Attention is currently required from: Julius Werner, Yu-Ping Wu.
Hello Julius Werner, Michał Kopeć, Yu-Ping Wu, build bot (Jenkins),
I'd like you to reexamine a change. Please visit
https://review.coreboot.org/c/coreboot/+/74343?usp=email
to look at the new patch set (#7).
The following approvals got outdated and were removed: Verified+1 by build bot (Jenkins)
Change subject: security/vboot: Add Kconfig option to clear recovery request ......................................................................
security/vboot: Add Kconfig option to clear recovery request
For ChromeOS platform the recovery reason is cleared in vb2api_kernel_phase2 which is probably not called by any non-ChromeOS system. It results in the platform being stuck in recovery mode, e.g. when RW firmware verification fails. Even if the RW partition is flashed with correctly signed image, the persistent non-zero recovery reason will prevent vboot from attempting the RW partition check.
Use the newly exposed vb2api_clear_recovery and VBOOT_CLEAR_RECOVERY_IN_RAMSTAGE Kconfig option to clear the recovery reason and save it immediately to the VBNV. The idea is to let non-ChromeOS coreboot platform to clear the recovery reason when needed.
TEST=Clear the recovery reason in mainboard_final function right before payload jump when RW partition is corrupted and RW partition is valid. In case it is corrupted, the platform stays in recovery mode, when valid the platform boots from RW partition. Tested on MSI PRO Z690-A DDR4.
Signed-off-by: Michał Żygowski michal.zygowski@3mdeb.com Change-Id: I7ffaf3e8f61a28a68c9802c184961b1b9bf9d617 --- M src/security/vboot/Kconfig M src/security/vboot/bootmode.c 2 files changed, 25 insertions(+), 0 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/43/74343/7