[coreboot-gerrit] Change in coreboot[master]: device/pci_device.c: Use verified boot to check oprom

[Patrick Georgi (Code Review)]

Patrick Georgi has submitted this change. ( https://review.coreboot.org/c/coreboot/+/30810 )

Change subject: device/pci_device.c: Use verified boot to check oprom
......................................................................

device/pci_device.c: Use verified boot to check oprom

Before oprom is executed, no check is performed if rom passes verification.
Add call to verified_boot_should_run_oprom() to verify the oprom.

verified_boot_should_run_oprom() expects and rom address as input pointer.
*rom is added as input parameter to should_run_oprom() which must be parsed
to verified_boot_should_run_oprom()..

BUG=N/A
TEST=Created verified binary and verify logging on Facebook FBG1701

Change-Id: Iec5092e85d34940ea3a3bb1192ea49f3bc3e5b27
Signed-off-by: Frans Hendriks 
Reviewed-on: https://review.coreboot.org/c/coreboot/+/30810
Tested-by: build bot (Jenkins) 
Reviewed-by: Philipp Deppenwiese 
---
M src/device/pci_device.c
M src/include/device/pci_rom.h
2 files changed, 9 insertions(+), 3 deletions(-)

Approvals:
  build bot (Jenkins): Verified
  Philipp Deppenwiese: Looks good to me, approved

diff --git a/src/device/pci_device.c b/src/device/pci_device.c
index c043dd6..0a4b69b 100644
--- a/src/device/pci_device.c
+++ b/src/device/pci_device.c
@@ -679,10 +679,15 @@
    }
 }

-static int should_run_oprom(struct device *dev)
+static int should_run_oprom(struct device *dev, struct rom_header *rom)
 {
    static int should_run = -1;

+	if (CONFIG(VENDORCODE_ELTAN_VBOOT))
+		if (rom != NULL)
+			if (!verified_boot_should_run_oprom(rom))
+				return 0;
+
    if (should_run >= 0)
    	return should_run;

@@ -711,7 +716,7 @@
    	return 0;
    if (CONFIG(ALWAYS_LOAD_OPROM))
    	return 1;
-	if (should_run_oprom(dev))
+	if (should_run_oprom(dev, NULL))
    	return 1;

return 0;
@@ -742,7 +747,7 @@
    	return;
    timestamp_add_now(TS_OPROM_COPY_END);

-	if (!should_run_oprom(dev))
+	if (!should_run_oprom(dev, rom))
    	return;

run_bios(dev, (unsigned long)ram);
diff --git a/src/include/device/pci_rom.h b/src/include/device/pci_rom.h
index a4aa52a..82f3c40 100644
--- a/src/include/device/pci_rom.h
+++ b/src/include/device/pci_rom.h
@@ -47,4 +47,5 @@

u32 map_oprom_vendev(u32 vendev);

+int verified_boot_should_run_oprom(struct rom_header *rom_header);
 #endif