futility: rwsig: Add support for images with FMAP

If an FMAP is detected in the rwsig image file, use it
to determine the location of:
 - RW region
 - RW signature
 - public key in RO region

futility show uses that information to verify the signature,
and futility sign uses it is correctly resign the image,
and replace the public key a well.

This also adds tests for this use case. hammer_dev.bin sample
image uses huge RO public key and RW signature regions to make
sure all keys up to RSA-8192 can be used.

BRANCH=none
BUG=chrome-os-partner:62321
TEST=make -j
TEST=./build/futility/futility --debug show \
                    --pubkey hammer.vbpubk2 hammer.bin
TEST=./build/futility/futility --debug show hammer.bin
TEST=cp hammer.bin hammer.bin.orig
     ./build/futility/futility --debug sign \
       --prikey hammer.vbprik2 hammer.bin
     diff hammer.bin hammer.bin.orig => identical
TEST=openssl genrsa -3 -out hammer2.pem 2048
     futility create --desc="Hammer 2nd key" hammer2.pem \
       hammer2
     ./build/futility/futility --debug sign \
       --version 2 --prikey hammer2.vbprik2 hammer.bin
     These 2 commands succeed, but show different keys:
     ./build/futility/futility --debug show hammer.bin
     ./build/futility/futility --debug show hammer.bin.orig
TEST=make runtests

Change-Id: I2cebc421eaf97d1b92c9a58afc238d41487d0f6d
Reviewed-on: https://chromium-review.googlesource.com/445536
Commit-Ready: Nicolas Boichat <drinkcat@chromium.org>
Tested-by: Nicolas Boichat <drinkcat@chromium.org>
Reviewed-by: Randall Spangler <rspangler@chromium.org>
Reviewed-by: Vincent Palatin <vpalatin@chromium.org>

3 files changed, 17 insertions, 9 deletions

diff --git a/tests/futility/data/hammer_dev.bin b/tests/futility/data/hammer_dev.bin
new file mode 100755
index 00000000..d124fb6b
--- /dev/null
+++ b/tests/futility/data/hammer_dev.bin
diff --git a/tests/futility/run_test_scripts.sh b/tests/futility/run_test_scripts.sh
index b817c430..15a2580c 100755
--- a/tests/futility/run_test_scripts.sh
+++ b/tests/futility/run_test_scripts.sh
@@ -46,9 +46,9 @@ ${SCRIPTDIR}/test_dump_fmap.sh
 ${SCRIPTDIR}/test_gbb_utility.sh
 ${SCRIPTDIR}/test_load_fmap.sh
 ${SCRIPTDIR}/test_main.sh
+${SCRIPTDIR}/test_rwsig.sh
 ${SCRIPTDIR}/test_show_contents.sh
 ${SCRIPTDIR}/test_show_kernel.sh
-${SCRIPTDIR}/test_show_rwsig.sh
 ${SCRIPTDIR}/test_show_vs_verify.sh
 ${SCRIPTDIR}/test_show_usbpd1.sh
 ${SCRIPTDIR}/test_sign_firmware.sh
diff --git a/tests/futility/test_show_rwsig.sh b/tests/futility/test_rwsig.sh
index 915842d6..efdb6dbb 100755
--- a/tests/futility/test_show_rwsig.sh
+++ b/tests/futility/test_rwsig.sh
@@ -12,8 +12,7 @@ cd "$OUTDIR"
 DATADIR="${SCRIPTDIR}/data"
 TESTKEYS=${SRCDIR}/tests/testkeys
 
-# Do not test 8192 as the signature length is > 1024 bytes
-SIGS="1024 2048 4096 2048_exp3"
+SIGS="1024 2048 2048_exp3 4096 8192"
 HASHES="SHA1 SHA256 SHA512"
 
 set -o pipefail
@@ -24,20 +23,29 @@ for s in $SIGS; do
     for h in $HASHES; do
         pemfile=${TESTKEYS}/key_rsa${s}.pem
         outfile=${TMP}.${s}_${h}.new
-        infile=${DATADIR}/random_noise.bin
+        infile=${DATADIR}/hammer_dev.bin
         outkeys=${TMP}.${s}_${h}
-        outsig=${TMP}.${s}_${h}.signature
+        outfile=${TMP}.${s}_${h}.bin
 
         ${FUTILITY} create --desc "Test key" --hash_alg ${h} \
                     ${pemfile} ${outkeys}
 
+        # The input file should be correctly signed to start with
+        ${FUTILITY} show --type rwsig ${infile}
+
+        # Using the wrong key to verify it should fail
+        if ${FUTILITY} show --type rwsig --pubkey ${outkeys}.vbpubk2 \
+                       ${infile}; then
+            exit 1
+        fi
+
+        cp ${infile} ${outfile}
+
         ${FUTILITY} sign --type rwsig --prikey ${outkeys}.vbprik2 \
-                ${infile} ${outsig}
-        dd if=/dev/zero bs=$((4096 + 1024)) count=1 of=${outfile}
-        dd if=${infile} of=${outfile} conv=notrunc
-        dd if=${outsig} of=${outfile} bs=4096 seek=1 conv=notrunc
+                --version 2 ${outfile}
 
         ${FUTILITY} show --type rwsig --pubkey ${outkeys}.vbpubk2 ${outfile}
+        ${FUTILITY} show --type rwsig ${outfile}
     done
 done