common: ab: Fix partition uuid support

Change-Id: I7f8723a29b053e181134b4dade16ae7da0468ee4
Signed-off-by: Xuhui Lin <xuhui.lin@rock-chips.com>

lib: avb: Add CONFIG_ARMV8_CRYPTO support

Change-Id: I545b0275a1cda5c4872eb4de0627212c14cdcae2
Signed-off-by: Xuhui Lin <xuhui.lin@rock-chips.com>

common: android_bootloader: Abandon preload data when boot_partition changed

1. Handle the case: "avb lock + (vbus = 0) + recovery key pressed".
2. Need to clean preload data, when boot_partition ch

common: android_bootloader: Abandon preload data when boot_partition changed

1. Handle the case: "avb lock + (vbus = 0) + recovery key pressed".
2. Need to clean preload data, when boot_partition change.
3. Saved boot_partition shouldn't have _a or _b suffix because
they should be saved in const char *slot_suffix.

Change-Id: Ia6354ef037ea0d205b1dc95e0ea8007925e652a3
Signed-off-by: Xuhui Lin <xuhui.lin@rock-chips.com>

show more ...

lib: avb: Use sha256 lib API

Signed-off-by: Joseph Chen <chenjh@rock-chips.com>
Change-Id: I03f67e12fe1d6d496bd97bc6f37c6cd0261dafaa

lib: avb: Fix maybe-uninitialized

lib/avb/libavb/avb_slot_verify.c:477:40: error: 'found' may be used uninitialized in this function [-Werror=maybe-uninitialized]
| 477 | loaded_partition->partition

lib: avb: Fix maybe-uninitialized

lib/avb/libavb/avb_slot_verify.c:477:40: error: 'found' may be used uninitialized in this function [-Werror=maybe-uninitialized]
| 477 | loaded_partition->partition_name = avb_strdup(found);
| | ^~~~~~~~~~~~~~~~~

Change-Id: Ic3edcc1527ff5e75009f0e4000dac74cb41c569e
Signed-off-by: Jeffy Chen <jeffy.chen@rock-chips.com>

show more ...

common: Add MP boot support

mp_boot build from: a5185c920.

Signed-off-by: Joseph Chen <chenjh@rock-chips.com>
Change-Id: I8f8b2fe45ee87ad0a60e1dfd6f0950f052d4f1e7

lib: avb: avb lock if pre-loader security enable

Save the operation steps of factory production.

Signed-off-by: Jason Zhu <jason.zhu@rock-chips.com>
Change-Id: Ib98b38d1b2e29161e7b2c5ef47b5c73b2fe4

lib: avb: avb lock if pre-loader security enable

Save the operation steps of factory production.

Signed-off-by: Jason Zhu <jason.zhu@rock-chips.com>
Change-Id: Ib98b38d1b2e29161e7b2c5ef47b5c73b2fe46c96

show more ...

lib: avb: avb lock if pre-loader security enable

Save the operation steps of factory production.

Signed-off-by: Jason Zhu <jason.zhu@rock-chips.com>
Change-Id: Icf69fceb04ae77a05954664a8d2d5c53cfa4

lib: avb: avb lock if pre-loader security enable

Save the operation steps of factory production.

Signed-off-by: Jason Zhu <jason.zhu@rock-chips.com>
Change-Id: Icf69fceb04ae77a05954664a8d2d5c53cfa45057

show more ...

lib: avb: sha512: Add support for selecting crypto or software dynamically

Background:
- Crypto_v2 sometimes supports sha512, sometimes doesn't support sha512.
- AVB code is relatively longer much,

lib: avb: sha512: Add support for selecting crypto or software dynamically

Background:
- Crypto_v2 sometimes supports sha512, sometimes doesn't support sha512.
- AVB code is relatively longer much, no need to save the amount of code in sha512.

Future:
- For crypto_v2, don't need to worry whether current platform supports sha512 or not.

Signed-off-by: Xuhui Lin <xuhui.lin@rock-chips.com>
Change-Id: Ia6eb0354bb4cb38eba9ffc46ffef0789f6c376f5

show more ...

android: avb: Support verify resource.img for locked device

The resource.img is from android boot/recovery or
resource partition.

The fit boot/recovery.img was already supported with
fit verify mec

android: avb: Support verify resource.img for locked device

The resource.img is from android boot/recovery or
resource partition.

The fit boot/recovery.img was already supported with
fit verify mechanism.

Signed-off-by: Joseph Chen <chenjh@rock-chips.com>
Change-Id: I54243934b40325c08eefa4bacdee542ee8e81654

show more ...

lib: avb: Fix Kconfig option help info

Signed-off-by: Joseph Chen <chenjh@rock-chips.com>
Change-Id: I9a7112ecbaa19453da72d4ef614cac7f863cd11b

android: avb: Add init_boot support

== init-boot:
This new init_boot partition contains the ramdisk the used to live in
the boot partition. The boot partition will no longer contain that
ramdisk.

i

android: avb: Add init_boot support

== init-boot:
This new init_boot partition contains the ramdisk the used to live in
the boot partition. The boot partition will no longer contain that
ramdisk.

init_boot use android v4 header and is mandory from Android-13.

== avb with unlock:
Don't process hash verify.
Go pre-loaded path: Loading vendor_boot and init_boot
directly to where they should be, while loading the
boot/recovery. The boot message tells like:
···
preloaded: distribute image from 'boot_a'
preloaded: distribute image from 'init_boot_a'
preloaded: distribute image from 'vendor_boot_a'
···

== avb with lock:
Process hash verify.
Go pre-loaded path: Loading full vendor_boot, init_boot and
boot/recovery one by one to verify, and distributing them to
where they should be by memcpy at last.

The three images share a large memory buffer that allocated
by sysmem_alloc(), it locate at high memory address that
just lower than SP bottom. The boot message tells like:
···
preloaded: full image from 'boot_a' at 0xe47f90c0 - 0xe7a4b0c0
preloaded: full image from 'init_boot_a' at 0xeaff90c0 - 0xeb2950c0
preloaded: full image from 'vendor_boot_a' at 0xe87f90c0 - 0xe9f6e0c0
···

Signed-off-by: Joseph Chen <chenjh@rock-chips.com>
Change-Id: I9c8428eb9777eac81952971cfa97b783a7e71394

show more ...

lib: avb: Add AvbOpsData

Signed-off-by: Jason Zhu <jason.zhu@rock-chips.com>
Signed-off-by: Joseph Chen <chenjh@rock-chips.com>
Change-Id: Ib444dbeaab73005a13a4f6e89ca3dc8b8d6272df

lib: avb: use function printf() to print log

Use uboot printf() to print log but not avb library function. So that
we need not to compile libavb if enable a/b system.

Signed-off-by: Jason Zhu <jaso

lib: avb: use function printf() to print log

Use uboot printf() to print log but not avb library function. So that
we need not to compile libavb if enable a/b system.

Signed-off-by: Jason Zhu <jason.zhu@rock-chips.com>
Change-Id: I8dbb3c18fd62858f1d8697fad1935f23f6e6b0a8

show more ...

lib: avb: add function rk_avb_update_stored_rollback_indexes_for_slot()

Signed-off-by: Jason Zhu <jason.zhu@rock-chips.com>
Change-Id: Ib6b452f6079d8ec768a46bd123fd1bd6a79d80fc

lib: avb: add function rk_avb_ab_have_bootable_slot()

Signed-off-by: Jason Zhu <jason.zhu@rock-chips.com>
Change-Id: Ib7e3dc383a1e7d407cdfb69f18f9f8df0cfed7ce

avb: otp: support avb hash download

Change-Id: Idd07a1473d4d1bbe91e309f8db73be08b5b59dd1
Signed-off-by: Wu Liangqing <wlq@rock-chips.com>

lib: avb: avb_atx_validate: fix crypto sha512 fail

The new crypto-v2 drivers requires total data length before sha init,
let's add it to avoid issue:

...
Vboot=0, AVB images, AVB verify
read_

lib: avb: avb_atx_validate: fix crypto sha512 fail

The new crypto-v2 drivers requires total data length before sha init,
let's add it to avoid issue:

...
Vboot=0, AVB images, AVB verify
read_is_device_unlocked() ops returned that device is LOCKED
total length(0x00000000) != init length(0xeb9f6290)!
avb_rsa.c:285: ERROR: Hash check failed.
avb_atx_validate.c:173: ERROR: Invalid certificate signature.
avb_atx_validate.c:199: ERROR: Invalid PIK certificate.
avb_slot_verify.c:865: ERROR: vbmeta: Public key used to sign data rejected.
AVB verify failed
...

Fixes: (5b0bc49177 lib: avb: support crypto sha256/512)

Signed-off-by: Joseph Chen <chenjh@rock-chips.com>
Change-Id: I276041a8b5faadac8c95622f77888a5447ed3a71

show more ...

lib: avb: skip descriptor hash check if unlock

What ever there is descriptor hash or not, let's skip
descriptor hash match check if device is unlock.

We rely on ops->get_preloaded_partition() to lo

lib: avb: skip descriptor hash check if unlock

What ever there is descriptor hash or not, let's skip
descriptor hash match check if device is unlock.

We rely on ops->get_preloaded_partition() to load image
and verify hash, which is more efficient than full load.

By the way, correct the function return code.

Signed-off-by: Joseph Chen <chenjh@rock-chips.com>
Change-Id: If48d7c676fec58b9c3905ba1bcf7ab43b833b323

show more ...

lib: avb: use CONFIG_SUPPORT_EMMC_RPMB to shield the code

Signed-off-by: Jason Zhu <jason.zhu@rock-chips.com>
Change-Id: I4d7009af0c0e3f7d26d9b283476ed623bb97dad2

lib: avb: reduce write rollback index operations

The optee is used to storage security data in U-Boot, and a file
which occupy 16KB is created when write a rollback index. But the
security space is

lib: avb: reduce write rollback index operations

The optee is used to storage security data in U-Boot, and a file
which occupy 16KB is created when write a rollback index. But the
security space is only 512KB, the sapce is not enough when write
too many items.

And here we write rollback index 32 times, but the avb only use
rollback_index_location 0 to verify the rollback index with vbmeta.
So just get the rollback_index_location 0 in this process.

Test:
fastboot getvar at-vboot-state

Error log:
TEEC: reference out of data: -1
TEEC: Not enough space available in secure storage!

Signed-off-by: Jason Zhu <jason.zhu@rock-chips.com>
Change-Id: Id69b852553a4ef9111dabe6f23e25038b0928bb3

show more ...

lib: avb: return flash unlock status

Return flash unlock status when close CONFIG_OPTEE_CLIENT.

Signed-off-by: Jason Zhu <jason.zhu@rock-chips.com>
Change-Id: I7a7a03b8305c864d83d3d2c14b0f9aa104b2e

lib: avb: return flash unlock status

Return flash unlock status when close CONFIG_OPTEE_CLIENT.

Signed-off-by: Jason Zhu <jason.zhu@rock-chips.com>
Change-Id: I7a7a03b8305c864d83d3d2c14b0f9aa104b2ef59

show more ...

lib: avb: support crypto sha256/512

Signed-off-by: Joseph Chen <chenjh@rock-chips.com>
Change-Id: Ifbcc1940d9b494fc488c0b9e95f88d7c98604f62

lib: avb: independent on optee client

Signed-off-by: Joseph Chen <chenjh@rock-chips.com>
Change-Id: I1bab69baf97b5174024db25278cf30efafd3e34e

lib: avb: separate the ab from the avb lib

Open CONFIG_AVB_LIBAVB_USER & CONFIG_ANDROID_AB &
CONFIG_AVB_LIBAVB_AB to enable ab.

Signed-off-by: Jason Zhu <jason.zhu@rock-chips.com>
Change-Id: I16119

lib: avb: separate the ab from the avb lib

Open CONFIG_AVB_LIBAVB_USER & CONFIG_ANDROID_AB &
CONFIG_AVB_LIBAVB_AB to enable ab.

Signed-off-by: Jason Zhu <jason.zhu@rock-chips.com>
Change-Id: I1611907b3cb82f72d5e706ed966ee98c7569d230

show more ...