2 files changed, 22 insertions, 2 deletions
diff --git a/src/vendorcode/google/chromeos/vboot2/Kconfig b/src/vendorcode/google/chromeos/vboot2/Kconfig
index bb6c1add0a..a086785e3f 100644
--- a/src/vendorcode/google/chromeos/vboot2/Kconfig
+++ b/src/vendorcode/google/chromeos/vboot2/Kconfig
@@ -101,3 +101,13 @@ config VBOOT_BOOT_LOADER_INDEX
 	help
 	  This is the index of the bootloader component in the verified
 	  firmware block.
+
+config VBOOT_DYNAMIC_WORK_BUFFER
+	bool "Vboot's work buffer is dynamically allocated."
+	default n
+	depends on VBOOT_VERIFY_FIRMWARE
+	help
+	  This option is used when there isn't enough pre-main memory
+	  ram to allocate the vboot work buffer. That means vboot verification
+	  is after memory init and requires main memory to back the work
+	  buffer.
diff --git a/src/vendorcode/google/chromeos/vboot2/common.c b/src/vendorcode/google/chromeos/vboot2/common.c
index 289005c996..deb0c8816c 100644
--- a/src/vendorcode/google/chromeos/vboot2/common.c
+++ b/src/vendorcode/google/chromeos/vboot2/common.c
@@ -18,6 +18,7 @@
  */
 
 #include <cbfs.h>
+#include <cbmem.h>
 #include <console/console.h>
 #include <reset.h>
 #include "../chromeos.h"
@@ -25,14 +26,23 @@
 #include "../vboot_handoff.h"
 #include "misc.h"
 
+static const size_t vb_work_buf_size = 16 * KiB;
+
 struct vb2_working_data * const vboot_get_working_data(void)
 {
-	return (struct vb2_working_data *)_vboot2_work;
+	if (IS_ENABLED(CONFIG_VBOOT_DYNAMIC_WORK_BUFFER))
+		/* cbmem_add() does a cbmem_find() first. */
+		return cbmem_add(CBMEM_ID_VBOOT_WORKBUF, vb_work_buf_size);
+	else
+		return (struct vb2_working_data *)_vboot2_work;
 }
 
 size_t vb2_working_data_size(void)
 {
-	return _vboot2_work_size;
+	if (IS_ENABLED(CONFIG_VBOOT_DYNAMIC_WORK_BUFFER))
+		return vb_work_buf_size;
+	else
+		return _vboot2_work_size;
 }
 
 void *vboot_get_work_buffer(struct vb2_working_data *wd)