[U-Boot] [PATCH 0/8] Initial integration of AVB2.0

Igor Opaniuk igor.opaniuk at linaro.org
Fri Apr 27 09:53:11 UTC 2018


Hi Alex,

I've replaced licence texts in source file headers to SPDX short
identifiers (suggestion from Tom Rini).
As far as I know that was the only one major change I introduced to
libavb/libavb_ab.
I also did remove crc32() implementation and used existing in U-boot
because of licence ambiguity,
frankly I wasn't sure if it was GPL-2.0 compatible (
https://android.googlesource.com/platform/external/avb/+/master/libavb/avb_crc32.c).

Regarding libavb_ab, I guess I can exclude it for now, as there is no
any functionality implemented for A/B
slots support in this patch-set. And, btw, I've noticed the note in
the latest README.md for AVB2.0
on googlesource "This code is DEPRECATED and you must define
AVB_AB_I_UNDERSTAND_LIBAVB_AB_IS_DEPRECATED  to use it. The code will
be removed Jun 1 2018.".
Does it mean that a/b stuff will be included in libavb instead of
seperate libavb_av lib?

Thanks!

Regards,
Igor

On 26 April 2018 at 19:35, Alex Deymo <deymo+ at google.com> wrote:
> Hi Kever,
>   libavb and libavb_ab are different things, and we split them for a reason.
> Adding libavb is great, but you don't need to add libavb_ab as an A/B
> implementation. The boot_android command referenced by Igor doesn't use that
> as an A/B implementation, but uses the structs already defined in the Boot
> Control Block (BCB) and the android bootloader flow. I would recommend to
> include the libavb only.
>
> Igor,
> What changes did you need to do to libavb to import it to U-Boot? The idea
> with libavb is that it should be easy to integrate into your bootloader
> without changes; and therefore easy to update and integrate new patches when
> we release new versions of libavb. We would like to avoid diverting from it
> to reduce the maintenance cost.
>
> Best regards,
> Alex
>
>
> Le jeu. 26 avr. 2018 à 05:05, Kever Yang <kever.yang at rock-chips.com> a écrit
> :
>>
>> Hi Igor,
>>
>>     It's great to see the patch set to support AVB2.0, the upstream
>> libavb(from aosp) combine the AVB with A/B which I think should be
>> two separate feature, are you going to split them?
>>
>>     BTW, do you have plan to update boot_android cmd to support avb?
>> the command is too weak for use now.
>> And any plan to add opptee_client/smcc to talk to OPTEE/ATF?
>>
>> Thanks,
>> - Kever
>> On 04/25/2018 09:17 PM, Igor Opaniuk wrote:
>> > This series of patches introduces support of Android Verified Boot 2.0,
>> > which provides integrity checking of Android partitions on MMC.
>> >
>> > It integrates libavb/libavb_ab into the U-boot, provides implementation
>> > of
>> > AvbOps, subset of `avb` commands to run verification chain (and for
>> > debugging
>> > purposes), and it enables AVB2.0 verification on AM57xx HS SoC by
>> > default.
>> >
>> > Currently, there is still no support for verification of A/B boot slots
>> > and no rollback protection (for storing rollback indexes
>> > there are plans to use eMMC RPMB)
>> >
>> > Libavb/libavb_ab will be deviated from AOSP upstream in the future,
>> > that's why minimal amount of changes were introduced into the lib
>> > sources,
>> > so checkpatch may fail.
>> >
>> > For additional details check [1] AVB 2.0 README and doc/README.avb2,
>> > which
>> > is a part of this patchset.
>> >
>> > [1]
>> > https://android.googlesource.com/platform/external/avb/+/master/README.md
>> >
>> > Igor Opaniuk (8):
>> >   avb2.0: add Android Verified Boot 2.0 libraries
>> >   avb2.0: integrate avb 2.0 into the build system
>> >   avb2.0: implement AVB ops
>> >   cmd: avb2.0: avb command for performing verification
>> >   avb2.0: add boot states and dm-verity support
>> >   am57xx_hs: avb2.0: add support of AVB 2.0
>> >   test/py: avb2.0: add tests for avb commands
>> >   doc: avb2.0: add README about AVB2.0 integration
>> >
>> >  cmd/Kconfig                                  |   15 +
>> >  cmd/Makefile                                 |    3 +
>> >  cmd/avb.c                                    |  366 ++++++++
>> >  common/Makefile                              |    2 +
>> >  common/avb_verify.c                          |  748 ++++++++++++++++
>> >  configs/am57xx_hs_evm_defconfig              |    3 +
>> >  doc/README.avb2                              |  100 +++
>> >  include/avb/avb_ab_flow.h                    |  235 ++++++
>> >  include/avb/avb_ab_ops.h                     |   61 ++
>> >  include/avb/avb_chain_partition_descriptor.h |   54 ++
>> >  include/avb/avb_crypto.h                     |  147 ++++
>> >  include/avb/avb_descriptor.h                 |  113 +++
>> >  include/avb/avb_footer.h                     |   68 ++
>> >  include/avb/avb_hash_descriptor.h            |   55 ++
>> >  include/avb/avb_hashtree_descriptor.h        |   65 ++
>> >  include/avb/avb_kernel_cmdline_descriptor.h  |   63 ++
>> >  include/avb/avb_ops.h                        |  196 +++++
>> >  include/avb/avb_property_descriptor.h        |   89 ++
>> >  include/avb/avb_rsa.h                        |   55 ++
>> >  include/avb/avb_sha.h                        |   72 ++
>> >  include/avb/avb_slot_verify.h                |  239 ++++++
>> >  include/avb/avb_sysdeps.h                    |   97 +++
>> >  include/avb/avb_util.h                       |  259 ++++++
>> >  include/avb/avb_vbmeta_image.h               |  272 ++++++
>> >  include/avb/avb_version.h                    |   45 +
>> >  include/avb/libavb.h                         |   32 +
>> >  include/avb/libavb_ab.h                      |   22 +
>> >  include/avb_verify.h                         |   97 +++
>> >  include/configs/am57xx_evm.h                 |   11 +
>> >  include/environment/ti/boot.h                |   15 +
>> >  lib/Kconfig                                  |   20 +
>> >  lib/Makefile                                 |    2 +
>> >  lib/libavb/Makefile                          |   15 +
>> >  lib/libavb/avb_chain_partition_descriptor.c  |   46 +
>> >  lib/libavb/avb_crypto.c                      |  355 ++++++++
>> >  lib/libavb/avb_descriptor.c                  |  142 ++++
>> >  lib/libavb/avb_footer.c                      |   36 +
>> >  lib/libavb/avb_hash_descriptor.c             |   43 +
>> >  lib/libavb/avb_hashtree_descriptor.c         |   51 ++
>> >  lib/libavb/avb_kernel_cmdline_descriptor.c   |   40 +
>> >  lib/libavb/avb_property_descriptor.c         |  167 ++++
>> >  lib/libavb/avb_rsa.c                         |  277 ++++++
>> >  lib/libavb/avb_sha256.c                      |  364 ++++++++
>> >  lib/libavb/avb_sha512.c                      |  362 ++++++++
>> >  lib/libavb/avb_slot_verify.c                 | 1169
>> > ++++++++++++++++++++++++++
>> >  lib/libavb/avb_sysdeps_posix.c               |   57 ++
>> >  lib/libavb/avb_util.c                        |  385 +++++++++
>> >  lib/libavb/avb_vbmeta_image.c                |  290 +++++++
>> >  lib/libavb/avb_version.c                     |   16 +
>> >  lib/libavb_ab/Makefile                       |    9 +
>> >  lib/libavb_ab/avb_ab_flow.c                  |  502 +++++++++++
>> >  test/py/tests/test_avb.py                    |  111 +++
>> >  52 files changed, 8058 insertions(+)
>> >  create mode 100644 cmd/avb.c
>> >  create mode 100644 common/avb_verify.c
>> >  create mode 100644 doc/README.avb2
>> >  create mode 100644 include/avb/avb_ab_flow.h
>> >  create mode 100644 include/avb/avb_ab_ops.h
>> >  create mode 100644 include/avb/avb_chain_partition_descriptor.h
>> >  create mode 100644 include/avb/avb_crypto.h
>> >  create mode 100644 include/avb/avb_descriptor.h
>> >  create mode 100644 include/avb/avb_footer.h
>> >  create mode 100644 include/avb/avb_hash_descriptor.h
>> >  create mode 100644 include/avb/avb_hashtree_descriptor.h
>> >  create mode 100644 include/avb/avb_kernel_cmdline_descriptor.h
>> >  create mode 100644 include/avb/avb_ops.h
>> >  create mode 100644 include/avb/avb_property_descriptor.h
>> >  create mode 100644 include/avb/avb_rsa.h
>> >  create mode 100644 include/avb/avb_sha.h
>> >  create mode 100644 include/avb/avb_slot_verify.h
>> >  create mode 100644 include/avb/avb_sysdeps.h
>> >  create mode 100644 include/avb/avb_util.h
>> >  create mode 100644 include/avb/avb_vbmeta_image.h
>> >  create mode 100644 include/avb/avb_version.h
>> >  create mode 100644 include/avb/libavb.h
>> >  create mode 100644 include/avb/libavb_ab.h
>> >  create mode 100644 include/avb_verify.h
>> >  create mode 100644 lib/libavb/Makefile
>> >  create mode 100644 lib/libavb/avb_chain_partition_descriptor.c
>> >  create mode 100644 lib/libavb/avb_crypto.c
>> >  create mode 100644 lib/libavb/avb_descriptor.c
>> >  create mode 100644 lib/libavb/avb_footer.c
>> >  create mode 100644 lib/libavb/avb_hash_descriptor.c
>> >  create mode 100644 lib/libavb/avb_hashtree_descriptor.c
>> >  create mode 100644 lib/libavb/avb_kernel_cmdline_descriptor.c
>> >  create mode 100644 lib/libavb/avb_property_descriptor.c
>> >  create mode 100644 lib/libavb/avb_rsa.c
>> >  create mode 100644 lib/libavb/avb_sha256.c
>> >  create mode 100644 lib/libavb/avb_sha512.c
>> >  create mode 100644 lib/libavb/avb_slot_verify.c
>> >  create mode 100644 lib/libavb/avb_sysdeps_posix.c
>> >  create mode 100644 lib/libavb/avb_util.c
>> >  create mode 100644 lib/libavb/avb_vbmeta_image.c
>> >  create mode 100644 lib/libavb/avb_version.c
>> >  create mode 100644 lib/libavb_ab/Makefile
>> >  create mode 100644 lib/libavb_ab/avb_ab_flow.c
>> >  create mode 100644 test/py/tests/test_avb.py
>> >
>>
>>
>> _______________________________________________
>> U-Boot mailing list
>> U-Boot at lists.denx.de
>> https://lists.denx.de/listinfo/u-boot



-- 
Regards,
Igor Opaniuk


More information about the U-Boot mailing list