futility: Compute / verify root key hash

Ryu will store a hash of the GBB root key in a struct inside its boot
block.  Add a vb2_ryu_root_key_hash struct for that.

If 'futility gbb_utility' is used to set the root key, also look for a
root key hash struct and fill it in.  No error if not found, because
this needs to work on other platforms where the struct is not present.
This way, we don't need to change the signing scripts.

Added a --roothash option which can be used to check if the root key
hash is found, and if so, whether it's empty, valid, or invalid.

BUG=chromium:511405
BRANCH=ryu
TEST=manual

    Take any existing image.bin.
    cp image.bin image.orig

    gbb_utility --roothash image.bin
    - ryu root hash not found

    Extract the root key
    gbb_utility -k rootkey.bin image.bin
    - exported root_key to file: rootkey.bin

    Now, append a blank ryu root hash struct to it
    echo '0000000: 5274 4b79 4861 7368 0100 0000 3000 0000' | xxd -r >> image.bin
    echo '0000000: 0000 0000 0000 0000 0000 0000 0000 0000' | xxd -r >> image.bin
    echo '0000000: 0000 0000 0000 0000 0000 0000 0000 0000' | xxd -r >> image.bin

    Nothing is set yet
    gbb_utility --roothash image.bin
    - ryu root hash is unset

    Setting the root key also sets the root hash
    gbb_utility -s -k rootkey.bin image.bin
    - import root_key from rootkey.bin: success
    - calculate ryu root hash: success
    successfully saved new image to: image.bin

    See, it verifies
    gbb_utility --roothash image.bin
    - ryu root hash verified

    Now, append a bad ryu root hash struct to it
    cp image.orig image.bin
    echo '0000000: 5274 4b79 4861 7368 0100 0000 3000 0000' | xxd -r >> image.bin
    echo '0000000: 0001 0000 0000 0000 0000 0000 0000 0000' | xxd -r >> image.bin
    echo '0000000: 0000 0000 0000 0000 0000 0000 0000 0000' | xxd -r >> image.bin

    See, it fails
    gbb_utility --roothash image.bin
    - ryu root hash does not verify

    Make sure the library doesn't contain the magic string
    strings `which futility` | grep RtKyHash
    (should be no output)

Change-Id: Ib46f93cac0f2b532bada4b187ae48efcf4926702
Signed-off-by: Randall Spangler <rspangler@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/286237
Reviewed-by: Furquan Shaikh <furquan@chromium.org>

1 files changed, 2 insertions, 1 deletions

diff --git a/Makefile b/Makefile
index 1273d80c..225097fc 100644
--- a/Makefile
+++ b/Makefile
@@ -615,7 +615,8 @@ FUTIL_STATIC_SRCS = \
 	futility/futility.c \
 	futility/cmd_dump_fmap.c \
 	futility/cmd_gbb_utility.c \
-	futility/misc.c
+	futility/misc.c \
+	futility/ryu_root_header.c
 
 FUTIL_SRCS = \
 	${FUTIL_STATIC_SRCS} \