBOOT_SLOTS_RW_A),y) -files_added:: $(obj)/VBLOCK_A.bin - $(CBFSTOOL) $(obj)/coreboot.rom write -u -r VBLOCK_A -f $(obj)/VBLOCK_A.bin - @printf " FLASHMAP Layout generated for RO and A partition.\n" + --version $(CONFIG_VBOOT_KEYBLOCK_VERSION) \ + --flags $(CONFIG_VBOOT_KEYBLOCK_PREAMBLE_FLAGS) \ + $(obj)/coreboot.rom + if [ "$(CONFIG_VBOOT_SLOTS_RW_AB)" = 'y' ]; then \ + printf " FLASHMAP Layout generated for RO, A and B partition.\n"; \ + elif [ "$(CONFIG_VBOOT_SLOTS_RW_A)" = 'y' ]; then \ + printf " FLASHMAP Layout generated for RO and A partition.\n"; \ + fi else files_added:: @printf " FLASHMAP Layout generated for RO partition only.\n" |