diff options
author | Randall Spangler <rspangler@chromium.org> | 2014-11-12 16:20:50 -0800 |
---|---|---|
committer | chrome-internal-fetch <chrome-internal-fetch@google.com> | 2014-11-14 23:56:55 +0000 |
commit | efa37b87f2b4cd4b4f515e96201502ae0408cec7 (patch) | |
tree | bfa936c35d93779b80d1c864e36fca91a62b31ab | |
parent | 7c1eee09eff54c6e60a3b261e6df790c11331695 (diff) | |
download | vboot-efa37b87f2b4cd4b4f515e96201502ae0408cec7.tar.gz |
vboot2: Add api-level functions to use new data structures
And associated unit tests.
And fix a memory overwrite in the old vb_api_tests.c, which apparently
didn't touch a critical piece of the shared work buffer, but was still
wrong. (This was a problem in the test, not in the code being
tested.)
BUG=chromium:423882
BRANCH=none
TEST=VBOOT2=1 make runtests
Change-Id: I322fb7e6bb5214b0adcf5d6d48a0cd238abba88e
Signed-off-by: Randall Spangler <rspangler@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/229738
Reviewed-by: Bill Richardson <wfrichar@chromium.org>
-rw-r--r-- | Makefile | 5 | ||||
-rw-r--r-- | firmware/2lib/2api2.c | 146 | ||||
-rw-r--r-- | firmware/2lib/include/2api.h | 21 | ||||
-rw-r--r-- | firmware/2lib/include/2return_codes.h | 6 | ||||
-rw-r--r-- | firmware/2lib/include/2struct.h | 10 | ||||
-rw-r--r-- | tests/vb2_api2_tests.c | 249 | ||||
-rw-r--r-- | tests/vb2_api_tests.c | 2 |
7 files changed, 433 insertions, 6 deletions
@@ -282,6 +282,7 @@ VBSLK_SRCS = \ # Firmware library source needed for smaller library 2 FWLIB2_SRCS = \ firmware/2lib/2api.c \ + firmware/2lib/2api2.c \ firmware/2lib/2common.c \ firmware/2lib/2common2.c \ firmware/2lib/2crc8.c \ @@ -633,6 +634,7 @@ endif ifneq (${VBOOT2},) TEST_NAMES += \ tests/vb2_api_tests \ + tests/vb2_api2_tests \ tests/vb2_common_tests \ tests/vb2_common2_tests \ tests/vb2_common3_tests \ @@ -936,7 +938,7 @@ tests: ${TEST_BINS} ${TEST_BINS}: ${UTILLIB} ${TESTLIB} ${TEST_BINS}: INCLUDES += -Itests -${TEST_BINS}: LIBS = ${UTILLIB} ${TESTLIB} +${TEST_BINS}: LIBS = ${TESTLIB} ${UTILLIB} ${TESTLIB}: ${TESTLIB_OBJS} @$(PRINTF) " RM $(subst ${BUILD}/,,$@)\n" @@ -1170,6 +1172,7 @@ runmisctests: test_setup .PHONY: run2tests run2tests: test_setup ${RUNTEST} ${BUILD_RUN}/tests/vb2_api_tests + ${RUNTEST} ${BUILD_RUN}/tests/vb2_api2_tests ${RUNTEST} ${BUILD_RUN}/tests/vb2_common_tests ${RUNTEST} ${BUILD_RUN}/tests/vb2_common2_tests ${TEST_KEYS} ${RUNTEST} ${BUILD_RUN}/tests/vb2_common3_tests ${TEST_KEYS} diff --git a/firmware/2lib/2api2.c b/firmware/2lib/2api2.c new file mode 100644 index 00000000..0df2cf69 --- /dev/null +++ b/firmware/2lib/2api2.c @@ -0,0 +1,146 @@ +/* Copyright (c) 2014 The Chromium OS Authors. All rights reserved. + * Use of this source code is governed by a BSD-style license that can be + * found in the LICENSE file. + * + * Externally-callable APIs + * (Firmware portion) + */ + +#include "2sysincludes.h" +#include "2api.h" +#include "2common.h" +#include "2misc.h" +#include "2nvstorage.h" +#include "2secdata.h" +#include "2sha.h" +#include "2rsa.h" + +int vb2api_fw_phase3_2(struct vb2_context *ctx) +{ + int rv; + + /* Verify firmware keyblock */ + rv = vb2_load_fw_keyblock2(ctx); + if (rv) { + vb2_fail(ctx, VB2_RECOVERY_RO_INVALID_RW, rv); + return rv; + } + + /* Verify firmware preamble */ + rv = vb2_load_fw_preamble2(ctx); + if (rv) { + vb2_fail(ctx, VB2_RECOVERY_RO_INVALID_RW, rv); + return rv; + } + + return VB2_SUCCESS; +} + +int vb2api_init_hash2(struct vb2_context *ctx, + const struct vb2_guid *guid, + uint32_t *size) +{ + struct vb2_shared_data *sd = vb2_get_sd(ctx); + const struct vb2_fw_preamble2 *pre; + const struct vb2_signature2 *sig = NULL; + struct vb2_digest_context *dc; + struct vb2_workbuf wb; + uint32_t hash_offset; + int i; + + vb2_workbuf_from_ctx(ctx, &wb); + + /* Get preamble pointer */ + if (!sd->workbuf_preamble_size) + return VB2_ERROR_API_INIT_HASH_PREAMBLE; + pre = (const struct vb2_fw_preamble2 *) + (ctx->workbuf + sd->workbuf_preamble_offset); + + /* Find the matching signature */ + hash_offset = pre->hash_offset; + for (i = 0; i < pre->hash_count; i++) { + sig = (const struct vb2_signature2 *) + ((uint8_t *)pre + hash_offset); + + if (!memcmp(guid, &sig->guid, sizeof(*guid))) + break; + + hash_offset += sig->c.total_size; + } + if (i >= pre->hash_count) + return VB2_ERROR_API_INIT_HASH_GUID; /* No match */ + + /* Allocate workbuf space for the hash */ + if (sd->workbuf_hash_size) { + dc = (struct vb2_digest_context *) + (ctx->workbuf + sd->workbuf_hash_offset); + } else { + uint32_t dig_size = sizeof(*dc); + + dc = vb2_workbuf_alloc(&wb, dig_size); + if (!dc) + return VB2_ERROR_API_INIT_HASH_WORKBUF; + + sd->workbuf_hash_offset = vb2_offset_of(ctx->workbuf, dc); + sd->workbuf_hash_size = dig_size; + ctx->workbuf_used = sd->workbuf_hash_offset + dig_size; + } + + sd->hash_tag = vb2_offset_of(ctx->workbuf, sig); + sd->hash_remaining_size = sig->data_size; + + if (size) + *size = sig->data_size; + + return vb2_digest_init(dc, sig->hash_alg); +} + +int vb2api_check_hash2(struct vb2_context *ctx) +{ + struct vb2_shared_data *sd = vb2_get_sd(ctx); + struct vb2_digest_context *dc = (struct vb2_digest_context *) + (ctx->workbuf + sd->workbuf_hash_offset); + struct vb2_workbuf wb; + + uint8_t *digest; + uint32_t digest_size = vb2_digest_size(dc->hash_alg); + + const struct vb2_signature2 *sig; + + int rv; + + vb2_workbuf_from_ctx(ctx, &wb); + + /* Get signature pointer */ + if (!sd->hash_tag) + return VB2_ERROR_API_CHECK_HASH_TAG; + sig = (const struct vb2_signature2 *)(ctx->workbuf + sd->hash_tag); + + /* Must have initialized hash digest work area */ + if (!sd->workbuf_hash_size) + return VB2_ERROR_API_CHECK_HASH_WORKBUF; + + /* Should have hashed the right amount of data */ + if (sd->hash_remaining_size) + return VB2_ERROR_API_CHECK_HASH_SIZE; + + /* Allocate the digest */ + digest = vb2_workbuf_alloc(&wb, digest_size); + if (!digest) + return VB2_ERROR_API_CHECK_HASH_WORKBUF_DIGEST; + + /* Finalize the digest */ + rv = vb2_digest_finalize(dc, digest, digest_size); + if (rv) + return rv; + + /* Compare with the signature */ + if (vb2_safe_memcmp(digest, (const uint8_t *)sig + sig->sig_offset, + digest_size)) + return VB2_ERROR_API_CHECK_HASH_SIG; + + // TODO: the old check-hash function called vb2_fail() on any mismatch. + // I don't think it should do that; the caller should. + + return VB2_SUCCESS; +} diff --git a/firmware/2lib/include/2api.h b/firmware/2lib/include/2api.h index 603e0953..c0727c76 100644 --- a/firmware/2lib/include/2api.h +++ b/firmware/2lib/include/2api.h @@ -297,6 +297,11 @@ int vb2api_fw_phase2(struct vb2_context *ctx); int vb2api_fw_phase3(struct vb2_context *ctx); /** + * Same, but for new-style structs. + */ +int vb2api_fw_phase3_2(struct vb2_context *ctx); + +/** * Initialize hashing data for the specified tag. * * @param ctx Vboot context @@ -308,8 +313,17 @@ int vb2api_fw_phase3(struct vb2_context *ctx); int vb2api_init_hash(struct vb2_context *ctx, uint32_t tag, uint32_t *size); /** + * Same, but for new-style structs. + */ +int vb2api_init_hash2(struct vb2_context *ctx, + const struct vb2_guid *guid, + uint32_t *size); + +/** * Extend the hash started by vb2api_init_hash() with additional data. * + * (This is the same for both old and new style structs.) + * * @param ctx Vboot context * @param buf Data to hash * @param size Size of data in bytes @@ -327,9 +341,10 @@ int vb2api_extend_hash(struct vb2_context *ctx, */ int vb2api_check_hash(struct vb2_context *ctx); -int vb2api_get_kernel_subkey(struct vb2_context *ctx, - uint8_t *buf, - uint32_t *size); +/** + * Same, but for new-style structs. + */ +int vb2api_check_hash2(struct vb2_context *ctx); /*****************************************************************************/ /* APIs provided by the caller to verified boot */ diff --git a/firmware/2lib/include/2return_codes.h b/firmware/2lib/include/2return_codes.h index 259726d1..fa7437e0 100644 --- a/firmware/2lib/include/2return_codes.h +++ b/firmware/2lib/include/2return_codes.h @@ -414,6 +414,12 @@ enum vb2_return_code { /* Phase one needs recovery mode */ VB2_ERROR_API_PHASE1_RECOVERY, + /* Bag tag in vb2api_check_hash() */ + VB2_ERROR_API_INIT_HASH_GUID, + + /* Siganature mismatch in vb2api_check_hash() */ + VB2_ERROR_API_CHECK_HASH_SIG, + /********************************************************************** * Errors which may be generated by implementations of vb2ex functions. * Implementation may also return its own specific errors, which should diff --git a/firmware/2lib/include/2struct.h b/firmware/2lib/include/2struct.h index de67bfc3..dd956219 100644 --- a/firmware/2lib/include/2struct.h +++ b/firmware/2lib/include/2struct.h @@ -611,7 +611,15 @@ struct vb2_shared_data { uint32_t workbuf_hash_offset; uint32_t workbuf_hash_size; - /* Current tag we're hashing */ + /* + * Current tag we're hashing + * + * For new structs, this is the offset of the vb2_signature2 struct + * in the work buffer. + * + * TODO: rename to workbuf_hash_sig_offset when vboot1 structs are + * deprecated. + */ uint32_t hash_tag; /* Amount of data we still expect to hash */ diff --git a/tests/vb2_api2_tests.c b/tests/vb2_api2_tests.c new file mode 100644 index 00000000..17fc3b96 --- /dev/null +++ b/tests/vb2_api2_tests.c @@ -0,0 +1,249 @@ +/* Copyright (c) 2014 The Chromium OS Authors. All rights reserved. + * Use of this source code is governed by a BSD-style license that can be + * found in the LICENSE file. + * + * Tests for api library, new style structs + */ + +#include <stdio.h> + +#include "2sysincludes.h" +#include "2api.h" +#include "2common.h" +#include "2misc.h" +#include "2nvstorage.h" +#include "2rsa.h" +#include "2secdata.h" + +#include "test_common.h" +#include "vb2_convert_structs.h" + +/* Common context for tests */ +static uint8_t workbuf[VB2_WORKBUF_RECOMMENDED_SIZE] + __attribute__ ((aligned (16))); +static struct vb2_context ctx; +static struct vb2_shared_data *sd; + +static const uint8_t mock_body[320] = "Mock body"; +static const int mock_body_size = sizeof(mock_body); +static const int mock_algorithm = VB2_ALG_RSA2048_SHA256; +static const int mock_hash_alg = VB2_HASH_SHA256; +static int mock_sig_size; + +static const struct vb2_guid test_guid[4] = { + {.raw = {0x11}}, + {.raw = {0x22}}, + {.raw = {0x33}}, + {.raw = {0x44}}, +}; + +/* Mocked function data */ +static int retval_vb2_load_fw_keyblock; +static int retval_vb2_load_fw_preamble; + +/* Type of test to reset for */ +enum reset_type { + FOR_MISC, + FOR_EXTEND_HASH, + FOR_CHECK_HASH, +}; + +static void reset_common_data(enum reset_type t) +{ + struct vb2_fw_preamble2 *pre; + struct vb2_signature2 *sig; + uint32_t sig_offset; + + int i; + + memset(workbuf, 0xaa, sizeof(workbuf)); + + memset(&ctx, 0, sizeof(ctx)); + ctx.workbuf = workbuf; + ctx.workbuf_size = sizeof(workbuf); + + vb2_init_context(&ctx); + sd = vb2_get_sd(&ctx); + + vb2_nv_init(&ctx); + + vb2_secdata_create(&ctx); + vb2_secdata_init(&ctx); + + retval_vb2_load_fw_keyblock = VB2_SUCCESS; + retval_vb2_load_fw_preamble = VB2_SUCCESS; + + sd->workbuf_preamble_offset = ctx.workbuf_used; + pre = (struct vb2_fw_preamble2 *) + (ctx.workbuf + sd->workbuf_preamble_offset); + pre->hash_count = 3; + pre->hash_offset = sig_offset = sizeof(*pre); + + for (i = 0; i < 3; i++) { + sig = vb2_create_hash_sig(mock_body, + mock_body_size - 16 * i, + mock_hash_alg); + memcpy(&sig->guid, test_guid + i, sizeof(sig->guid)); + memcpy((uint8_t *)pre + sig_offset, sig, sig->c.total_size); + sig_offset += sig->c.total_size; + mock_sig_size = sig->c.total_size; + free(sig); + } + + sd->workbuf_preamble_size = sig_offset; + ctx.workbuf_used = sd->workbuf_preamble_offset + + sd->workbuf_preamble_size; + + if (t == FOR_EXTEND_HASH || t == FOR_CHECK_HASH) + vb2api_init_hash2(&ctx, test_guid, NULL); + + if (t == FOR_CHECK_HASH) + vb2api_extend_hash(&ctx, mock_body, mock_body_size); +}; + +/* Mocked functions */ + +int vb2_load_fw_keyblock2(struct vb2_context *ctx) +{ + return retval_vb2_load_fw_keyblock; +} + +int vb2_load_fw_preamble2(struct vb2_context *ctx) +{ + return retval_vb2_load_fw_preamble; +} + +/* Tests */ + +static void phase3_tests(void) +{ + reset_common_data(FOR_MISC); + TEST_SUCC(vb2api_fw_phase3_2(&ctx), "phase3 good"); + + reset_common_data(FOR_MISC); + retval_vb2_load_fw_keyblock = VB2_ERROR_MOCK; + TEST_EQ(vb2api_fw_phase3_2(&ctx), VB2_ERROR_MOCK, "phase3 keyblock"); + TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), + VB2_RECOVERY_RO_INVALID_RW, " recovery reason"); + + reset_common_data(FOR_MISC); + retval_vb2_load_fw_preamble = VB2_ERROR_MOCK; + TEST_EQ(vb2api_fw_phase3_2(&ctx), VB2_ERROR_MOCK, "phase3 keyblock"); + TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), + VB2_RECOVERY_RO_INVALID_RW, " recovery reason"); +} + +static void init_hash_tests(void) +{ + struct vb2_fw_preamble2 *pre; + struct vb2_signature2 *sig; + int wb_used_before; + uint32_t size; + + reset_common_data(FOR_MISC); + pre = (struct vb2_fw_preamble2 *) + (ctx.workbuf + sd->workbuf_preamble_offset); + sig = (struct vb2_signature2 *)((uint8_t *)pre + pre->hash_offset); + + wb_used_before = ctx.workbuf_used; + TEST_SUCC(vb2api_init_hash2(&ctx, test_guid, &size), + "init hash good"); + TEST_EQ(sd->workbuf_hash_offset, + (wb_used_before + (VB2_WORKBUF_ALIGN - 1)) & + ~(VB2_WORKBUF_ALIGN - 1), + "hash context offset"); + TEST_EQ(sd->workbuf_hash_size, sizeof(struct vb2_digest_context), + "hash context size"); + TEST_EQ(ctx.workbuf_used, + sd->workbuf_hash_offset + sd->workbuf_hash_size, + "hash uses workbuf"); + TEST_EQ(sd->hash_tag, + sd->workbuf_preamble_offset + pre->hash_offset, + "hash signature offset"); + TEST_EQ(sd->hash_remaining_size, mock_body_size, "hash remaining"); + + wb_used_before = ctx.workbuf_used; + TEST_SUCC(vb2api_init_hash2(&ctx, test_guid + 2, NULL), + "init hash again"); + TEST_EQ(ctx.workbuf_used, wb_used_before, "init hash reuses context"); + TEST_EQ(sd->hash_tag, + sd->workbuf_preamble_offset + pre->hash_offset + + 2 * mock_sig_size, + "hash signature offset 2"); + + reset_common_data(FOR_MISC); + TEST_EQ(vb2api_init_hash2(&ctx, test_guid + 3, &size), + VB2_ERROR_API_INIT_HASH_GUID, "init hash invalid guid"); + + reset_common_data(FOR_MISC); + sd->workbuf_preamble_size = 0; + TEST_EQ(vb2api_init_hash2(&ctx, test_guid, &size), + VB2_ERROR_API_INIT_HASH_PREAMBLE, "init hash preamble"); + + reset_common_data(FOR_MISC); + ctx.workbuf_used = + ctx.workbuf_size - sizeof(struct vb2_digest_context) + 8; + TEST_EQ(vb2api_init_hash2(&ctx, test_guid, &size), + VB2_ERROR_API_INIT_HASH_WORKBUF, "init hash workbuf"); + + reset_common_data(FOR_MISC); + sig->hash_alg = VB2_HASH_INVALID; + TEST_EQ(vb2api_init_hash2(&ctx, test_guid, &size), + VB2_ERROR_SHA_INIT_ALGORITHM, "init hash algorithm"); +} + +static void check_hash_tests(void) +{ + struct vb2_fw_preamble2 *pre; + struct vb2_signature2 *sig; + struct vb2_digest_context *dc; + + reset_common_data(FOR_CHECK_HASH); + pre = (struct vb2_fw_preamble2 *) + (ctx.workbuf + sd->workbuf_preamble_offset); + sig = (struct vb2_signature2 *)((uint8_t *)pre + pre->hash_offset); + dc = (struct vb2_digest_context *) + (ctx.workbuf + sd->workbuf_hash_offset); + + TEST_SUCC(vb2api_check_hash2(&ctx), "check hash good"); + + reset_common_data(FOR_CHECK_HASH); + sd->hash_tag = 0; + TEST_EQ(vb2api_check_hash2(&ctx), + VB2_ERROR_API_CHECK_HASH_TAG, "check hash tag"); + + reset_common_data(FOR_CHECK_HASH); + sd->workbuf_hash_size = 0; + TEST_EQ(vb2api_check_hash2(&ctx), + VB2_ERROR_API_CHECK_HASH_WORKBUF, "check hash no workbuf"); + + reset_common_data(FOR_CHECK_HASH); + sd->hash_remaining_size = 1; + TEST_EQ(vb2api_check_hash2(&ctx), + VB2_ERROR_API_CHECK_HASH_SIZE, "check hash size"); + + reset_common_data(FOR_CHECK_HASH); + ctx.workbuf_used = ctx.workbuf_size; + TEST_EQ(vb2api_check_hash2(&ctx), + VB2_ERROR_API_CHECK_HASH_WORKBUF_DIGEST, "check hash workbuf"); + + reset_common_data(FOR_CHECK_HASH); + dc->hash_alg = VB2_HASH_INVALID; + *((uint8_t *)sig + sig->sig_offset) ^= 0x55; + TEST_EQ(vb2api_check_hash2(&ctx), + VB2_ERROR_SHA_FINALIZE_ALGORITHM, "check hash finalize"); + + reset_common_data(FOR_CHECK_HASH); + *((uint8_t *)sig + sig->sig_offset) ^= 0x55; + TEST_EQ(vb2api_check_hash2(&ctx), + VB2_ERROR_API_CHECK_HASH_SIG, "check hash sig"); +} + +int main(int argc, char* argv[]) +{ + phase3_tests(); + init_hash_tests(); + check_hash_tests(); + + return gTestSuccess ? 0 : 255; +} diff --git a/tests/vb2_api_tests.c b/tests/vb2_api_tests.c index 5d667663..a7893012 100644 --- a/tests/vb2_api_tests.c +++ b/tests/vb2_api_tests.c @@ -75,7 +75,7 @@ static void reset_common_data(enum reset_type t) retval_vb2_digest_finalize = VB2_SUCCESS; retval_vb2_verify_digest = VB2_SUCCESS; - sd->workbuf_preamble_offset = 8; + sd->workbuf_preamble_offset = cc.workbuf_used; sd->workbuf_preamble_size = sizeof(*pre); cc.workbuf_used = sd->workbuf_preamble_offset + sd->workbuf_preamble_size; |