Initial integration of AVB2.0

Enable a "avb" command to execute Android Verified
Boot 2.0 operations. It includes such subcommands:
avb init - initialize avb2 subsystem
avb read_rb - read rollback index
avb write_rb - write rollback index
avb is_unlocked - check device lock state
avb get_uuid - read and print uuid of a partition
avb read_part - read data from partition
avb read_part_hex - read data from partition and output to stdout avb write_part - write data to partition
avb verify - run full verification chain

Signed-off-by Igor Opaniuk <[email protected]>

---
 cmd/Kconfig  |  15 +++
 cmd/Makefile |   3 +
 cmd/avb.c    | 351 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 369 insertions(+)
 create mode 100644 cmd/avb.c

cmd/Kconfig +15 -0

index bc1d2f3..96695ff 100644
@@ -1675,6 +1675,21 @@ config CMD_TRACE
          for analsys (e.g. using bootchart). See doc/README.trace for full
          details.
 
+config CMD_AVB
+       bool "avb - Android Verified Boot 2.0 operations"
+       depends on LIBAVB_AB
+       help
+         Enables a "avb" command to perform verification of partitions using
+         Android Verified Boot 2.0 functionality. It includes such subcommands:
+           avb init - initialize avb2 subsystem
+           avb read_rb - read rollback index
+           avb write_rb - write rollback index
+           avb is_unlocked - check device lock state
+           avb get_uuid - read and print uuid of a partition
+           avb read_part - read data from partition
+           avb read_part_hex - read data from partition and output to stdout
+           avb write_part - write data to partition
+           avb verify - run full verification chain
 endmenu
 
 config CMD_UBI

cmd/Makefile +3 -0

index c4269ac..bbf6c2a 100644
@@ -151,6 +151,9 @@ obj-$(CONFIG_CMD_REGULATOR) += regulator.o
 
 obj-$(CONFIG_CMD_BLOB) += blob.o
 
+# Android Verified Boot 2.0
+obj-$(CONFIG_CMD_AVB) += avb.o
+
 obj-$(CONFIG_X86) += x86/
 endif # !CONFIG_SPL_BUILD
 

cmd/avb.c new file +49 -0

new file mode 100644
index 0000000..d040906
@@ -0,0 +1,351 @@
+
+/*
+ * (C) Copyright 2018, Linaro Limited
+ *
+ * SPDX-License-Identifier:    GPL-2.0+
+ */
+
+#include <avb_verify.h>
+#include <command.h>
+#include <image.h>
+#include <malloc.h>
+#include <mmc.h>
+
+#define AVB_BOOTARGS   "avb_bootargs"
+static struct AvbOps *avb_ops;
+
+static const char * const requested_partitions[] = {"boot",
+                                            "system",
+                                            "vendor",
+                                            NULL};
+
+int do_avb_init(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
+{
+       unsigned long mmc_dev;
+
+       if (argc != 2)
+               return CMD_RET_USAGE;
+
+       mmc_dev = simple_strtoul(argv[1], NULL, 16);
+
+       if (avb_ops)
+               avb_ops_free(avb_ops);
+
+       avb_ops = avb_ops_alloc(mmc_dev);
+       if (avb_ops)
+               return CMD_RET_SUCCESS;
+
+       return CMD_RET_FAILURE;
+}
+
+int do_avb_read_part(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
+{
+       const char *part;
+       s64 offset;
+       size_t bytes, bytes_read = 0;
+       void *buffer;
+
+       if (!avb_ops) {
+               printf("AVB 2.0 is not initialized, please run 'avb init'\n");

cmd/avb.c new file +292 -1

+
+       if (avb_ops->read_from_partition(avb_ops, part, offset, bytes,
+                                        buffer, &bytes_read) ==
+                                        AVB_IO_RESULT_OK) {
+               printf("Read %zu bytes\n", bytes_read);
+               return CMD_RET_SUCCESS;
+       }
+
+       return CMD_RET_FAILURE;
+}
+
+int do_avb_read_part_hex(cmd_tbl_t *cmdtp, int flag, int argc,
+                        char *const argv[])
+{
+       const char *part;
+       s64 offset;
+       size_t bytes, bytes_read = 0;
+       char *buffer;
+
+       if (!avb_ops) {
+               printf("AVB 2.0 is not initialized, please run 'avb init'\n");
+               return CMD_RET_USAGE;
+       }
+
+       if (argc != 4)
+               return CMD_RET_USAGE;
+
+       part = argv[1];
+       offset = simple_strtoul(argv[2], NULL, 16);
+       bytes = simple_strtoul(argv[3], NULL, 16);
+
+       buffer = malloc(bytes);
+       if (!buffer) {
+               printf("Failed to tlb_allocate buffer for data\n");
+               return CMD_RET_FAILURE;
+       }
+       memset(buffer, 0, bytes);
+
+       if (avb_ops->read_from_partition(avb_ops, part, offset, bytes, buffer,
+                                        &bytes_read) == AVB_IO_RESULT_OK) {
+               printf("Requested %zu, read %zu bytes\n", bytes, bytes_read);
+               printf("Data: ");
+               for (int i = 0; i < bytes_read; i++)
+                       printf("%02X", buffer[i]);
+
+               printf("\n");
+
+               free(buffer);
+               return CMD_RET_SUCCESS;
+       }
+
+       free(buffer);
+       return CMD_RET_FAILURE;
+}
+
+int do_avb_write_part(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
+{
+       const char *part;
+       s64 offset;
+       size_t bytes;
+       void *buffer;
+
+       if (!avb_ops) {
+               printf("AVB 2.0 is not initialized, run 'avb init' first\n");
+               return CMD_RET_FAILURE;
+       }
+
+       if (argc != 5)
+               return CMD_RET_USAGE;
+
+       part = argv[1];
+       offset = simple_strtoul(argv[2], NULL, 16);
+       bytes = simple_strtoul(argv[3], NULL, 16);
+       buffer = (void *)simple_strtoul(argv[4], NULL, 16);
+
+       if (avb_ops->write_to_partition(avb_ops, part, offset, bytes, buffer) ==
+           AVB_IO_RESULT_OK) {
+               printf("Wrote %zu bytes\n", bytes);
+               return CMD_RET_SUCCESS;
+       }
+
+       return CMD_RET_FAILURE;
+}
+
+int do_avb_read_rb(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
+{
+       size_t index;
+       u64 rb_idx;
+
+       if (!avb_ops) {
+               printf("AVB 2.0 is not initialized, run 'avb init' first\n");
+               return CMD_RET_FAILURE;
+       }
+
+       if (argc != 2)
+               return CMD_RET_USAGE;
+
+       index = (size_t)simple_strtoul(argv[1], NULL, 16);
+
+       if (avb_ops->read_rollback_index(avb_ops, index, &rb_idx) ==
+           AVB_IO_RESULT_OK) {
+               printf("Rollback index: %llu\n", rb_idx);
+               return CMD_RET_SUCCESS;
+       }
+       return CMD_RET_FAILURE;
+}
+
+int do_avb_write_rb(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
+{
+       size_t index;
+       u64 rb_idx;
+
+       if (!avb_ops) {
+               printf("AVB 2.0 is not initialized, run 'avb init' first\n");
+               return CMD_RET_FAILURE;
+       }
+
+       if (argc != 3)
+               return CMD_RET_USAGE;
+
+       index = (size_t)simple_strtoul(argv[1], NULL, 16);
+       rb_idx = simple_strtoul(argv[2], NULL, 16);
+
+       if (avb_ops->write_rollback_index(avb_ops, index, rb_idx) ==
+           AVB_IO_RESULT_OK)
+               return CMD_RET_SUCCESS;
+
+       return CMD_RET_FAILURE;
+}
+
+int do_avb_get_uuid(cmd_tbl_t *cmdtp, int flag,
+                   int argc, char * const argv[])
+{
+       const char *part;
+       char buffer[UUID_STR_LEN + 1];
+
+       if (!avb_ops) {
+               printf("AVB 2.0 is not initialized, run 'avb init' first\n");
+               return CMD_RET_FAILURE;
+       }
+
+       if (argc != 2)
+               return CMD_RET_USAGE;
+
+       part = argv[1];
+
+       if (avb_ops->get_unique_guid_for_partition(avb_ops, part, buffer,
+                                                  UUID_STR_LEN + 1) ==
+                                                  AVB_IO_RESULT_OK) {
+               printf("'%s' UUID: %s\n", part, buffer);
+               return CMD_RET_SUCCESS;
+       }
+
+       return CMD_RET_FAILURE;
+}
+
+int do_avb_verify_part(cmd_tbl_t *cmdtp, int flag,
+                      int argc, char *const argv[])
+{
+       AvbSlotVerifyResult slot_result;
+       AvbSlotVerifyData *out_data;
+
+       bool unlocked = false;
+       int res = CMD_RET_FAILURE;
+
+       if (!avb_ops) {
+               printf("AVB 2.0 is not initialized, run 'avb init' first\n");
+               return CMD_RET_FAILURE;
+       }
+
+       if (argc != 1)
+               return CMD_RET_USAGE;
+
+       printf("## Android Verified Boot 2.0 version %s\n",
+              avb_version_string());
+
+       if (avb_ops->read_is_device_unlocked(avb_ops, &unlocked) !=
+           AVB_IO_RESULT_OK) {
+               printf("Can't determine device lock state.\n");
+               return CMD_RET_FAILURE;
+       }
+
+       slot_result = avb_slot_verify(avb_ops, requested_partitions,
+                                     "", unlocked, &out_data);
+       switch (slot_result) {
+       case AVB_SLOT_VERIFY_RESULT_OK:
+               printf("Verification passed successfully\n");
+
+               /* export additional bootargs to AVB_BOOTARGS env var */
+               env_set(AVB_BOOTARGS, out_data->cmdline);
+
+               res = CMD_RET_SUCCESS;
+               break;
+       case AVB_SLOT_VERIFY_RESULT_ERROR_VERIFICATION:
+               printf("Verification failed\n");
+               break;
+       case AVB_SLOT_VERIFY_RESULT_ERROR_IO:
+               printf("I/O error occurred during verification\n");
+               break;
+       case AVB_SLOT_VERIFY_RESULT_ERROR_OOM:
+               printf("OOM error occurred during verification\n");
+               break;
+       case AVB_SLOT_VERIFY_RESULT_ERROR_INVALID_METADATA:
+               printf("Corrupted dm-verity metadata detected\n");
+               break;
+       case AVB_SLOT_VERIFY_RESULT_ERROR_UNSUPPORTED_VERSION:
+               printf("Unsupported version avbtool was used\n");
+               break;
+       case AVB_SLOT_VERIFY_RESULT_ERROR_ROLLBACK_INDEX:
+               printf("Checking rollback index failed\n");
+               break;
+       case AVB_SLOT_VERIFY_RESULT_ERROR_PUBLIC_KEY_REJECTED:
+               printf("Public key was rejected\n");
+               break;
+       default:
+               printf("Unknown error occurred\n");
+       }
+
+       return res;
+}
+
+int do_avb_is_unlocked(cmd_tbl_t *cmdtp, int flag,
+                      int argc, char * const argv[])
+{
+       bool unlock;
+
+       if (!avb_ops) {
+               printf("AVB not initialized, run 'avb init' first\n");
+               return CMD_RET_FAILURE;
+       }
+
+       if (argc != 1) {
+               printf("--%s(-1)\n", __func__);
+               return CMD_RET_USAGE;
+       }
+
+       if (avb_ops->read_is_device_unlocked(avb_ops, &unlock) ==
+           AVB_IO_RESULT_OK) {
+               printf("Unlocked = %d\n", unlock);
+               return CMD_RET_SUCCESS;
+       }
+
+       return CMD_RET_FAILURE;
+}
+
+static cmd_tbl_t cmd_avb[] = {
+       U_BOOT_CMD_MKENT(init, 2, 0, do_avb_init, "", ""),
+       U_BOOT_CMD_MKENT(read_rb, 2, 0, do_avb_read_rb, "", ""),
+       U_BOOT_CMD_MKENT(write_rb, 3, 0, do_avb_write_rb, "", ""),
+       U_BOOT_CMD_MKENT(is_unlocked, 1, 0, do_avb_is_unlocked, "", ""),
+       U_BOOT_CMD_MKENT(get_uuid, 2, 0, do_avb_get_uuid, "", ""),
+       U_BOOT_CMD_MKENT(read_part, 5, 0, do_avb_read_part, "", ""),
+       U_BOOT_CMD_MKENT(read_part_hex, 4, 0, do_avb_read_part_hex, "", ""),
+       U_BOOT_CMD_MKENT(write_part, 5, 0, do_avb_write_part, "", ""),
+       U_BOOT_CMD_MKENT(verify, 1, 0, do_avb_verify_part, "", ""),
+};
+
+static int do_avb(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
+{
+       cmd_tbl_t *cp;
+
+       cp = find_cmd_tbl(argv[1], cmd_avb, ARRAY_SIZE(cmd_avb));
+
+       argc--;
+       argv++;
+
+       if (!cp || argc > cp->maxargs)
+               return CMD_RET_USAGE;
+
+       if (flag == CMD_FLAG_REPEAT)
+               return CMD_RET_FAILURE;
+
+       return cp->cmd(cmdtp, flag, argc, argv);
+}
+
+U_BOOT_CMD(
+       avb, 29, 0, do_avb,
+       "Provides commands for testing Android Verified Boot 2.0 functionality",
+       "init <dev> - initialize avb2 for <dev>\n"
+       "avb read_rb <num> - read rollback index at location <num>\n"
+       "avb write_rb <num> <rb> - write rollback index <rb> to <num>\n"
+       "avb is_unlocked - returns unlock status of the device\n"
+       "avb get_uuid <partname> - read and print uuid of partition <part>\n"
+       "avb read_part <partname> <offset> <num> <addr> - read <num> bytes from\n"
+       "    partition <partname> to buffer <addr>\n"
+       "avb read_part_hex <partname> <offset> <num> - read <num> bytes from\n"
+       "    partition <partname> and print to stdout\n"
+       "avb write_part <partname> <offset> <num> <addr> - write <num> bytes to\n"
+       "    <partname> by <offset> using data from <addr>\n"
+       "avb verify - run verification process using hash data\n"
+       "    from vbmeta structure\n"
+       );
--

2.7.4

Enable a "avb" command to execute Android Verified
Boot 2.0 operations. It includes such subcommands:
avb init - initialize avb2 subsystem
avb read_rb - read rollback index
avb write_rb - write rollback index
avb is_unlocked - check device lock state
avb get_uuid - read and print uuid of a partition
avb read_part - read data from partition
avb read_part_hex - read data from partition and output to stdout avb write_part - write data to partition
avb verify - run full verification chain

Signed-off-by Igor Opaniuk <[email protected]>

---
 cmd/Kconfig  |  15 +++
 cmd/Makefile |   3 +
 cmd/avb.c    | 351 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 369 insertions(+)
 create mode 100644 cmd/avb.c

cmd/Kconfig +15 -0

index bc1d2f3..96695ff 100644
@@ -1675,6 +1675,21 @@ config CMD_TRACE
          for analsys (e.g. using bootchart). See doc/README.trace for full
          details.
 
+config CMD_AVB
+       bool "avb - Android Verified Boot 2.0 operations"
+       depends on LIBAVB_AB
+       help
+         Enables a "avb" command to perform verification of partitions using
+         Android Verified Boot 2.0 functionality. It includes such subcommands:
+           avb init - initialize avb2 subsystem
+           avb read_rb - read rollback index
+           avb write_rb - write rollback index
+           avb is_unlocked - check device lock state
+           avb get_uuid - read and print uuid of a partition
+           avb read_part - read data from partition
+           avb read_part_hex - read data from partition and output to stdout
+           avb write_part - write data to partition
+           avb verify - run full verification chain
 endmenu
 
 config CMD_UBI

cmd/Makefile +3 -0

index c4269ac..bbf6c2a 100644
@@ -151,6 +151,9 @@ obj-$(CONFIG_CMD_REGULATOR) += regulator.o
 
 obj-$(CONFIG_CMD_BLOB) += blob.o
 
+# Android Verified Boot 2.0
+obj-$(CONFIG_CMD_AVB) += avb.o
+
 obj-$(CONFIG_X86) += x86/
 endif # !CONFIG_SPL_BUILD
 

cmd/avb.c new file +53 -0

new file mode 100644
index 0000000..d040906
@@ -0,0 +1,351 @@
+
+/*
+ * (C) Copyright 2018, Linaro Limited
+ *
+ * SPDX-License-Identifier:    GPL-2.0+
+ */
+
+#include <avb_verify.h>
+#include <command.h>
+#include <image.h>
+#include <malloc.h>
+#include <mmc.h>
+
+#define AVB_BOOTARGS   "avb_bootargs"
+static struct AvbOps *avb_ops;
+
+static const char * const requested_partitions[] = {"boot",
+                                            "system",
+                                            "vendor",
+                                            NULL};
+
+int do_avb_init(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
+{
+       unsigned long mmc_dev;
+
+       if (argc != 2)
+               return CMD_RET_USAGE;
+
+       mmc_dev = simple_strtoul(argv[1], NULL, 16);
+
+       if (avb_ops)
+               avb_ops_free(avb_ops);
+
+       avb_ops = avb_ops_alloc(mmc_dev);
+       if (avb_ops)
+               return CMD_RET_SUCCESS;
+
+       return CMD_RET_FAILURE;
+}
+
+int do_avb_read_part(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
+{
+       const char *part;
+       s64 offset;
+       size_t bytes, bytes_read = 0;
+       void *buffer;
+
+       if (!avb_ops) {
+               printf("AVB 2.0 is not initialized, please run 'avb init'\n");
+               return CMD_RET_USAGE;
+       }
+
+       if (argc != 5)

Hi Igor,

Quoted 119 lines · Igor Opaniuk

Enable a "avb" command to execute Android Verified
Boot 2.0 operations. It includes such subcommands:
avb init - initialize avb2 subsystem
avb read_rb - read rollback index
avb write_rb - write rollback index
avb is_unlocked - check device lock state
avb get_uuid - read and print uuid of a partition
avb read_part - read data from partition
avb read_part_hex - read data from partition and output to stdout avb write_part - write data to partition
avb verify - run full verification chain

Signed-off-by Igor Opaniuk <[email protected]>

---
 cmd/Kconfig  |  15 +++
 cmd/Makefile |   3 +
 cmd/avb.c    | 351 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 369 insertions(+)
 create mode 100644 cmd/avb.c

cmd/Kconfig +15 -0

index bc1d2f3..96695ff 100644
@@ -1675,6 +1675,21 @@ config CMD_TRACE
          for analsys (e.g. using bootchart). See doc/README.trace for full
          details.
 
+config CMD_AVB
+       bool "avb - Android Verified Boot 2.0 operations"
+       depends on LIBAVB_AB
+       help
+         Enables a "avb" command to perform verification of partitions using
+         Android Verified Boot 2.0 functionality. It includes such subcommands:
+           avb init - initialize avb2 subsystem
+           avb read_rb - read rollback index
+           avb write_rb - write rollback index
+           avb is_unlocked - check device lock state
+           avb get_uuid - read and print uuid of a partition
+           avb read_part - read data from partition
+           avb read_part_hex - read data from partition and output to stdout
+           avb write_part - write data to partition
+           avb verify - run full verification chain
 endmenu
 
 config CMD_UBI

cmd/Makefile +3 -0

index c4269ac..bbf6c2a 100644
@@ -151,6 +151,9 @@ obj-$(CONFIG_CMD_REGULATOR) += regulator.o
 
 obj-$(CONFIG_CMD_BLOB) += blob.o
 
+# Android Verified Boot 2.0
+obj-$(CONFIG_CMD_AVB) += avb.o
+
 obj-$(CONFIG_X86) += x86/
 endif # !CONFIG_SPL_BUILD
 

cmd/avb.c new file +53 -0

new file mode 100644
index 0000000..d040906
@@ -0,0 +1,351 @@
+
+/*
+ * (C) Copyright 2018, Linaro Limited
+ *
+ * SPDX-License-Identifier:    GPL-2.0+
+ */
+
+#include <avb_verify.h>
+#include <command.h>
+#include <image.h>
+#include <malloc.h>
+#include <mmc.h>
+
+#define AVB_BOOTARGS   "avb_bootargs"
+static struct AvbOps *avb_ops;
+
+static const char * const requested_partitions[] = {"boot",
+                                            "system",
+                                            "vendor",
+                                            NULL};
+
+int do_avb_init(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
+{
+       unsigned long mmc_dev;
+
+       if (argc != 2)
+               return CMD_RET_USAGE;
+
+       mmc_dev = simple_strtoul(argv[1], NULL, 16);
+
+       if (avb_ops)
+               avb_ops_free(avb_ops);
+
+       avb_ops = avb_ops_alloc(mmc_dev);
+       if (avb_ops)
+               return CMD_RET_SUCCESS;
+
+       return CMD_RET_FAILURE;
+}
+
+int do_avb_read_part(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
+{
+       const char *part;
+       s64 offset;
+       size_t bytes, bytes_read = 0;
+       void *buffer;
+
+       if (!avb_ops) {
+               printf("AVB 2.0 is not initialized, please run 'avb init'\n");
+               return CMD_RET_USAGE;
+       }
+
+       if (argc != 5)

cmd/avb.c line 63

Quoted 10 lines

cmd/avb.c new file +10 -0

+               return CMD_RET_USAGE;
+
+       part = argv[1];
+       offset = simple_strtoul(argv[2], NULL, 16);
+       bytes = simple_strtoul(argv[3], NULL, 16);
+       buffer = (void *)simple_strtoul(argv[4], NULL, 16);
+
+       if (avb_ops->read_from_partition(avb_ops, part, offset, bytes,
+                                        buffer, &bytes_read) ==
+                                        AVB_IO_RESULT_OK) {

Please can you make sure this uses driver model, and put wrappers for these function calls in the uclass?

Regards,
Simon

Hi Simon,

I've dug into DriverModel documentation and even created a PoC for existing avb commands. The problem is that (maybe I missed out some key concepts) I'm still
not sure if it makes sense to follow it driver mode in the context of AVB 2.0 feature and
what kind of extra devices can be used within the same uclass in this case? Could you please explain in detail.
Thanks

Hi Sam,
Thanks, will fix!

Quoted 135 lines · Simon Glass

Hi Igor,

Quoted 119 lines · Igor Opaniuk

Enable a "avb" command to execute Android Verified
Boot 2.0 operations. It includes such subcommands:
avb init - initialize avb2 subsystem
avb read_rb - read rollback index
avb write_rb - write rollback index
avb is_unlocked - check device lock state
avb get_uuid - read and print uuid of a partition
avb read_part - read data from partition
avb read_part_hex - read data from partition and output to stdout avb write_part - write data to partition
avb verify - run full verification chain

Signed-off-by Igor Opaniuk <[email protected]>

---
 cmd/Kconfig  |  15 +++
 cmd/Makefile |   3 +
 cmd/avb.c    | 351 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 369 insertions(+)
 create mode 100644 cmd/avb.c

cmd/Kconfig +15 -0

index bc1d2f3..96695ff 100644
@@ -1675,6 +1675,21 @@ config CMD_TRACE
          for analsys (e.g. using bootchart). See doc/README.trace for full
          details.
 
+config CMD_AVB
+       bool "avb - Android Verified Boot 2.0 operations"
+       depends on LIBAVB_AB
+       help
+         Enables a "avb" command to perform verification of partitions using
+         Android Verified Boot 2.0 functionality. It includes such subcommands:
+           avb init - initialize avb2 subsystem
+           avb read_rb - read rollback index
+           avb write_rb - write rollback index
+           avb is_unlocked - check device lock state
+           avb get_uuid - read and print uuid of a partition
+           avb read_part - read data from partition
+           avb read_part_hex - read data from partition and output to stdout
+           avb write_part - write data to partition
+           avb verify - run full verification chain
 endmenu
 
 config CMD_UBI

cmd/Makefile +3 -0

index c4269ac..bbf6c2a 100644
@@ -151,6 +151,9 @@ obj-$(CONFIG_CMD_REGULATOR) += regulator.o
 
 obj-$(CONFIG_CMD_BLOB) += blob.o
 
+# Android Verified Boot 2.0
+obj-$(CONFIG_CMD_AVB) += avb.o
+
 obj-$(CONFIG_X86) += x86/
 endif # !CONFIG_SPL_BUILD
 

cmd/avb.c new file +53 -0

new file mode 100644
index 0000000..d040906
@@ -0,0 +1,351 @@
+
+/*
+ * (C) Copyright 2018, Linaro Limited
+ *
+ * SPDX-License-Identifier:    GPL-2.0+
+ */
+
+#include <avb_verify.h>
+#include <command.h>
+#include <image.h>
+#include <malloc.h>
+#include <mmc.h>
+
+#define AVB_BOOTARGS   "avb_bootargs"
+static struct AvbOps *avb_ops;
+
+static const char * const requested_partitions[] = {"boot",
+                                            "system",
+                                            "vendor",
+                                            NULL};
+
+int do_avb_init(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
+{
+       unsigned long mmc_dev;
+
+       if (argc != 2)
+               return CMD_RET_USAGE;
+
+       mmc_dev = simple_strtoul(argv[1], NULL, 16);
+
+       if (avb_ops)
+               avb_ops_free(avb_ops);
+
+       avb_ops = avb_ops_alloc(mmc_dev);
+       if (avb_ops)
+               return CMD_RET_SUCCESS;
+
+       return CMD_RET_FAILURE;
+}
+
+int do_avb_read_part(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
+{
+       const char *part;
+       s64 offset;
+       size_t bytes, bytes_read = 0;
+       void *buffer;
+
+       if (!avb_ops) {
+               printf("AVB 2.0 is not initialized, please run 'avb init'\n");
+               return CMD_RET_USAGE;
+       }
+
+       if (argc != 5)

cmd/avb.c line 63

Quoted 10 lines

cmd/avb.c new file +10 -0

+               return CMD_RET_USAGE;
+
+       part = argv[1];
+       offset = simple_strtoul(argv[2], NULL, 16);
+       bytes = simple_strtoul(argv[3], NULL, 16);
+       buffer = (void *)simple_strtoul(argv[4], NULL, 16);
+
+       if (avb_ops->read_from_partition(avb_ops, part, offset, bytes,
+                                        buffer, &bytes_read) ==
+                                        AVB_IO_RESULT_OK) {

Please can you make sure this uses driver model, and put wrappers for these function calls in the uclass?

Hi Igor,

Quoted 10 lines · Igor Opaniuk

Hi Simon,

I've dug into DriverModel documentation and even created a PoC for existing avb commands. The problem is that (maybe I missed out some key concepts) I'm still
not sure if it makes sense to follow it driver mode in the context of AVB 2.0 feature and
what kind of extra devices can be used within the same uclass in this case? Could you please explain in detail.
Thanks

avb_ops_alloc() is allocating a struct and then assigning operations to its members.

This is what driver model is designed to do. It handles the allocations and the operations become part of the uclass interface.

At present it looks like you only have one driver. I'm not sure if it would make sense to have a second one.

As a counter example see cros_ec uclass, which does things differently. It models the EC interface (I2C, SPI, LPC) using DM, with just a single impl on top.

Also can you please drop the CamelCase in the patches? We don't use that in U-Boot.

Quoted 141 lines

Hi Sam,
Thanks, will fix!

Quoted 135 lines · Simon Glass

Hi Igor,

Quoted 119 lines · Igor Opaniuk

Enable a "avb" command to execute Android Verified
Boot 2.0 operations. It includes such subcommands:
avb init - initialize avb2 subsystem
avb read_rb - read rollback index
avb write_rb - write rollback index
avb is_unlocked - check device lock state
avb get_uuid - read and print uuid of a partition
avb read_part - read data from partition
avb read_part_hex - read data from partition and output to stdout avb write_part - write data to partition
avb verify - run full verification chain

Signed-off-by Igor Opaniuk <[email protected]>

---
 cmd/Kconfig  |  15 +++
 cmd/Makefile |   3 +
 cmd/avb.c    | 351 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 369 insertions(+)
 create mode 100644 cmd/avb.c

cmd/Kconfig +15 -0

index bc1d2f3..96695ff 100644
@@ -1675,6 +1675,21 @@ config CMD_TRACE
          for analsys (e.g. using bootchart). See doc/README.trace for full
          details.
 
+config CMD_AVB
+       bool "avb - Android Verified Boot 2.0 operations"
+       depends on LIBAVB_AB
+       help
+         Enables a "avb" command to perform verification of partitions using
+         Android Verified Boot 2.0 functionality. It includes such subcommands:
+           avb init - initialize avb2 subsystem
+           avb read_rb - read rollback index
+           avb write_rb - write rollback index
+           avb is_unlocked - check device lock state
+           avb get_uuid - read and print uuid of a partition
+           avb read_part - read data from partition
+           avb read_part_hex - read data from partition and output to stdout
+           avb write_part - write data to partition
+           avb verify - run full verification chain
 endmenu
 
 config CMD_UBI

cmd/Makefile +3 -0

index c4269ac..bbf6c2a 100644
@@ -151,6 +151,9 @@ obj-$(CONFIG_CMD_REGULATOR) += regulator.o
 
 obj-$(CONFIG_CMD_BLOB) += blob.o
 
+# Android Verified Boot 2.0
+obj-$(CONFIG_CMD_AVB) += avb.o
+
 obj-$(CONFIG_X86) += x86/
 endif # !CONFIG_SPL_BUILD
 

cmd/avb.c new file +53 -0

new file mode 100644
index 0000000..d040906
@@ -0,0 +1,351 @@
+
+/*
+ * (C) Copyright 2018, Linaro Limited
+ *
+ * SPDX-License-Identifier:    GPL-2.0+
+ */
+
+#include <avb_verify.h>
+#include <command.h>
+#include <image.h>
+#include <malloc.h>
+#include <mmc.h>
+
+#define AVB_BOOTARGS   "avb_bootargs"
+static struct AvbOps *avb_ops;
+
+static const char * const requested_partitions[] = {"boot",
+                                            "system",
+                                            "vendor",
+                                            NULL};
+
+int do_avb_init(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
+{
+       unsigned long mmc_dev;
+
+       if (argc != 2)
+               return CMD_RET_USAGE;
+
+       mmc_dev = simple_strtoul(argv[1], NULL, 16);
+
+       if (avb_ops)
+               avb_ops_free(avb_ops);
+
+       avb_ops = avb_ops_alloc(mmc_dev);
+       if (avb_ops)
+               return CMD_RET_SUCCESS;
+
+       return CMD_RET_FAILURE;
+}
+
+int do_avb_read_part(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
+{
+       const char *part;
+       s64 offset;
+       size_t bytes, bytes_read = 0;
+       void *buffer;
+
+       if (!avb_ops) {
+               printf("AVB 2.0 is not initialized, please run 'avb init'\n");
+               return CMD_RET_USAGE;
+       }
+
+       if (argc != 5)

cmd/avb.c line 63

Quoted 10 lines

cmd/avb.c new file +10 -0

+               return CMD_RET_USAGE;
+
+       part = argv[1];
+       offset = simple_strtoul(argv[2], NULL, 16);
+       bytes = simple_strtoul(argv[3], NULL, 16);
+       buffer = (void *)simple_strtoul(argv[4], NULL, 16);
+
+       if (avb_ops->read_from_partition(avb_ops, part, offset, bytes,
+                                        buffer, &bytes_read) ==
+                                        AVB_IO_RESULT_OK) {

Please can you make sure this uses driver model, and put wrappers for these function calls in the uclass?

Regards,
Simon

Quoted 20 lines · Simon Glass

Hi Igor,

Quoted 10 lines · Igor Opaniuk

Hi Simon,

I've dug into DriverModel documentation and even created a PoC for existing avb commands. The problem is that (maybe I missed out some key concepts) I'm still
not sure if it makes sense to follow it driver mode in the context of AVB 2.0 feature and
what kind of extra devices can be used within the same uclass in this case? Could you please explain in detail.
Thanks

avb_ops_alloc() is allocating a struct and then assigning operations to its members.

This is what driver model is designed to do. It handles the allocations and the operations become part of the uclass interface.

Quoted 6 lines

At present it looks like you only have one driver. I'm not sure if it would make sense to have a second one.

As a counter example see cros_ec uclass, which does things differently. It models the EC interface (I2C, SPI, LPC) using DM, with just a single impl on top.

Right, I do understand what DriverModel is and why it should be used in the case of real-device drivers. But regarding Android Verified Boot 2.0 feature, which introduces verification capabilities and leverages only device-independent APIs,
I see no reason why it should be used here.
Could you please check [1] and confirm that this set of commands should really follow this model.

Quoted 3 lines

Also can you please drop the CamelCase in the patches? We don't use that in U-Boot.

Frankly, I don't like it also, bit all CamelCase instances in the code relate to libavb/libavb_ab library ([2]), which is planned to be deviated from AOSP upstream in the future.
That's why a decision was made to not introduce any changes to simplify this process, as Google intensively introduces new changes to it.

(I've left a notice in the cover letter that checkpatch
will fail on the commit, which introduces libavb; also, there is the ongoing discussion there regarding why libavb/libavb_ab should be
kept as it's. Please join us, if you don't mind).

Thanks!

Best regards,
Igor

[1] https://android.googlesource.com/platform/external/avb/+/master/README.md
[2] https://android.googlesource.com/platform/external/avb/

Quoted 1 line

Quoted 1 line

If there is no need for operations and indirection through function pointers, why not just call the functions directly?

Quoted 4 lines

(I've left a notice in the cover letter that checkpatch
will fail on the commit, which introduces libavb; also, there is the ongoing discussion there regarding why libavb/libavb_ab should be
kept as it's. Please join us, if you don't mind).

I do see the cover letter thread but could not find the camel case discussion. Can you please point me to it?

(Tom can you please comment on the CamelCase question?)

Hi Igor,

Quoted 28 lines · Igor Opaniuk

Quoted 20 lines · Simon Glass

Hi Igor,

Quoted 10 lines · Igor Opaniuk

Hi Simon,

I've dug into DriverModel documentation and even created a PoC for existing avb commands. The problem is that (maybe I missed out some key concepts) I'm still
not sure if it makes sense to follow it driver mode in the context of AVB 2.0 feature and
what kind of extra devices can be used within the same uclass in this case? Could you please explain in detail.
Thanks

avb_ops_alloc() is allocating a struct and then assigning operations to its members.

This is what driver model is designed to do. It handles the allocations and the operations become part of the uclass interface.

Quoted 6 lines

At present it looks like you only have one driver. I'm not sure if it would make sense to have a second one.

As a counter example see cros_ec uclass, which does things differently. It models the EC interface (I2C, SPI, LPC) using DM, with just a single impl on top.

Quoted 7 lines

Right, I do understand what DriverModel is and why it should be used in the case of real-device drivers. But regarding Android Verified Boot 2.0 feature, which introduces verification capabilities and leverages only device-independent APIs,
I see no reason why it should be used here.
Could you please check [1] and confirm that this set of commands should really follow this model.

If there is no need for operations and indirection through function pointers, why not just call the functions directly?

I do think (as the code is currently structured) that DM makes sense, even though I understand that you are not creating a device. Perhaps Tom might have thoughts on this though?

Quoted 9 lines

Quoted 3 lines

Also can you please drop the CamelCase in the patches? We don't use that in U-Boot.

Frankly, I don't like it also, bit all CamelCase instances in the code relate to libavb/libavb_ab library ([2]), which is planned to be deviated from AOSP upstream in the future.
That's why a decision was made to not introduce any changes to simplify this process, as Google intensively introduces new changes to it.

Tom, what do you think? It's not how things usually work, but perhaps there is precedent for this?

Quoted 4 lines

(I've left a notice in the cover letter that checkpatch
will fail on the commit, which introduces libavb; also, there is the ongoing discussion there regarding why libavb/libavb_ab should be
kept as it's. Please join us, if you don't mind).

I do see the cover letter thread but could not find the camel case discussion. Can you please point me to it?

Quoted 9 lines

Thanks!

Best regards,
Igor

[1] https://android.googlesource.com/platform/external/avb/+/master/README.md
[2] https://android.googlesource.com/platform/external/avb/

Quoted 1 line

Quoted 1 line

[..]

Regards,
Simon

Hi Simon,

Quoted 2 lines

If there is no need for operations and indirection through function pointers, why not just call the functions directly?

This is the way how libavb is integrated into bootloader. libavb interfaces with the bootloader through the supplied AvbOps struct. This includes operations to read and write data from partitions, read and write rollback indexes, check if the public key used to make a signature should be accepted, and so on. This is what Google AVB 2.0 specification says.
For additional details please check [1].

In this particular patch, all avb commands, except the main "avb verify", are used
to debug these particular callback implementations
(can be used when enabling this feature on new platform etc.). The reason I use indirection through function pointers is that they are not supposed
to be public, and are not intended to be used somehow directly, only by libavb (check [2] how libavb is using it)

Quoted 7 lines

Quoted 4 lines

(I've left a notice in the cover letter that checkpatch
will fail on the commit, which introduces libavb; also, there is the ongoing discussion there regarding why libavb/libavb_ab should be
kept as it's. Please join us, if you don't mind).

I do see the cover letter thread but could not find the camel case discussion. Can you please point me to it?

There is no any particular discussion about CamelCase, but a few general statements why I should avoid introducing any changes in libavb/libavb_ab libraries.
Regarding our particular case, AvbSlotVerifyResult and AvbSlotVerifyData types (I guess you're talking about these CamelCase instances) are defined inside libavb library, so obviously I can't simply replace it with something, that conforms to the Linux kernel coding style

1. Add initial support of boot states mode (red, green, yellow)
2. Add functions for enforcing dm-verity configurations

Signed-off-by Igor Opaniuk <[email protected]>

---
 cmd/avb.c            |  17 ++++++-
 common/avb_verify.c  | 140 +++++++++++++++++++++++++++++++++++++++++++++++++--
 include/avb_verify.h |  19 ++++++-
 3 files changed, 171 insertions(+), 5 deletions(-)

cmd/avb.c +16 -1

index d040906..2c15b47 100644
@@ -218,6 +218,8 @@ int do_avb_verify_part(cmd_tbl_t *cmdtp, int flag,
 {
        AvbSlotVerifyResult slot_result;
        AvbSlotVerifyData *out_data;
+       char *cmdline;
+       char *extra_args;
 
        bool unlocked = false;
        int res = CMD_RET_FAILURE;

@@ -243,10 +245,23 @@ int do_avb_verify_part(cmd_tbl_t *cmdtp, int flag,
                                      "", unlocked, &out_data);
        switch (slot_result) {
        case AVB_SLOT_VERIFY_RESULT_OK:
+               /* Until we don't have support of changing unlock states, we
+                * assume that we are by default in locked state.
+                * So in this case we can boot only when verification is
+                * successful; we also supply in cmdline GREEN boot state
+                */
                printf("Verification passed successfully\n");
 
                /* export additional bootargs to AVB_BOOTARGS env var */
-               env_set(AVB_BOOTARGS, out_data->cmdline);
+
+               extra_args = avb_set_state(avb_ops, AVB_GREEN);
+               if (extra_args)
+                       cmdline = append_cmd_line(out_data->cmdline,
+                                                 extra_args);
+               else
+                       cmdline = out_data->cmdline;
+
+               env_set(AVB_BOOTARGS, cmdline);
 
                res = CMD_RET_SUCCESS;
                break;

common/avb_verify.c +48 -0

index b3d1229..df5e407 100644
@@ -119,6 +119,140 @@ const unsigned char avb_root_pub[1032] = {
 
 /**
  * ============================================================================
+ * Boot states support (GREEN, YELLOW, ORANGE, RED) and dm_verity
+ * ============================================================================
+ */
+char *avb_set_state(AvbOps *ops, enum avb_boot_state boot_state)
+{
+       struct AvbOpsData *data;
+       char *cmdline = NULL;
+
+       if (!ops)
+               return NULL;
+
+       data = (struct AvbOpsData *)ops->user_data;
+       if (!data)
+               return NULL;
+
+       data->boot_state = boot_state;
+       switch (boot_state) {
+       case AVB_GREEN:
+               cmdline = "androidboot.verifiedbootstate=green";
+               break;
+       case AVB_YELLOW:
+               cmdline = "androidboot.verifiedbootstate=yellow";
+               break;
+       case AVB_ORANGE:
+               cmdline = "androidboot.verifiedbootstate=orange";
+       case AVB_RED:
+               break;
+       }
+
+       return cmdline;
+}
+
+char *append_cmd_line(char *cmdline_orig, char *cmdline_new)
+{
+       char *cmd_line;
+
+       if (!cmdline_new)
+               return cmdline_orig;
+
+       if (cmdline_orig)
+               cmd_line = cmdline_orig;
+       else
+               cmd_line = " ";
+
+       cmd_line = avb_strdupv(cmd_line, " ", cmdline_new, NULL);
+
+       return cmd_line;
+}

common/avb_verify.c +71 -3

+
+static char *avb_set_enforce_option(const char *cmdline, const char *option)
+{
+       char *cmdarg[AVB_MAX_ARGS];
+       char *newargs = NULL;
+       int i = 0;
+       int total_args;
+
+       memset(cmdarg, 0, sizeof(cmdarg));
+       cmdarg[i++] = strtok((char *)cmdline, " ");
+
+       do {
+               cmdarg[i] = strtok(NULL, " ");
+               if (!cmdarg[i])
+                       break;
+
+               if (++i >= AVB_MAX_ARGS) {
+                       printf("%s: Can't handle more then %d args\n",
+                              __func__, i);
+                       return NULL;
+               }
+       } while (true);
+
+       total_args = i;
+       i = avb_find_dm_args(&cmdarg[0], VERITY_TABLE_OPT_LOGGING);
+       if (i >= 0) {
+               cmdarg[i] = (char *)option;
+       } else {
+               i = avb_find_dm_args(&cmdarg[0], VERITY_TABLE_OPT_RESTART);
+               if (i < 0) {
+                       printf("%s: No verity options found\n", __func__);
+                       return NULL;
+               }
+
+               cmdarg[i] = (char *)option;
+       }
+
+       for (i = 0; i <= total_args; i++)
+               newargs = append_cmd_line(newargs, cmdarg[i]);
+
+       return newargs;
+}
+
+char *avb_set_ignore_corruption(const char *cmdline)
+{
+       char *newargs = NULL;
+
+       newargs = avb_set_enforce_option(cmdline, VERITY_TABLE_OPT_LOGGING);
+       if (newargs)
+               newargs = append_cmd_line(newargs,
+                                         "androidboot.veritymode=eio");
+
+       return newargs;
+}
+
+char *avb_set_enforce_verity(const char *cmdline)
+{
+       char *newargs;
+
+       newargs = avb_set_enforce_option(cmdline, VERITY_TABLE_OPT_RESTART);
+       if (newargs)
+               newargs = append_cmd_line(newargs,
+                                         "androidboot.veritymode=enforcing");
+       return newargs;
+}
+
+/**
+ * ============================================================================
  * IO(mmc) auxiliary functions
  * ============================================================================
  */

@@ -478,7 +612,7 @@ static AvbIOResult read_rollback_index(AvbOps *ops,
                                       u64 *out_rollback_index)
 {
        /* For now we always return 0 as the stored rollback index. */
-       printf("TODO: implement %s.\n", __func__);
+       printf("%s not supported yet\n", __func__);
 
        if (out_rollback_index)
                *out_rollback_index = 0;

@@ -502,7 +636,7 @@ static AvbIOResult write_rollback_index(AvbOps *ops,
                                        u64 rollback_index)
 {
        /* For now this is a no-op. */
-       printf("TODO: implement %s.\n", __func__);
+       printf("%s not supported yet\n", __func__);
 
        return AVB_IO_RESULT_OK;
 }

@@ -522,7 +656,7 @@ static AvbIOResult read_is_device_unlocked(AvbOps *ops, bool *out_is_unlocked)
 {
        /* For now we always return that the device is unlocked. */
 
-       printf("TODO: implement %s.\n", __func__);
+       printf("%s not supported yet\n", __func__);
 
        *out_is_unlocked = true;
 

include/avb_verify.h +18 -2

index fb7ab23..9363ca5 100644
@@ -11,12 +11,23 @@
 #include <avb/libavb_ab.h>
 #include <mmc.h>
 
-#define ALLOWED_BUF_ALIGN      8
+#define AVB_MAX_ARGS                   1024
+#define VERITY_TABLE_OPT_RESTART       "restart_on_corruption"
+#define VERITY_TABLE_OPT_LOGGING       "ignore_corruption"
+#define ALLOWED_BUF_ALIGN              8
+
+enum avb_boot_state {
+       AVB_GREEN,
+       AVB_YELLOW,
+       AVB_ORANGE,
+       AVB_RED,
+};
 
 struct AvbOpsData {
        struct AvbOps ops;
        struct AvbABOps ab_ops;
        int mmc_dev;
+       enum avb_boot_state boot_state;
 };
 
 struct mmc_part {

@@ -34,6 +45,12 @@ enum mmc_io_type {
 AvbOps *avb_ops_alloc(int boot_device);
 void avb_ops_free(AvbOps *ops);
 
+char *avb_set_state(AvbOps *ops, enum avb_boot_state boot_state);
+char *avb_set_enforce_verity(const char *cmdline);
+char *avb_set_ignore_corruption(const char *cmdline);
+
+char *append_cmd_line(char *cmdline_orig, char *cmdline_new);
+
 /**
  * ============================================================================
  * I/O helper inline functions
--

2.7.4

1. Add vbmeta partition info to android partition layout for am57xx SoC
2. Add support of AVB 2.0 (including avb subset of commands) for am57xx HS

Signed-off-by Igor Opaniuk <[email protected]>

---
 configs/am57xx_hs_evm_defconfig |  3 +++
 include/configs/am57xx_evm.h    | 11 +++++++++++
 include/environment/ti/boot.h   | 15 +++++++++++++++
 3 files changed, 29 insertions(+)

configs/am57xx_hs_evm_defconfig +0 -0

index ca9742f..226537a 100644

include/configs/am57xx_evm.h +10 -0

+#define VBMETA_PART_SIZE               (64 * 1024)
+
+#if defined(CONFIG_LIBAVB)
+#define VBMETA_PART \
+       "name=vbmeta,size=" str(VBMETA_PART_SIZE) ",uuid=${uuid_gpt_vbmeta};"
+#else
+#define VBMETA_PART                    ""
+#endif
+
 /* Define the default GPT table for eMMC */
 #define PARTS_DEFAULT \
        /* Linux partitions */ \

@@ -61,6 +71,7 @@
        "name=cache,size=256M,uuid=${uuid_gpt_cache};" \
        "name=ipu1,size=1M,uuid=${uuid_gpt_ipu1};" \
        "name=ipu2,size=1M,uuid=${uuid_gpt_ipu2};" \
+       VBMETA_PART \
        "name=userdata,size=-,uuid=${uuid_gpt_userdata}"
 
 #define DFUARGS \

include/environment/ti/boot.h +15 -1

index 24b7783..a8336ae 100644
@@ -18,6 +18,19 @@
 #define PARTS_DEFAULT
 #endif
 
+#if defined(CONFIG_CMD_AVB)
+#define AVB_VERIFY_CHECK "if run avb_verify; then " \
+                               "echo AVB verification OK.;" \
+                               "set bootargs $bootargs $avb_bootargs;" \
+                       "else " \
+                               "echo AVB verification failed.;" \
+                       "exit; fi;"
+#define AVB_VERIFY_CMD "avb_verify=avb init 1; avb verify;\0"
+#else
+#define AVB_VERIFY_CHECK ""
+#define AVB_VERIFY_CMD ""
+#endif
+
 #define DEFAULT_COMMON_BOOT_TI_ARGS \
        "console=" CONSOLEDEV ",115200n8\0" \
        "fdtfile=undefined\0" \

@@ -26,6 +39,7 @@
        "bootfile=zImage\0" \
        "usbtty=cdc_acm\0" \
        "vram=16M\0" \
+       AVB_VERIFY_CMD \
        "partitions=" PARTS_DEFAULT "\0" \
        "optargs=\0" \
        "dofastboot=0\0" \

@@ -43,6 +57,7 @@
                "setenv machid fe6; " \
                "mmc dev $mmcdev; " \
                "mmc rescan; " \
+               AVB_VERIFY_CHECK \
                "part start mmc ${mmcdev} environment fdt_start; " \
                "part size mmc ${mmcdev} environment fdt_size; " \
                "part start mmc ${mmcdev} boot boot_start; " \
--

2.7.4

Contains:
1. Overview of Android Verified Boot 2.0
2. Description of avb subset of commands
3. Examples of errors when boot/vendor/system/vbmeta partitions are tampered
4. Examples of enabling AVB2.0 on your setup

Signed-off-by Igor Opaniuk <[email protected]>

---
 doc/README.avb2 | 100 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 100 insertions(+)
 create mode 100644 doc/README.avb2

doc/README.avb2 new file +90 -0

new file mode 100644
index 0000000..40db7c5
@@ -0,0 +1,100 @@
+Android Verified Boot 2.0
+
+This file contains information about the current support of Android Verified
+Boot 2.0 in U-boot
+
+1. OVERVIEW
+---------------------------------
+Verified Boot establishes a chain of trust from the bootloader to system images
+* Provides integrity checking for:
+  - Android Boot image: Linux kernel + ramdisk. RAW hashing of the whole
+    partition is done and the hash is compared with the one stored in
+    the VBMeta image
+  - system/vendor partitions: verifying root hash of dm-verity hashtrees.
+* Provides capabilities for rollback protection.
+
+Integrity of the bootloader (U-boot BLOB and environment) is out of scope.
+
+For additional details check:
+https://android.googlesource.com/platform/external/avb/+/master/README.md
+
+
+2. AVB 2.0 U-BOOT SHELL COMMANDS
+-----------------------------------
+Provides CLI interface to invoke AVB 2.0 verification + misc. commands for
+different testing purposes:
+
+avb init <dev> - initialize avb 2.0 for <dev>
+avb verify - run verification process using hash data from vbmeta structure
+avb read_rb <num> - read rollback index at location <num>
+avb write_rb <num> <rb> - write rollback index <rb> to <num>
+avb is_unlocked - returns unlock status of the device
+avb get_uuid <partname> - read and print uuid of partition <partname>
+avb read_part <partname> <offset> <num> <addr> - read <num> bytes from
+partition <partname> to buffer <addr>
+avb write_part <partname> <offset> <num> <addr> - write <num> bytes to
+<partname> by <offset> using data from <addr>
+
+
+3. PARTITIONS TAMPERING (EXAMPLE)
+-----------------------------------
+Boot or system/vendor (dm-verity metadata section) is tampered:
+=> avb init 1
+=> avb verify
+avb_slot_verify.c:175: ERROR: boot: Hash of data does not match digest in
+descriptor.
+Slot verification result: ERROR_IO
+
+Vbmeta partition is tampered:
+=> avb init 1
+=> avb verify
+avb_vbmeta_image.c:206: ERROR: Hash does not match!
+avb_slot_verify.c:388: ERROR: vbmeta: Error verifying vbmeta image:
+HASH_MISMATCH
+Slot verification result: ERROR_IO
+
+
+4. ENABLE ON YOUR BOARD
+-----------------------------------
+The following options must be enabled:
+CONFIG_LIBAVB=y
+CONFIG_LIBAVB_AB=y
+CONFIG_CMD_AVB=y
+
+
+Then add `avb verify` invocation to your android boot sequence of commands,
+e.g.:
+
+=> avb_verify=avb init $mmcdev; avb verify;
+=> if run avb_verify; then                       \
+        echo AVB verification OK. Continue boot; \
+        set bootargs $bootargs $avb_bootargs;    \
+   else                                          \
+        echo AVB verification failed;            \
+        exit;                                    \
+   fi;                                           \
+
+=> emmc_android_boot=                                   \
+       echo Trying to boot Android from eMMC ...;       \
+       ...                                              \
+       run avb_verify;                                  \
+       mmc read ${fdtaddr} ${fdt_start} ${fdt_size};    \
+       mmc read ${loadaddr} ${boot_start} ${boot_size}; \
+       bootm $loadaddr $loadaddr $fdtaddr;              \
+
+
+To switch on automatic generation of vbmeta partition in AOSP build, add these
+lines to device configuration mk file:
+
+BOARD_AVB_ENABLE := true
+BOARD_AVB_ALGORITHM := SHA512_RSA4096

--
2.7.4

Quoted 109 lines · Igor Opaniuk

Contains:
1. Overview of Android Verified Boot 2.0
2. Description of avb subset of commands
3. Examples of errors when boot/vendor/system/vbmeta partitions are tampered
4. Examples of enabling AVB2.0 on your setup

Signed-off-by Igor Opaniuk <[email protected]>

---
 doc/README.avb2 | 100 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 100 insertions(+)
 create mode 100644 doc/README.avb2

doc/README.avb2 new file +90 -0

new file mode 100644
index 0000000..40db7c5
@@ -0,0 +1,100 @@
+Android Verified Boot 2.0
+
+This file contains information about the current support of Android Verified
+Boot 2.0 in U-boot
+
+1. OVERVIEW
+---------------------------------
+Verified Boot establishes a chain of trust from the bootloader to system images
+* Provides integrity checking for:
+  - Android Boot image: Linux kernel + ramdisk. RAW hashing of the whole
+    partition is done and the hash is compared with the one stored in
+    the VBMeta image
+  - system/vendor partitions: verifying root hash of dm-verity hashtrees.
+* Provides capabilities for rollback protection.
+
+Integrity of the bootloader (U-boot BLOB and environment) is out of scope.
+
+For additional details check:
+https://android.googlesource.com/platform/external/avb/+/master/README.md
+
+
+2. AVB 2.0 U-BOOT SHELL COMMANDS
+-----------------------------------
+Provides CLI interface to invoke AVB 2.0 verification + misc. commands for
+different testing purposes:
+
+avb init <dev> - initialize avb 2.0 for <dev>
+avb verify - run verification process using hash data from vbmeta structure
+avb read_rb <num> - read rollback index at location <num>
+avb write_rb <num> <rb> - write rollback index <rb> to <num>
+avb is_unlocked - returns unlock status of the device
+avb get_uuid <partname> - read and print uuid of partition <partname>
+avb read_part <partname> <offset> <num> <addr> - read <num> bytes from
+partition <partname> to buffer <addr>
+avb write_part <partname> <offset> <num> <addr> - write <num> bytes to
+<partname> by <offset> using data from <addr>
+
+
+3. PARTITIONS TAMPERING (EXAMPLE)
+-----------------------------------
+Boot or system/vendor (dm-verity metadata section) is tampered:
+=> avb init 1
+=> avb verify
+avb_slot_verify.c:175: ERROR: boot: Hash of data does not match digest in
+descriptor.
+Slot verification result: ERROR_IO
+
+Vbmeta partition is tampered:
+=> avb init 1
+=> avb verify
+avb_vbmeta_image.c:206: ERROR: Hash does not match!
+avb_slot_verify.c:388: ERROR: vbmeta: Error verifying vbmeta image:
+HASH_MISMATCH
+Slot verification result: ERROR_IO
+
+
+4. ENABLE ON YOUR BOARD
+-----------------------------------
+The following options must be enabled:
+CONFIG_LIBAVB=y
+CONFIG_LIBAVB_AB=y
+CONFIG_CMD_AVB=y
+
+
+Then add `avb verify` invocation to your android boot sequence of commands,
+e.g.:
+
+=> avb_verify=avb init $mmcdev; avb verify;
+=> if run avb_verify; then                       \
+        echo AVB verification OK. Continue boot; \
+        set bootargs $bootargs $avb_bootargs;    \
+   else                                          \
+        echo AVB verification failed;            \
+        exit;                                    \
+   fi;                                           \
+
+=> emmc_android_boot=                                   \
+       echo Trying to boot Android from eMMC ...;       \
+       ...                                              \
+       run avb_verify;                                  \
+       mmc read ${fdtaddr} ${fdt_start} ${fdt_size};    \
+       mmc read ${loadaddr} ${boot_start} ${boot_size}; \
+       bootm $loadaddr $loadaddr $fdtaddr;              \
+
+
+To switch on automatic generation of vbmeta partition in AOSP build, add these
+lines to device configuration mk file:
+
+BOARD_AVB_ENABLE := true
+BOARD_AVB_ALGORITHM := SHA512_RSA4096

doc/README.avb2 line 100

Quoted 10 lines

doc/README.avb2 new file +10 -0

+BOARD_BOOTIMAGE_PARTITION_SIZE := <boot partition size>
+
+After flashing U-boot don't forget to update environment and write new
+partition table:
+=> env default -f -a
+=> setenv partitions $partitions_android
+=> env save
+=> fas 1
+
+$ fastboot oem format

FYI, those commands can be shrank down to a single command:

=> gpt write mmc 1 $partitions_android

because that's exactly what "fastboot oem format" is doing. This way you can avoid using fastboot, and thus having it as a dependency. But your way is better w.r.t. user experience (i.e. if environment is already set, user can just run host command, and avoid tinkering with U-Boot shell at all). Please choose which one is better depending on targeting use-case.

Quoted 3 lines

--
2.7.4

This series of patches introduces support of Android Verified Boot 2.0, which provides integrity checking of Android partitions on MMC.

It integrates libavb/libavb_ab into the U-boot, provides implementation of AvbOps, subset of avb commands to run verification chain (and for debugging purposes), and it enables AVB2.0 verification on AM57xx HS SoC by default.

Currently, there is still no support for verification of A/B boot slots and no rollback protection (for storing rollback indexes there are plans to use eMMC RPMB)

Libavb/libavb_ab will be deviated from AOSP upstream in the future, that's why minimal amount of changes were introduced into the lib sources, so checkpatch may fail.

For additional details check [1] AVB 2.0 README and doc/README.avb2, which is a part of this patchset.

[1] https://android.googlesource.com/platform/external/avb/+/master/README.md

Igor Opaniuk (8):
avb2.0: add Android Verified Boot 2.0 libraries avb2.0: integrate avb 2.0 into the build system avb2.0: implement AVB ops
cmd: avb2.0: avb command for performing verification avb2.0: add boot states and dm-verity support
am57xx_hs: avb2.0: add support of AVB 2.0 test/py: avb2.0: add tests for avb commands
doc: avb2.0: add README about AVB2.0 integration

 cmd/Kconfig                                  |   15 +
 cmd/Makefile                                 |    3 +
 cmd/avb.c                                    |  366 ++++++++
 common/Makefile                              |    2 +
 common/avb_verify.c                          |  748 ++++++++++++++++
 configs/am57xx_hs_evm_defconfig              |    3 +
 doc/README.avb2                              |  100 +++
 include/avb/avb_ab_flow.h                    |  235 ++++++
 include/avb/avb_ab_ops.h                     |   61 ++
 include/avb/avb_chain_partition_descriptor.h |   54 ++
 include/avb/avb_crypto.h                     |  147 ++++
 include/avb/avb_descriptor.h                 |  113 +++
 include/avb/avb_footer.h                     |   68 ++
 include/avb/avb_hash_descriptor.h            |   55 ++
 include/avb/avb_hashtree_descriptor.h        |   65 ++
 include/avb/avb_kernel_cmdline_descriptor.h  |   63 ++
 include/avb/avb_ops.h                        |  196 +++++
 include/avb/avb_property_descriptor.h        |   89 ++
 include/avb/avb_rsa.h                        |   55 ++
 include/avb/avb_sha.h                        |   72 ++
 include/avb/avb_slot_verify.h                |  239 ++++++
 include/avb/avb_sysdeps.h                    |   97 +++
 include/avb/avb_util.h                       |  259 ++++++
 include/avb/avb_vbmeta_image.h               |  272 ++++++
 include/avb/avb_version.h                    |   45 +
 include/avb/libavb.h                         |   32 +
 include/avb/libavb_ab.h                      |   22 +
 include/avb_verify.h                         |   97 +++
 include/configs/am57xx_evm.h                 |   11 +
 include/environment/ti/boot.h                |   15 +
 lib/Kconfig                                  |   20 +
 lib/Makefile                                 |    2 +
 lib/libavb/Makefile                          |   15 +
 lib/libavb/avb_chain_partition_descriptor.c  |   46 +
 lib/libavb/avb_crypto.c                      |  355 ++++++++
 lib/libavb/avb_descriptor.c                  |  142 ++++
 lib/libavb/avb_footer.c                      |   36 +
 lib/libavb/avb_hash_descriptor.c             |   43 +
 lib/libavb/avb_hashtree_descriptor.c         |   51 ++
 lib/libavb/avb_kernel_cmdline_descriptor.c   |   40 +
 lib/libavb/avb_property_descriptor.c         |  167 ++++
 lib/libavb/avb_rsa.c                         |  277 ++++++
 lib/libavb/avb_sha256.c                      |  364 ++++++++
 lib/libavb/avb_sha512.c                      |  362 ++++++++
 lib/libavb/avb_slot_verify.c                 | 1169 ++++++++++++++++++++++++++
 lib/libavb/avb_sysdeps_posix.c               |   57 ++
 lib/libavb/avb_util.c                        |  385 +++++++++
 lib/libavb/avb_vbmeta_image.c                |  290 +++++++
 lib/libavb/avb_version.c                     |   16 +
 lib/libavb_ab/Makefile                       |    9 +
 lib/libavb_ab/avb_ab_flow.c                  |  502 +++++++++++
 test/py/tests/test_avb.py                    |  111 +++
 52 files changed, 8058 insertions(+)
 create mode 100644 cmd/avb.c
 create mode 100644 common/avb_verify.c
 create mode 100644 doc/README.avb2
 create mode 100644 include/avb/avb_ab_flow.h
 create mode 100644 include/avb/avb_ab_ops.h
 create mode 100644 include/avb/avb_chain_partition_descriptor.h
 create mode 100644 include/avb/avb_crypto.h
 create mode 100644 include/avb/avb_descriptor.h
 create mode 100644 include/avb/avb_footer.h
 create mode 100644 include/avb/avb_hash_descriptor.h
 create mode 100644 include/avb/avb_hashtree_descriptor.h
 create mode 100644 include/avb/avb_kernel_cmdline_descriptor.h
 create mode 100644 include/avb/avb_ops.h
 create mode 100644 include/avb/avb_property_descriptor.h
 create mode 100644 include/avb/avb_rsa.h
 create mode 100644 include/avb/avb_sha.h
 create mode 100644 include/avb/avb_slot_verify.h
 create mode 100644 include/avb/avb_sysdeps.h
 create mode 100644 include/avb/avb_util.h
 create mode 100644 include/avb/avb_vbmeta_image.h
 create mode 100644 include/avb/avb_version.h
 create mode 100644 include/avb/libavb.h
 create mode 100644 include/avb/libavb_ab.h
 create mode 100644 include/avb_verify.h
 create mode 100644 lib/libavb/Makefile
 create mode 100644 lib/libavb/avb_chain_partition_descriptor.c
 create mode 100644 lib/libavb/avb_crypto.c
 create mode 100644 lib/libavb/avb_descriptor.c
 create mode 100644 lib/libavb/avb_footer.c
 create mode 100644 lib/libavb/avb_hash_descriptor.c
 create mode 100644 lib/libavb/avb_hashtree_descriptor.c
 create mode 100644 lib/libavb/avb_kernel_cmdline_descriptor.c
 create mode 100644 lib/libavb/avb_property_descriptor.c
 create mode 100644 lib/libavb/avb_rsa.c
 create mode 100644 lib/libavb/avb_sha256.c
 create mode 100644 lib/libavb/avb_sha512.c
 create mode 100644 lib/libavb/avb_slot_verify.c
 create mode 100644 lib/libavb/avb_sysdeps_posix.c
 create mode 100644 lib/libavb/avb_util.c
 create mode 100644 lib/libavb/avb_vbmeta_image.c
 create mode 100644 lib/libavb/avb_version.c
 create mode 100644 lib/libavb_ab/Makefile
 create mode 100644 lib/libavb_ab/avb_ab_flow.c
 create mode 100644 test/py/tests/test_avb.py

Hi Igor,

It's great to see the patch set to support AVB2.0, the upstream
libavb(from aosp) combine the AVB with A/B which I think should be two separate feature, are you going to split them?

BTW, do you have plan to update boot_android cmd to support avb?
the command is too weak for use now.
And any plan to add opptee_client/smcc to talk to OPTEE/ATF?

Thanks,
- Kever

Quoted 128 lines · Igor Opaniuk

This series of patches introduces support of Android Verified Boot 2.0, which provides integrity checking of Android partitions on MMC.

It integrates libavb/libavb_ab into the U-boot, provides implementation of AvbOps, subset of avb commands to run verification chain (and for debugging purposes), and it enables AVB2.0 verification on AM57xx HS SoC by default.

Currently, there is still no support for verification of A/B boot slots and no rollback protection (for storing rollback indexes there are plans to use eMMC RPMB)

Libavb/libavb_ab will be deviated from AOSP upstream in the future, that's why minimal amount of changes were introduced into the lib sources, so checkpatch may fail.

For additional details check [1] AVB 2.0 README and doc/README.avb2, which is a part of this patchset.

[1] https://android.googlesource.com/platform/external/avb/+/master/README.md

Igor Opaniuk (8):
avb2.0: add Android Verified Boot 2.0 libraries avb2.0: integrate avb 2.0 into the build system avb2.0: implement AVB ops
cmd: avb2.0: avb command for performing verification avb2.0: add boot states and dm-verity support
am57xx_hs: avb2.0: add support of AVB 2.0 test/py: avb2.0: add tests for avb commands
doc: avb2.0: add README about AVB2.0 integration

 cmd/Kconfig                                  |   15 +
 cmd/Makefile                                 |    3 +
 cmd/avb.c                                    |  366 ++++++++
 common/Makefile                              |    2 +
 common/avb_verify.c                          |  748 ++++++++++++++++
 configs/am57xx_hs_evm_defconfig              |    3 +
 doc/README.avb2                              |  100 +++
 include/avb/avb_ab_flow.h                    |  235 ++++++
 include/avb/avb_ab_ops.h                     |   61 ++
 include/avb/avb_chain_partition_descriptor.h |   54 ++
 include/avb/avb_crypto.h                     |  147 ++++
 include/avb/avb_descriptor.h                 |  113 +++
 include/avb/avb_footer.h                     |   68 ++
 include/avb/avb_hash_descriptor.h            |   55 ++
 include/avb/avb_hashtree_descriptor.h        |   65 ++
 include/avb/avb_kernel_cmdline_descriptor.h  |   63 ++
 include/avb/avb_ops.h                        |  196 +++++
 include/avb/avb_property_descriptor.h        |   89 ++
 include/avb/avb_rsa.h                        |   55 ++
 include/avb/avb_sha.h                        |   72 ++
 include/avb/avb_slot_verify.h                |  239 ++++++
 include/avb/avb_sysdeps.h                    |   97 +++
 include/avb/avb_util.h                       |  259 ++++++
 include/avb/avb_vbmeta_image.h               |  272 ++++++
 include/avb/avb_version.h                    |   45 +
 include/avb/libavb.h                         |   32 +
 include/avb/libavb_ab.h                      |   22 +
 include/avb_verify.h                         |   97 +++
 include/configs/am57xx_evm.h                 |   11 +
 include/environment/ti/boot.h                |   15 +
 lib/Kconfig                                  |   20 +
 lib/Makefile                                 |    2 +
 lib/libavb/Makefile                          |   15 +
 lib/libavb/avb_chain_partition_descriptor.c  |   46 +
 lib/libavb/avb_crypto.c                      |  355 ++++++++
 lib/libavb/avb_descriptor.c                  |  142 ++++
 lib/libavb/avb_footer.c                      |   36 +
 lib/libavb/avb_hash_descriptor.c             |   43 +
 lib/libavb/avb_hashtree_descriptor.c         |   51 ++
 lib/libavb/avb_kernel_cmdline_descriptor.c   |   40 +
 lib/libavb/avb_property_descriptor.c         |  167 ++++
 lib/libavb/avb_rsa.c                         |  277 ++++++
 lib/libavb/avb_sha256.c                      |  364 ++++++++
 lib/libavb/avb_sha512.c                      |  362 ++++++++
 lib/libavb/avb_slot_verify.c                 | 1169 ++++++++++++++++++++++++++
 lib/libavb/avb_sysdeps_posix.c               |   57 ++
 lib/libavb/avb_util.c                        |  385 +++++++++
 lib/libavb/avb_vbmeta_image.c                |  290 +++++++
 lib/libavb/avb_version.c                     |   16 +
 lib/libavb_ab/Makefile                       |    9 +
 lib/libavb_ab/avb_ab_flow.c                  |  502 +++++++++++
 test/py/tests/test_avb.py                    |  111 +++
 52 files changed, 8058 insertions(+)
 create mode 100644 cmd/avb.c
 create mode 100644 common/avb_verify.c
 create mode 100644 doc/README.avb2
 create mode 100644 include/avb/avb_ab_flow.h
 create mode 100644 include/avb/avb_ab_ops.h
 create mode 100644 include/avb/avb_chain_partition_descriptor.h
 create mode 100644 include/avb/avb_crypto.h
 create mode 100644 include/avb/avb_descriptor.h
 create mode 100644 include/avb/avb_footer.h
 create mode 100644 include/avb/avb_hash_descriptor.h
 create mode 100644 include/avb/avb_hashtree_descriptor.h
 create mode 100644 include/avb/avb_kernel_cmdline_descriptor.h
 create mode 100644 include/avb/avb_ops.h
 create mode 100644 include/avb/avb_property_descriptor.h
 create mode 100644 include/avb/avb_rsa.h
 create mode 100644 include/avb/avb_sha.h
 create mode 100644 include/avb/avb_slot_verify.h
 create mode 100644 include/avb/avb_sysdeps.h
 create mode 100644 include/avb/avb_util.h
 create mode 100644 include/avb/avb_vbmeta_image.h
 create mode 100644 include/avb/avb_version.h
 create mode 100644 include/avb/libavb.h
 create mode 100644 include/avb/libavb_ab.h
 create mode 100644 include/avb_verify.h
 create mode 100644 lib/libavb/Makefile
 create mode 100644 lib/libavb/avb_chain_partition_descriptor.c
 create mode 100644 lib/libavb/avb_crypto.c
 create mode 100644 lib/libavb/avb_descriptor.c
 create mode 100644 lib/libavb/avb_footer.c
 create mode 100644 lib/libavb/avb_hash_descriptor.c
 create mode 100644 lib/libavb/avb_hashtree_descriptor.c
 create mode 100644 lib/libavb/avb_kernel_cmdline_descriptor.c
 create mode 100644 lib/libavb/avb_property_descriptor.c
 create mode 100644 lib/libavb/avb_rsa.c
 create mode 100644 lib/libavb/avb_sha256.c
 create mode 100644 lib/libavb/avb_sha512.c
 create mode 100644 lib/libavb/avb_slot_verify.c
 create mode 100644 lib/libavb/avb_sysdeps_posix.c
 create mode 100644 lib/libavb/avb_util.c
 create mode 100644 lib/libavb/avb_vbmeta_image.c
 create mode 100644 lib/libavb/avb_version.c
 create mode 100644 lib/libavb_ab/Makefile
 create mode 100644 lib/libavb_ab/avb_ab_flow.c
 create mode 100644 test/py/tests/test_avb.py

Hi Igor,

It's great to see the patch set to support AVB2.0, the upstream
libavb(from aosp) combine the AVB with A/B which I think should be two separate feature, are you going to split them?

BTW, do you have plan to update boot_android cmd to support avb?
the command is too weak for use now.
And any plan to add opptee_client/smcc to talk to OPTEE/ATF?

Thanks,
- Kever

Quoted 4 lines · Igor Opaniuk

This series of patches introduces support of Android Verified Boot 2.0, which provides integrity checking of Android partitions on MMC.

It integrates libavb/libavb_ab into the U-boot, provides implementation

of

Quoted 1 line

AvbOps, subset of avb commands to run verification chain (and for

debugging

Quoted 1 line

purposes), and it enables AVB2.0 verification on AM57xx HS SoC by

default.

Quoted 7 lines

Currently, there is still no support for verification of A/B boot slots and no rollback protection (for storing rollback indexes there are plans to use eMMC RPMB)

Libavb/libavb_ab will be deviated from AOSP upstream in the future, that's why minimal amount of changes were introduced into the lib

sources,

Quoted 3 lines

so checkpatch may fail.

For additional details check [1] AVB 2.0 README and doc/README.avb2,

which

Quoted 3 lines

is a part of this patchset.

[1]

https://android.googlesource.com/platform/external/avb/+/master/README.md

Quoted 48 lines

Igor Opaniuk (8):
avb2.0: add Android Verified Boot 2.0 libraries avb2.0: integrate avb 2.0 into the build system avb2.0: implement AVB ops
cmd: avb2.0: avb command for performing verification avb2.0: add boot states and dm-verity support
am57xx_hs: avb2.0: add support of AVB 2.0 test/py: avb2.0: add tests for avb commands
doc: avb2.0: add README about AVB2.0 integration

 cmd/Kconfig                                  |   15 +
 cmd/Makefile                                 |    3 +
 cmd/avb.c                                    |  366 ++++++++
 common/Makefile                              |    2 +
 common/avb_verify.c                          |  748 ++++++++++++++++
 configs/am57xx_hs_evm_defconfig              |    3 +
 doc/README.avb2                              |  100 +++
 include/avb/avb_ab_flow.h                    |  235 ++++++
 include/avb/avb_ab_ops.h                     |   61 ++
 include/avb/avb_chain_partition_descriptor.h |   54 ++
 include/avb/avb_crypto.h                     |  147 ++++
 include/avb/avb_descriptor.h                 |  113 +++
 include/avb/avb_footer.h                     |   68 ++
 include/avb/avb_hash_descriptor.h            |   55 ++
 include/avb/avb_hashtree_descriptor.h        |   65 ++
 include/avb/avb_kernel_cmdline_descriptor.h  |   63 ++
 include/avb/avb_ops.h                        |  196 +++++
 include/avb/avb_property_descriptor.h        |   89 ++
 include/avb/avb_rsa.h                        |   55 ++
 include/avb/avb_sha.h                        |   72 ++
 include/avb/avb_slot_verify.h                |  239 ++++++
 include/avb/avb_sysdeps.h                    |   97 +++
 include/avb/avb_util.h                       |  259 ++++++
 include/avb/avb_vbmeta_image.h               |  272 ++++++
 include/avb/avb_version.h                    |   45 +
 include/avb/libavb.h                         |   32 +
 include/avb/libavb_ab.h                      |   22 +
 include/avb_verify.h                         |   97 +++
 include/configs/am57xx_evm.h                 |   11 +
 include/environment/ti/boot.h                |   15 +
 lib/Kconfig                                  |   20 +
 lib/Makefile                                 |    2 +
 lib/libavb/Makefile                          |   15 +
 lib/libavb/avb_chain_partition_descriptor.c  |   46 +
 lib/libavb/avb_crypto.c                      |  355 ++++++++
 lib/libavb/avb_descriptor.c                  |  142 ++++
 lib/libavb/avb_footer.c                      |   36 +

Quoted 8 lines

 lib/libavb/avb_hash_descriptor.c             |   43 +
 lib/libavb/avb_hashtree_descriptor.c         |   51 ++
 lib/libavb/avb_kernel_cmdline_descriptor.c   |   40 +
 lib/libavb/avb_property_descriptor.c         |  167 ++++
 lib/libavb/avb_rsa.c                         |  277 ++++++
 lib/libavb/avb_sha256.c                      |  364 ++++++++
 lib/libavb/avb_sha512.c                      |  362 ++++++++
 lib/libavb/avb_slot_verify.c                 | 1169

++++++++++++++++++++++++++

Quoted 44 lines

 lib/libavb/avb_sysdeps_posix.c               |   57 ++
 lib/libavb/avb_util.c                        |  385 +++++++++
 lib/libavb/avb_vbmeta_image.c                |  290 +++++++
 lib/libavb/avb_version.c                     |   16 +
 lib/libavb_ab/Makefile                       |    9 +
 lib/libavb_ab/avb_ab_flow.c                  |  502 +++++++++++
 test/py/tests/test_avb.py                    |  111 +++
 52 files changed, 8058 insertions(+)
 create mode 100644 cmd/avb.c
 create mode 100644 common/avb_verify.c
 create mode 100644 doc/README.avb2
 create mode 100644 include/avb/avb_ab_flow.h
 create mode 100644 include/avb/avb_ab_ops.h
 create mode 100644 include/avb/avb_chain_partition_descriptor.h
 create mode 100644 include/avb/avb_crypto.h
 create mode 100644 include/avb/avb_descriptor.h
 create mode 100644 include/avb/avb_footer.h
 create mode 100644 include/avb/avb_hash_descriptor.h
 create mode 100644 include/avb/avb_hashtree_descriptor.h
 create mode 100644 include/avb/avb_kernel_cmdline_descriptor.h
 create mode 100644 include/avb/avb_ops.h
 create mode 100644 include/avb/avb_property_descriptor.h
 create mode 100644 include/avb/avb_rsa.h
 create mode 100644 include/avb/avb_sha.h
 create mode 100644 include/avb/avb_slot_verify.h
 create mode 100644 include/avb/avb_sysdeps.h
 create mode 100644 include/avb/avb_util.h
 create mode 100644 include/avb/avb_vbmeta_image.h
 create mode 100644 include/avb/avb_version.h
 create mode 100644 include/avb/libavb.h
 create mode 100644 include/avb/libavb_ab.h
 create mode 100644 include/avb_verify.h
 create mode 100644 lib/libavb/Makefile
 create mode 100644 lib/libavb/avb_chain_partition_descriptor.c
 create mode 100644 lib/libavb/avb_crypto.c
 create mode 100644 lib/libavb/avb_descriptor.c
 create mode 100644 lib/libavb/avb_footer.c
 create mode 100644 lib/libavb/avb_hash_descriptor.c
 create mode 100644 lib/libavb/avb_hashtree_descriptor.c
 create mode 100644 lib/libavb/avb_kernel_cmdline_descriptor.c
 create mode 100644 lib/libavb/avb_property_descriptor.c
 create mode 100644 lib/libavb/avb_rsa.c
 create mode 100644 lib/libavb/avb_sha256.c
 create mode 100644 lib/libavb/avb_sha512.c

Quoted 9 lines

 create mode 100644 lib/libavb/avb_slot_verify.c
 create mode 100644 lib/libavb/avb_sysdeps_posix.c
 create mode 100644 lib/libavb/avb_util.c
 create mode 100644 lib/libavb/avb_vbmeta_image.c
 create mode 100644 lib/libavb/avb_version.c
 create mode 100644 lib/libavb_ab/Makefile
 create mode 100644 lib/libavb_ab/avb_ab_flow.c
 create mode 100644 test/py/tests/test_avb.py

_______________________________________________
U-Boot mailing list
U-Boot at lists.denx.de
https://lists.denx.de/listinfo/u-boot

Hi Kever,
libavb and libavb_ab are different things, and we split them for a reason.
Adding libavb is great, but you don't need to add libavb_ab as an A/B implementation. The boot_android command referenced by Igor doesn't use that as an A/B implementation, but uses the structs already defined in the Boot Control Block (BCB) and the android bootloader flow. I would recommend to include the libavb only.

Igor,
What changes did you need to do to libavb to import it to U-Boot? The idea with libavb is that it should be easy to integrate into your bootloader without changes; and therefore easy to update and integrate new patches when we release new versions of libavb. We would like to avoid diverting from it to reduce the maintenance cost.

Best regards,
Alex

Le jeu. 26 avr. 2018 à 05:05, Kever Yang <[email protected]> a écrit :

Quoted 155 lines

Hi Igor,

It's great to see the patch set to support AVB2.0, the upstream
libavb(from aosp) combine the AVB with A/B which I think should be two separate feature, are you going to split them?

BTW, do you have plan to update boot_android cmd to support avb?
the command is too weak for use now.
And any plan to add opptee_client/smcc to talk to OPTEE/ATF?

Thanks,
- Kever

Quoted 126 lines · Igor Opaniuk

This series of patches introduces support of Android Verified Boot 2.0, which provides integrity checking of Android partitions on MMC.

It integrates libavb/libavb_ab into the U-boot, provides implementation of
AvbOps, subset of avb commands to run verification chain (and for debugging
purposes), and it enables AVB2.0 verification on AM57xx HS SoC by default.

Currently, there is still no support for verification of A/B boot slots and no rollback protection (for storing rollback indexes there are plans to use eMMC RPMB)

Libavb/libavb_ab will be deviated from AOSP upstream in the future, that's why minimal amount of changes were introduced into the lib sources,
so checkpatch may fail.

For additional details check [1] AVB 2.0 README and doc/README.avb2, which
is a part of this patchset.

[1]
https://android.googlesource.com/platform/external/avb/+/master/README.md

Igor Opaniuk (8):
avb2.0: add Android Verified Boot 2.0 libraries avb2.0: integrate avb 2.0 into the build system avb2.0: implement AVB ops
cmd: avb2.0: avb command for performing verification avb2.0: add boot states and dm-verity support
am57xx_hs: avb2.0: add support of AVB 2.0 test/py: avb2.0: add tests for avb commands
doc: avb2.0: add README about AVB2.0 integration

 cmd/Kconfig                                  |   15 +
 cmd/Makefile                                 |    3 +
 cmd/avb.c                                    |  366 ++++++++
 common/Makefile                              |    2 +
 common/avb_verify.c                          |  748 ++++++++++++++++
 configs/am57xx_hs_evm_defconfig              |    3 +
 doc/README.avb2                              |  100 +++
 include/avb/avb_ab_flow.h                    |  235 ++++++
 include/avb/avb_ab_ops.h                     |   61 ++
 include/avb/avb_chain_partition_descriptor.h |   54 ++
 include/avb/avb_crypto.h                     |  147 ++++
 include/avb/avb_descriptor.h                 |  113 +++
 include/avb/avb_footer.h                     |   68 ++
 include/avb/avb_hash_descriptor.h            |   55 ++
 include/avb/avb_hashtree_descriptor.h        |   65 ++
 include/avb/avb_kernel_cmdline_descriptor.h  |   63 ++
 include/avb/avb_ops.h                        |  196 +++++
 include/avb/avb_property_descriptor.h        |   89 ++
 include/avb/avb_rsa.h                        |   55 ++
 include/avb/avb_sha.h                        |   72 ++
 include/avb/avb_slot_verify.h                |  239 ++++++
 include/avb/avb_sysdeps.h                    |   97 +++
 include/avb/avb_util.h                       |  259 ++++++
 include/avb/avb_vbmeta_image.h               |  272 ++++++
 include/avb/avb_version.h                    |   45 +
 include/avb/libavb.h                         |   32 +
 include/avb/libavb_ab.h                      |   22 +
 include/avb_verify.h                         |   97 +++
 include/configs/am57xx_evm.h                 |   11 +
 include/environment/ti/boot.h                |   15 +
 lib/Kconfig                                  |   20 +
 lib/Makefile                                 |    2 +
 lib/libavb/Makefile                          |   15 +
 lib/libavb/avb_chain_partition_descriptor.c  |   46 +
 lib/libavb/avb_crypto.c                      |  355 ++++++++
 lib/libavb/avb_descriptor.c                  |  142 ++++
 lib/libavb/avb_footer.c                      |   36 +
 lib/libavb/avb_hash_descriptor.c             |   43 +
 lib/libavb/avb_hashtree_descriptor.c         |   51 ++
 lib/libavb/avb_kernel_cmdline_descriptor.c   |   40 +
 lib/libavb/avb_property_descriptor.c         |  167 ++++
 lib/libavb/avb_rsa.c                         |  277 ++++++
 lib/libavb/avb_sha256.c                      |  364 ++++++++
 lib/libavb/avb_sha512.c                      |  362 ++++++++
 lib/libavb/avb_slot_verify.c                 | 1169
++++++++++++++++++++++++++
 lib/libavb/avb_sysdeps_posix.c               |   57 ++
 lib/libavb/avb_util.c                        |  385 +++++++++
 lib/libavb/avb_vbmeta_image.c                |  290 +++++++
 lib/libavb/avb_version.c                     |   16 +
 lib/libavb_ab/Makefile                       |    9 +
 lib/libavb_ab/avb_ab_flow.c                  |  502 +++++++++++
 test/py/tests/test_avb.py                    |  111 +++
 52 files changed, 8058 insertions(+)
 create mode 100644 cmd/avb.c
 create mode 100644 common/avb_verify.c
 create mode 100644 doc/README.avb2
 create mode 100644 include/avb/avb_ab_flow.h
 create mode 100644 include/avb/avb_ab_ops.h
 create mode 100644 include/avb/avb_chain_partition_descriptor.h
 create mode 100644 include/avb/avb_crypto.h
 create mode 100644 include/avb/avb_descriptor.h
 create mode 100644 include/avb/avb_footer.h
 create mode 100644 include/avb/avb_hash_descriptor.h
 create mode 100644 include/avb/avb_hashtree_descriptor.h
 create mode 100644 include/avb/avb_kernel_cmdline_descriptor.h
 create mode 100644 include/avb/avb_ops.h
 create mode 100644 include/avb/avb_property_descriptor.h
 create mode 100644 include/avb/avb_rsa.h
 create mode 100644 include/avb/avb_sha.h
 create mode 100644 include/avb/avb_slot_verify.h
 create mode 100644 include/avb/avb_sysdeps.h
 create mode 100644 include/avb/avb_util.h
 create mode 100644 include/avb/avb_vbmeta_image.h
 create mode 100644 include/avb/avb_version.h
 create mode 100644 include/avb/libavb.h
 create mode 100644 include/avb/libavb_ab.h
 create mode 100644 include/avb_verify.h
 create mode 100644 lib/libavb/Makefile
 create mode 100644 lib/libavb/avb_chain_partition_descriptor.c
 create mode 100644 lib/libavb/avb_crypto.c
 create mode 100644 lib/libavb/avb_descriptor.c
 create mode 100644 lib/libavb/avb_footer.c
 create mode 100644 lib/libavb/avb_hash_descriptor.c
 create mode 100644 lib/libavb/avb_hashtree_descriptor.c
 create mode 100644 lib/libavb/avb_kernel_cmdline_descriptor.c
 create mode 100644 lib/libavb/avb_property_descriptor.c
 create mode 100644 lib/libavb/avb_rsa.c
 create mode 100644 lib/libavb/avb_sha256.c
 create mode 100644 lib/libavb/avb_sha512.c

Quoted 9 lines

 create mode 100644 lib/libavb/avb_slot_verify.c
 create mode 100644 lib/libavb/avb_sysdeps_posix.c
 create mode 100644 lib/libavb/avb_util.c
 create mode 100644 lib/libavb/avb_vbmeta_image.c
 create mode 100644 lib/libavb/avb_version.c
 create mode 100644 lib/libavb_ab/Makefile
 create mode 100644 lib/libavb_ab/avb_ab_flow.c
 create mode 100644 test/py/tests/test_avb.py

_______________________________________________
U-Boot mailing list
U-Boot at lists.denx.de
https://lists.denx.de/listinfo/u-boot

Hi Alex,

I've replaced licence texts in source file headers to SPDX short identifiers (suggestion from Tom Rini).
As far as I know that was the only one major change I introduced to libavb/libavb_ab.
I also did remove crc32() implementation and used existing in U-boot because of licence ambiguity,
frankly I wasn't sure if it was GPL-2.0 compatible (
https://android.googlesource.com/platform/external/avb/+/mas
ter/libavb/avb_crc32.c).

Regarding libavb_ab, I guess I can exclude it for now, as there is no any functionality implemented for A/B
slots support in this patch-set. And, btw, I've noticed the note in the latest README.md for AVB2.0
on googlesource "This code is DEPRECATED and you must define AVB_AB_I_UNDERSTAND_LIBAVB_AB_IS_DEPRECATED to use it. The code will be removed Jun 1 2018.".
Does it mean that a/b stuff will be included in libavb instead of seperate libavb_av lib?

Thanks!

Regards,
Igor

Hello Igor, Alex, Kever,

I wonder if it would be possible to keep the internal libavb headers in lib/libavb (similar to how it's done by NXP in [4]), since this would allow not rewriting the original include paths for such headers in every *.c file and hence minimize the delta between in-tree vs out-of-tree code, as well as potentially speed up the update process (and/or simplify any update script which will take care of it, as also mentioned by Alex).

[4] http://git.freescale.com/git/cgit.cgi/imx/uboot-imx.git/commit/?h=60e14a6a07c5

My final question is what's your opinion about the NXP-specific libavb wrapper implementation found at lib/avb/fsl/ in [5]/[6] which seems to rely on libavb and libavb_ab. Do you see it as a good model to be followed by other platforms (both from point of view of contents and placement in the tree)? I am asking because we are in the middle of some decision-making for similar/alternative implementation on a different SoC, so your feedback will be extremely helpful and greatly appreciated.

Quoted 11 lines · Eugeniu Rosca

Hello Igor, Alex, Kever,

I wonder if it would be possible to keep the internal libavb headers in lib/libavb (similar to how it's done by NXP in [4]), since this would allow not rewriting the original include paths for such headers in every *.c file and hence minimize the delta between in-tree vs out-of-tree code, as well as potentially speed up the update process (and/or simplify any update script which will take care of it, as also mentioned by Alex).

[4] http://git.freescale.com/git/cgit.cgi/imx/uboot-imx.git/commit/?h=60e14a6a07c5

Here is what I mean.
Three lzma headers are exposed to internal users/consumers:

$ git grep '"../../lib/'
---<-snip->---
include/lzma/LzmaDec.h:#include "../../lib/lzma/LzmaDec.h"
include/lzma/LzmaTools.h:#include "../../lib/lzma/LzmaTools.h"
include/lzma/LzmaTypes.h:#include "../../lib/lzma/Types.h"
---<-snip->---

A few places where lzma headers are used:

$ git grep 'include <lzma/Lzma'
cmd/lzmadec.c:#include <lzma/LzmaTools.h>
common/bootm.c:#include <lzma/LzmaTypes.h>
common/bootm.c:#include <lzma/LzmaDec.h>
common/bootm.c:#include <lzma/LzmaTools.h>
lib/lzma/LzmaTools.h:#include <lzma/LzmaTypes.h>
test/compression.c:#include <lzma/LzmaTypes.h>
test/compression.c:#include <lzma/LzmaDec.h>
test/compression.c:#include <lzma/LzmaTools.h>

For libavb this would translate to:

$ cat include/avb/libavb.h
---<-snip->---
#include "../../lib/libavb/avb_chain_partition_descriptor.h"
#include "../../lib/libavb/avb_crypto.h"
#include "../../lib/libavb/avb_descriptor.h"
#include "../../lib/libavb/avb_footer.h"
#include "../../lib/libavb/avb_hash_descriptor.h"
---<-snip->---

And with that, various consumers (mainly libavb_avb?) would do:
#include <avb/libavb.h>

As said, this would make integration of new libavb versions much easier. Would appreciate your thoughts.

Best regards,
Eugeniu.

Hi Eugeniu,

You're totally right regarding avb internal headers, they all should remain in lib/libavb.
v2 patchset (planning to send it by the end of this week) will include these changes you're talking about (+ will include libavb updates from [1]).

I've taken a quick look at patches from [2], and noticed a few issues (IMHO):
1) It includes custom implementation of RPMB operations, although generic RPMB functionality already exists in the U-boot mainline (check drivers/mmc/rpmb.c)
2) It introduces a brand-new "boota" command for booting Android, although existing bootm does already support Android boot image parsing and booting.
3) It doesn't have any dm-verify enforcement policies in case
if the bootloader is in the "locked" state (at least, I didn't manage to grep it)
4) There are a bunch of platform-specific code introduced to fastboot driver, and it's used as a base for working with GPT
in avb ops (sounds strange, but this is what I see here), although mainline U-boot does have API for this purposes.

Regards,
Igor

[1] https://android.googlesource.com/platform/external/avb/+/master
[2] http://git.freescale.com/git/cgit.cgi/imx/uboot-imx.git/tree/lib/avb/fsl?h=imx_v2017.03_4.9.11_1.0.0_ga