summaryrefslogtreecommitdiff
path: root/futility/cmd_sign.c
Commit message (Collapse)AuthorAgeFilesLines
* Rewrite algorithm type parsers and make them globally availableJulius Werner2020-04-061-5/+8
| | | | | | | | | | | | | | | | | | | | | There is some code strewn around between futility and the vb21-specific part of hostlib to allow parsing of textual algorithm names to vboot enums, but it is somewhat disorganized and not written in a super efficient way. This patch rewrites it and centralizes all the algorithm mapping stuff under 2crypto.c so it can be a single source of truth for all of vboot. (String parsing routines still need to stay in hostlib since not all firmware targets support things like stroul() and strcasecmp().) BRANCH=None BUG=None TEST=make runtests Signed-off-by: Julius Werner <jwerner@chromium.org> Change-Id: I719b2499992a6e4395a29231bc8b9a7680c5b174 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/2099447 Reviewed-by: Joel Kitching <kitching@chromium.org> Commit-Queue: Joel Kitching <kitching@chromium.org>
* vboot: move vboot 2.1 functions and structs into host codeJoel Kitching2020-02-111-3/+3
| | | | | | | | | | | | | | | | | | These structs and functions need to stick around for futility to use, but they are no longer supported in firmware code. Rename host/lib21/include/* files to end in 21 instead of 2. BUG=b:124141368, chromium:968464 TEST=make clean && make runtests BRANCH=none Change-Id: I01e181e2f03553d60724fbdc826f5ada63777303 Cq-Depend: chromium:1969172 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/1963621 Reviewed-by: Julius Werner <jwerner@chromium.org> Tested-by: Joel Kitching <kitching@chromium.org> Commit-Queue: Joel Kitching <kitching@chromium.org>
* Reland: Clean up implicit fall through.Manoj Gupta2020-02-011-1/+1
| | | | | | | | | | | | | | | | Directly use the __attribute__ ((fallthrough)) instead of a macro. This was suggested in CL:1772474. BUG=chromium:997709 TEST=CQ BRANCH=None Change-Id: Ifcdcd3822eddea41aeb88f4a55bd09aa483f6054 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/2031766 Tested-by: Manoj Gupta <manojgupta@chromium.org> Reviewed-by: Julius Werner <jwerner@chromium.org> Commit-Queue: Manoj Gupta <manojgupta@chromium.org>
* Enable format string warnings for vb2ex_printf()stabilize-12859.BJulius Werner2020-01-251-1/+1
| | | | | | | | | | | | | | | | | | | This patch enables the -Wformat warning and tags vb2ex_printf() with the appropriate attribute so the compiler recognizes it as a printf variant. This shows a bunch of (sometimes pretty bad) issues in existing code that are hereby fixed. Cannot enable -Wformat-security yet since a lot of code still uses non-constant format strings and it's unclear whether we can/want to change that in all circumstances (e.g. stuff like DoError()). BRANCH=None BUG=None TEST=make runtests Change-Id: I917a4982a97a668a5c0f793f7c771573f2bd3949 Signed-off-by: Julius Werner <jwerner@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/2013857
* vboot: fix up some host key functions for host_key2.cfactory-excelsior-12812.BJoel Kitching2019-12-251-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | Deprecate: PublicKeyInit --> vb2_init_packed_key PublicKeyCopy --> vb2_copy_packed_key Rename: packed_key_looks_ok --> vb2_packed_key_looks_ok Move vb2_packed_key_looks_ok from host_key.c to host_key2.c. Move tests/vboot_common_tests.c to tests/vb2_host_key_tests.c. Remove firmware/lib/vboot_common.c. Remove host/lib/host_key.c. BUG=b:124141368, chromium:968464 TEST=make clean && make runtests BRANCH=none Change-Id: I627b2af0416ac69460f9860614a69cad8bdb76a7 Signed-off-by: Joel Kitching <kitching@google.com> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/1844597 Tested-by: Joel Kitching <kitching@chromium.org> Reviewed-by: Joel Kitching <kitching@chromium.org> Commit-Queue: Joel Kitching <kitching@chromium.org>
* vboot: merge vb2_struct.h into 2struct.hJoel Kitching2019-12-101-1/+0
| | | | | | | | | | | | | | | Also remove unused preamble structs in vboot_struct.h. BUG=b:124141368, chromium:968464 TEST=make clean && make runtests BRANCH=none Change-Id: I8b41f24b55eba91b1f952415eda1b532732848eb Signed-off-by: Joel Kitching <kitching@google.com> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/1844601 Tested-by: Joel Kitching <kitching@chromium.org> Reviewed-by: Julius Werner <jwerner@chromium.org> Commit-Queue: Joel Kitching <kitching@chromium.org>
* vboot: remove unnecessary vboot_common.h includesJoel Kitching2019-12-061-1/+0
| | | | | | | | | | | | | BUG=b:124141368 TEST=make clean && make runtests BRANCH=none Change-Id: I7daf97a88c71ff188c5812a30ca71d6c84823ae9 Signed-off-by: Joel Kitching <kitching@google.com> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/1844595 Tested-by: Joel Kitching <kitching@chromium.org> Commit-Queue: Joel Kitching <kitching@chromium.org> Reviewed-by: Julius Werner <jwerner@chromium.org>
* Revert "Clean up implicit fall through."Mathew King2019-11-051-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit 6a703f5b0edfdbf2eee72d59499f73585262a46f. Reason for revert: This change breaks building coreboot Original change's description: > Clean up implicit fall through. > > Directly use the __attribute__ ((fallthrough)) instead of > a macro. > This was suggested in CL:1772474. > > BUG=chromium:997709 > TEST=CQ > BRANCH=None > > Change-Id: Ic6cd417d7c735395a4b136dbb0879a6f1716da98 > Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/1897360 > Tested-by: Manoj Gupta <manojgupta@chromium.org> > Reviewed-by: Julius Werner <jwerner@chromium.org> > Commit-Queue: Manoj Gupta <manojgupta@chromium.org> Bug: chromium:997709 Change-Id: Icd0de8bcdee44d1b41f313a4f5aaba8108f734ab Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/1899735 Reviewed-by: Mathew King <mathewk@chromium.org> Reviewed-by: Julius Werner <jwerner@chromium.org> Commit-Queue: Julius Werner <jwerner@chromium.org> Tested-by: Julius Werner <jwerner@chromium.org>
* Clean up implicit fall through.Manoj Gupta2019-11-051-1/+1
| | | | | | | | | | | | | | | | Directly use the __attribute__ ((fallthrough)) instead of a macro. This was suggested in CL:1772474. BUG=chromium:997709 TEST=CQ BRANCH=None Change-Id: Ic6cd417d7c735395a4b136dbb0879a6f1716da98 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/1897360 Tested-by: Manoj Gupta <manojgupta@chromium.org> Reviewed-by: Julius Werner <jwerner@chromium.org> Commit-Queue: Manoj Gupta <manojgupta@chromium.org>
* vboot: format hex numbers with %#x instead of 0x%xJoel Kitching2019-10-231-5/+5
| | | | | | | | | | | | | | | | Also standardize on using hex for printing ASCII key values across vboot_ui.c and vboot_ui_menu.c. BUG=b:124141368 TEST=make clean && make runtests BRANCH=none Change-Id: Ib10288d95e29c248ebe807d99108aea75775b155 Signed-off-by: Joel Kitching <kitching@google.com> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/1840191 Reviewed-by: Joel Kitching <kitching@chromium.org> Tested-by: Joel Kitching <kitching@chromium.org> Commit-Queue: Joel Kitching <kitching@chromium.org>
* vboot: fix up some more includesJoel Kitching2019-09-231-2/+2
| | | | | | | | | | | | | | | | Should have no extra line breaks in between local includes, and should be sorted alphabetically. BUG=b:124141368 TEST=make clean && make runtests BRANCH=none Change-Id: I83c25d30d7376712857314965a7d93f57190aa3f Signed-off-by: Joel Kitching <kitching@google.com> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/1776281 Tested-by: Joel Kitching <kitching@chromium.org> Commit-Queue: Joel Kitching <kitching@chromium.org> Reviewed-by: Julius Werner <jwerner@chromium.org>
* Fix fall through warning reported by ToT clang.Manoj Gupta2019-08-281-1/+1
| | | | | | | | | | | | | | | | | | | | Clang is diagnosing implicit fallthrough in C code past https://reviews.llvm.org/rL369414. Detect the support for the fallthrough attributes in gcc/clang and enable it as VBOOT_FALLTHROUGH (copied from boringssl). This is needed to fix ToT clang builds. Note: GCC apparently does not diagnose fallthrough to another case with break but clang does (https://gcc.gnu.org/bugzilla/show_bug.cgi?id=91432). And clang does not detect the fallthrough based on code comments. Bug: chromium:997709 Test: CQ Change-Id: Id8b4be4deabca2d0f1b2efd80efa72a485a5dc8c Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/1772474 Tested-by: Manoj Gupta <manojgupta@chromium.org> Reviewed-by: Patrick Georgi <pgeorgi@chromium.org> Commit-Queue: Manoj Gupta <manojgupta@chromium.org>
* vboot: fix up some headers, includes, comments, spacingJoel Kitching2019-08-281-2/+2
| | | | | | | | | | | | | BUG=b:124141368 TEST=make clean && make runtests BRANCH=none Change-Id: Id97f544da845f7070555e5e8cc6e782b2d45c300 Signed-off-by: Joel Kitching <kitching@google.com> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/1758151 Tested-by: Joel Kitching <kitching@chromium.org> Reviewed-by: Joel Kitching <kitching@chromium.org> Commit-Queue: Joel Kitching <kitching@chromium.org>
* vboot/futility: update fatal errors to use FATALJoel Kitching2019-07-221-3/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | Previously, a mix of: - DIE - Fatal (customly defined in cmd_vbutil_kernel.c) - VbExError ... were all used to print an error message and exit. In the case of futility, standardize on using the FATAL macro defined in futility.h. BUG=b:124141368 TEST=Check that FATAL works correctly: $ build/futility/futility vbutil_key --in a --out a --algorithm 18 FATAL: do_vbutil_key: Unknown option TEST=make clean && make runtests BRANCH=none Change-Id: I97ca1153dc36e7208c69185883518c52d5d75293 Signed-off-by: Joel Kitching <kitching@google.com> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/1679799 Commit-Queue: Joel Kitching <kitching@chromium.org> Tested-by: Joel Kitching <kitching@chromium.org> Reviewed-by: Randall Spangler <rspangler@chromium.org> Reviewed-by: Julius Werner <jwerner@chromium.org>
* vboot: move vb2_packed_key and several functions from lib20 to 2libJoel Kitching2019-06-071-0/+1
| | | | | | | | | | | | | | | | | | | * Move vb2_packed_key from vb2_struct.h to 2struct.h * Move vb2_verify_member_inside from lib20/common.c to 2common.c * Move vb2_packed_key_data and vb2_verify_packed_key_inside from lib20/packed_key.c to 2packed_key.c * Relocate tests accordingly BUG=b:124141368, chromium:968464 TEST=make clean && make runtests BRANCH=none Change-Id: I6a9338ffdb640aad071941c3768427e15cd2aa93 Signed-off-by: Joel Kitching <kitching@google.com> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/1642773 Tested-by: Joel Kitching <kitching@chromium.org> Reviewed-by: Julius Werner <jwerner@chromium.org> Commit-Queue: Joel Kitching <kitching@chromium.org>
* vboot: deprecate v1 GoogleBinaryBlockHeader structJoel Kitching2019-05-171-1/+0
| | | | | | | | | | | | | | | | | Deprecate internal usage of GoogleBinaryBlockHeader struct in favour of vb2_gbb_header struct. Keep the v1 struct around until we remove references in other repos. BUG=b:124141368, chromium:954774 TEST=make clean && make runtests BRANCH=none Change-Id: I396d2e624bd5dcac9c461cc86e8175e8f7692d26 Signed-off-by: Joel Kitching <kitching@google.com> Reviewed-on: https://chromium-review.googlesource.com/1583826 Commit-Ready: Joel Kitching <kitching@chromium.org> Tested-by: Joel Kitching <kitching@chromium.org> Reviewed-by: Joel Kitching <kitching@chromium.org>
* Makefile: Enable more warnings for host utilities / testsJulius Werner2019-05-141-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds a bunch of more warnings that are already enabled in coreboot and thus already enabled for firmware builds anyway (because coreboot just passes its CFLAGS through). Enabling it in the vboot Makefile means they also apply to host utilities and tests, which sounds desirable for consistency. Fix enough of the cruft and bad coding practices that accumulated over the years of not having warnings enabled to get it to build again (this includes making functions static, removing dead code, cleaning up prototypes, etc.). Also remove -fno-strict-aliasing from the x86 firmware build options, because it's not clear why it's there (coreboot isn't doing this, so presumably it's not needed). BRANCH=None BUG=None TEST=make runtests Change-Id: Ie4a42083c4770a4eca133b22725be9ba85b24184 Signed-off-by: Julius Werner <jwerner@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/1598721 Commit-Ready: ChromeOS CL Exonerator Bot <chromiumos-cl-exonerator@appspot.gserviceaccount.com>
* futility: Merge Debug() into VB2_DEBUG()Julius Werner2019-03-061-13/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Futility has two debug facilities: the Debug() function that can be enabled by passing --debug on the command line, and the VB2_DEBUG() macro (mostly in common code from the firmware/ directory that it includes) which can only be enabled by passing DEBUG=1 at build time. This is confusing and inconvenient, since you don't always want to rebuild futility whenever you need that extra debug output and it's not very obvious that you can get even more debugging beyond just passing --debug. This patch resolves the inconsistency by merging both facilities together into a single VB2_DEBUG() that is output when passing --debug. In order to make this work, we'll have to move the VBOOT_DEBUG #define so that it only affects the stub implementation of vb2ex_printf(), and any caller overriding the stub is in charge of their own destiny. This should be okay since callers can still individually implement debugging policy in their versions of vb2ex_printf() if they want to. (This may have been useful to cut down the binary space for debugging strings, but our firmware has always been unconditionally enabling VBOOT_DEBUG in the past years, so that doesn't seem to be very important in practice.) BRANCH=None BUG=None TEST=Ran futility --debug show, noticed I got all the extra keyblock verification debug output I always wanted. Change-Id: I9a5c205fc3673941b50f03f2a967b1be110a1555 Signed-off-by: Julius Werner <jwerner@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/1504140 Commit-Ready: ChromeOS CL Exonerator Bot <chromiumos-cl-exonerator@appspot.gserviceaccount.com> Reviewed-by: Hung-Te Lin <hungte@chromium.org> Reviewed-by: Randall Spangler <rspangler@chromium.org>
* vboot: bulk fix tabs and spacing inconsistencyJoel Kitching2018-08-031-13/+13
| | | | | | | | | | | | | | | | | | | Problem files were found with: find . -name '*.c' -o -name '*.h' | xargs grep '^ [^*]' and edited manually. Ignores utility/ and cgpt/, since they seem to globally adhere to a two-space tab convention. BUG=None TEST=make clean runtests TEST=emerge vboot_reference depthcharge Change-Id: I5a678484a119c8f1911f717e1968bdb4f1a0810f Reviewed-on: https://chromium-review.googlesource.com/1160131 Commit-Ready: Joel Kitching <kitching@chromium.org> Tested-by: Joel Kitching <kitching@chromium.org> Reviewed-by: Randall Spangler <rspangler@chromium.org>
* futility: Make rwsig sign command produce EC_RW imageDaisuke Nojiri2017-09-091-4/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | This change makes futility write out a EC_RW image to the filesystem. It also allows the command to run without '--prikey' option. When a private key isn't provided, the command copies the previous signature. This can be used to extract EC_RW without changing the key or the signature. Since data only mode doesn't have a previous signature, the command returns error if '--prikey' isn't specified (as done before). BUG=b:65027647 BRANCH=none TEST=Run futility as follows futility sign --type rwsig ec.RW.flat ec.RW.sig (Missing key error, expected) futility sign --type rwsig ec.bin (EC_RW.bin is produced) futility sign --type rwsig EC_RW.bin futility sign --type rwsig --prikey key.vbprik2 ec.RW.flat ec.RW.sig futility sign --type rwsig --prikey key.vbprik2 ec.bin (EC_RW.bin is produced) futility sign --type rwsig --prikey key.vbprik2 EC_RW.bin make runfutiltests Change-Id: I8c1e0cef147967cfd6d28aa7272b88c03e109e0d Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/647804 Reviewed-by: Randall Spangler <rspangler@chromium.org>
* futility: Make help text for sign-rwsig accurateDaisuke Nojiri2017-09-051-3/+10
| | | | | | | | | | | | | | | | This patch updates the help text for futility sign --type rwsig command. The change describes what FMAP regions are required. It also names each mode (data only, data+signature, key+data+signature) and explains how each mode is selected. BUG=b:65027647 BRANCH=none TEST=Run futility help sign rwsig Change-Id: Ib43f5396ce4f1319f4825ef85d412483bd92d18f Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/646377 Reviewed-by: Aaron Durbin <adurbin@chromium.org>
* futility: rwsig: Add support for images with FMAPNicolas Boichat2017-02-251-18/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If an FMAP is detected in the rwsig image file, use it to determine the location of: - RW region - RW signature - public key in RO region futility show uses that information to verify the signature, and futility sign uses it is correctly resign the image, and replace the public key a well. This also adds tests for this use case. hammer_dev.bin sample image uses huge RO public key and RW signature regions to make sure all keys up to RSA-8192 can be used. BRANCH=none BUG=chrome-os-partner:62321 TEST=make -j TEST=./build/futility/futility --debug show \ --pubkey hammer.vbpubk2 hammer.bin TEST=./build/futility/futility --debug show hammer.bin TEST=cp hammer.bin hammer.bin.orig ./build/futility/futility --debug sign \ --prikey hammer.vbprik2 hammer.bin diff hammer.bin hammer.bin.orig => identical TEST=openssl genrsa -3 -out hammer2.pem 2048 futility create --desc="Hammer 2nd key" hammer2.pem \ hammer2 ./build/futility/futility --debug sign \ --version 2 --prikey hammer2.vbprik2 hammer.bin These 2 commands succeed, but show different keys: ./build/futility/futility --debug show hammer.bin ./build/futility/futility --debug show hammer.bin.orig TEST=make runtests Change-Id: I2cebc421eaf97d1b92c9a58afc238d41487d0f6d Reviewed-on: https://chromium-review.googlesource.com/445536 Commit-Ready: Nicolas Boichat <drinkcat@chromium.org> Tested-by: Nicolas Boichat <drinkcat@chromium.org> Reviewed-by: Randall Spangler <rspangler@chromium.org> Reviewed-by: Vincent Palatin <vpalatin@chromium.org>
* cmd_sign/rwsig: Free sign_option.prikey in the main functionNicolas Boichat2017-02-251-0/+2
| | | | | | | | | | | | | | It's better to free it in the same function as it was allocated. BRANCH=none BUG=none TEST=make runtests Change-Id: I7a224364c4b1afce5a274b944d32fc1b7ba5db30 Reviewed-on: https://chromium-review.googlesource.com/446177 Commit-Ready: Nicolas Boichat <drinkcat@chromium.org> Tested-by: Nicolas Boichat <drinkcat@chromium.org> Reviewed-by: Vincent Palatin <vpalatin@chromium.org>
* vboot: Remove vboot1 cryptolib padding sourceRandall Spangler2016-11-061-2/+2
| | | | | | | | | | | | | | | | | The old vboot1 cryptolib hard-coded many of its padding arrays in a padding.c file. Use the equivalent vboot2 apis instead. This change is almost exclusively on the host and test side; the only firmware impact is on a single line of debug output. BUG=chromium:611535 BRANCH=none TEST=make runtests; emerge-kevin coreboot depthcharge Change-Id: If689ffd92f0255847bea2424950da4547b2c0df3 Signed-off-by: Randall Spangler <rspangler@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/400902 Reviewed-by: Daisuke Nojiri <dnojiri@chromium.org>
* vboot: use standard memcmp, memcpy, memsetRandall Spangler2016-10-231-1/+1
| | | | | | | | | | | | | | Originally, we didn't trust the firmware to provide these functions from a standard library. Now, with coreboot, we do. BUG=chromium:611535 BRANCH=none TEST=make runtests; emerge-kevin coreboot depthcharge Change-Id: I4e624c40085f2b665275a38624340b2f6aabcf11 Signed-off-by: Randall Spangler <rspangler@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/399120 Reviewed-by: Daisuke Nojiri <dnojiri@chromium.org>
* futility/host lib: Fix coverity warningsRandall Spangler2016-09-141-1/+1
| | | | | | | | | | | | | | Assorted minor code issues, which we should fix so any new errors stand out more. BUG=chromium:643769 BRANCH=none TEST=make runtests Change-Id: Ib37b45dea54bd506b519b0304300b8d192e34339 Signed-off-by: Randall Spangler <rspangler@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/382319 Reviewed-by: Daisuke Nojiri <dnojiri@chromium.org>
* futility: use vboot2 functions for kernel preambleRandall Spangler2016-09-061-12/+13
| | | | | | | | | | | | | | | Another in a long series of refactoring changes to replace old vboot1 code with its vboot2 equivalent. Futility changes only; no change to firmware. BUG=chromium:611535 BRANCH=none TEST=make runtests Change-Id: I7be813b82820674e975db13d5e540e49bdea028d Signed-off-by: Randall Spangler <rspangler@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/366057 Reviewed-by: Daisuke Nojiri <dnojiri@chromium.org>
* futility: Use vboot 2.0 APIs for public keysRandall Spangler2016-09-021-19/+19
| | | | | | | | | | | | | | This replaces calls to the old vboot 1 APIs with their vboot 2.0 equivalents. BUG=chromium:611535 BRANCH=none TEST=make runtests Change-Id: Ieb1a127577c6428c47ac088c3aaa0d0dad6275a8 Signed-off-by: Randall Spangler <rspangler@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/356541 Reviewed-by: Daisuke Nojiri <dnojiri@chromium.org>
* futility: Use vboot 2.0 APIs for private keysRandall Spangler2016-08-101-24/+8
| | | | | | | | | | | | | | This replaces calls to the vboot 1 host library with their vboot 2.0 equivalents. BUG=chromium:611535 BRANCH=none TEST=make runtests Change-Id: Id061554fd82ea3efe35d0fe1485693b47599a863 Signed-off-by: Randall Spangler <rspangler@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/356540 Reviewed-by: Daisuke Nojiri <dnojiri@chromium.org>
* futility: Use only vboot 2.0 APIs for keyblocksRandall Spangler2016-08-101-14/+20
| | | | | | | | | | | | | | This refactors futility and the host library to use only vboot 2.0 APIs to create and verify keyblocks. BUG=chromium:611535 BRANCH=none TEST=make runtests Change-Id: Ia3cc1e24971b94f01bcb4890c8666a3af6f84841 Signed-off-by: Randall Spangler <rspangler@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/356129 Reviewed-by: Daisuke Nojiri <dnojiri@chromium.org>
* futility: Create signatures using vboot 2.0 APIsstabilize-8688.BRandall Spangler2016-08-031-12/+31
| | | | | | | | | | | | | Refactor futility to use only vboot 2.0 APIs to create signatures. BUG=chromium:611535 BRANCH=none TEST=make runtests Change-Id: I176e7f424fa556d34d8fe691df5681f1e43210ce Signed-off-by: Randall Spangler <rspangler@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/356128 Reviewed-by: Daisuke Nojiri <dnojiri@chromium.org>
* vboot: Disambiguate vb2.1 structs and functionsRandall Spangler2016-07-261-5/+5
| | | | | | | | | | | | | | | | | | | | | | | Futility needs to link against both vboot1/vboot2.0 and vboot2.1 functions. This was easy in the past because it did (vboot1 + vboot2.1) and there's no overlap. In replacing vboot1 function calls and structs with vboot2.0, now there are symbol collisions between vboot2.0 and vboot2.1. For example, both of them use a struct called vb2_signature, but the structs are defined differently. Functions which operate on those structs also overload. Rename the vb2.1 structs to start with vb21_ instead of vb2_. Do the same for vb2.1 functions which operate on vb2.1 data. BUG=chromium:611535 BRANCH=none TEST=make runtests Change-Id: I24defd87cbd9ef64239faf1a8e98ab2372d27539 Signed-off-by: Randall Spangler <rspangler@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/347458 Reviewed-by: Daisuke Nojiri <dnojiri@google.com>
* futility: Revised support for RO+RW firmwareBill Richardson2015-10-151-58/+42
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The "rwsig" type is used for independent device firmware (not Chromebook BIOS) that need to verify themselves instead of using software sync. The expected use case is that a RO firmware contains a vb2_public_key struct along with an FMAP or other pointers to a slot for RW firmware. The RW firmware slot reserves room for a vb2_signature struct. This CL changes the args and behavior of the rwsig type, so that the RW firmware can be [re]signed independently of the rest of the image. BUG=chrome-os-partner:46254 BRANCH=smaug,ToT TEST=make runtests, manual Create a keypair: futility create --desc "Key One" tests/testkeys/key_rsa2048.pem foo Sign a RW binary and build a complete image out of the parts: futility sign --type rwsig --prikey foo.vbprik2 rw.bin sig.bin dd if=/dev/zero bs=65536 count=1 of=image.bin dd if=rw.bin of=image.bin conv=notrunc dd if=sig.bin bs=$((65536 - 1024)) seek=1 of=image.bin conv=notrunc Verify both the separate parts and the combined image: futility show --type rwsig --pubkey foo.vbpubk2 rw.bin sig.bin futility show --type rwsig --pubkey foo.vbpubk2 image.bin Re-sign the combined image with a different keypair: futility create --desc "Key Two" tests/testkeys/key_rsa1024.pem bar futility sign --type rwsig --prikey bar.vbprik2 image.bin Now the first key no longer verifies: futility show --type rwsig --pubkey foo.vbpubk2 image.bin But the second key does: futility show --type rwsig --pubkey bar.vbpubk2 image.bin Change-Id: Ifdddab08f218f506eb1dce28851b153d70140a7b Signed-off-by: Bill Richardson <wfrichar@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/305980 Tested-by: Vincent Palatin <vpalatin@chromium.org> Reviewed-by: Vincent Palatin <vpalatin@chromium.org>
* futility: Support for signing RO+RW firmwarestabilize-smaug-7547.BBill Richardson2015-10-131-2/+83
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This adds the "rwsig" type, with initial support for RO+RW firmware images that need to verify themselves instead of using software sync. This uses our vb2 structs instead of raw binary blobs. That will help us locate, identify, and verify the keys and signatures in the signed firmware images. BUG=chrome-os-partner:46254 BRANCH=smaug,ToT TEST=make runtests I also hacked up a test board with the EC-side signature verification routines from a preliminary CL and tested this signing scheme with that. It works. Additional work is needed to make this seamless, but you can try it out like so: futility create ./tests/testkeys/key_rsa2048.pem foo futility sign --type rwsig --prikey foo.vbprik2 --pubkey foo.vbpubk2 ec.bin Change-Id: I876ab312a2b0b36411c5f739fe3252529728d034 Signed-off-by: Bill Richardson <wfrichar@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/305394 Reviewed-by: Randall Spangler <rspangler@chromium.org>
* futility: add support for usbpd1 imagesBill Richardson2015-03-311-31/+131
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The USB Type-C chargers released with Samus ("Pixel (2015)") have upgradable firmware. Those firmware images are currently signed by some custom scripts. This adds support for those images to futility, so that those custom scripts can be replaced. Note that due to space considerations, the usbpd firmware images don't have room for handy things like an FMAP or headers for the signatures. Accordingly, all the normally variable factors (image size, signature algorithms, etc.) are hard coded and the image itself just looks like a bunch of random numbers. Because of this: 1. There's no way to recognize this type of file, and nothing to display about it. 2. You have to give the "--type usbpd1" arg to the sign command. 3. I'm designating this file type "v1" because I hope that the firmware for any future adapters will be more readily identifiable. BUG=chromium:231574 BRANCH=none TEST=make runtests This adds a new test that signs usbpd1 firmware images using futility, and compares the result to the same files signed by the custom scripts, ensuring that they are bitwise identical. Signed-off-by: Bill Richardson <wfrichar@chromium.org> Change-Id: Idbe061db5b3c8e474ada47b40bcbe04bbecdba3a Reviewed-on: https://chromium-review.googlesource.com/262899 Reviewed-by: Randall Spangler <rspangler@chromium.org>
* futility: put all the BIOS stuff into a separate fileBill Richardson2015-03-311-286/+1
| | | | | | | | | | | | | | | | This moves the functions that handle BIOS file types into a separate set of source files. BIOSes are constructed from other components arranged in particular ways, so they shouldn't be mixed in with the code specifically for those components. BUG=chromium:231574 BRANCH=none TEST=make runtests Signed-off-by: Bill Richardson <wfrichar@chromium.org> Change-Id: I15c3fec61498925f9b8c672092fd97e7ea2d90e9 Reviewed-on: https://chromium-review.googlesource.com/262898 Reviewed-by: Randall Spangler <rspangler@chromium.org>
* futility: cleanup help functions for sign commandBill Richardson2015-03-311-33/+49
| | | | | | | | | | | | | Just rearranging some internal functions and args. BUG=none BRANCH=none TEST=make runtests Signed-off-by: Bill Richardson <wfrichar@chromium.org> Change-Id: Ib7d3ab358543c549c670b1cd2715f1b670da2001 Reviewed-on: https://chromium-review.googlesource.com/262897 Reviewed-by: Randall Spangler <rspangler@chromium.org>
* futility: export options for the sign and show commandsBill Richardson2015-03-311-191/+182
| | | | | | | | | | | | | | | | | | | | This declares the options for the sign and show commands in a header file. We want to split the code for logically separate file types into separate source files, but we don't want to have multiple option-parsing routines, so that we can be sure we're using the same option names consistently (for example, --hash_alg always takes the same args and means the same thing). BUG=chromium:231574 BRANCH=none TEST=make runtests Signed-off-by: Bill Richardson <wfrichar@chromium.org> Change-Id: I939bd19ba199b4c44eb41cff3571cff88df9a181 Reviewed-on: https://chromium-review.googlesource.com/262896 Reviewed-by: Randall Spangler <rspangler@chromium.org>
* futility: add --type arg to show and sign commandsBill Richardson2015-03-311-9/+22
| | | | | | | | | | | | | | | | | This allows the user to manually specify the type of an input file, since not all file types can be reliably identified. This also adds a test to ensure that futility doesn't coredump if you give it the wrong type (although I'm sure it's not exhaustive). BUG=chromium:231574 BRANCH=none TEST=make runtests Signed-off-by: Bill Richardson <wfrichar@chromium.org> Change-Id: I9d909305d9989fe7299e744c585de380109cf8cd Reviewed-on: https://chromium-review.googlesource.com/262895 Reviewed-by: Randall Spangler <rspangler@chromium.org>
* futility: refactor to handle each file type individuallyBill Richardson2015-03-311-109/+135
| | | | | | | | | | | | | | | | | | | | | | Instead of calling futil_traverse() to iterate through a preset list of functions, this establishes a separate show() and sign() function for each type of file. The only significant change is that walking through the FMAP areas within BIOS images is done in BIOS-specific functions instead of that being the "normal" case with every other type of file skipping that traversal. This is a refactoring only. There is no externally visible change. BUG=chromium:231574 BRANCH=none TEST=make runtests Signed-off-by: Bill Richardson <wfrichar@chromium.org> Change-Id: I7080afb43e35308c8bb618793c8382c2efb3d6a1 Reviewed-on: https://chromium-review.googlesource.com/262894 Reviewed-by: Randall Spangler <rspangler@chromium.org>
* futility: Split help for "sign" command into partsBill Richardson2015-03-201-30/+69
| | | | | | | | | | | | | | | | | | | | | The help message for the sign command is much too long. This breaks it into several subcategories. BUG=none BRANCH=none TEST=make runtests futility help sign futility help sign pubkey futility help sign fwblob futility help sign bios futility help sign vmlinuz futility help sign kernel Change-Id: I3e12b2cfdfb17a77c171f925a53748efb1d6c440 Signed-off-by: Bill Richardson <wfrichar@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/260496 Reviewed-by: Randall Spangler <rspangler@chromium.org>
* futility: Let each command provide its own helpBill Richardson2015-03-181-4/+8
| | | | | | | | | | | | | | | | | | | Instead of a separate help function for each command, let's just require each command to handle a --help option. This will make it easier to layer the commands (for example, "sign" could have several subcommand variants, each with its own help). BUG=none BRANCH=none TEST=make runtests I also compared the result of running "futility help CMD" before and after this change. The help still shows up correctly. Change-Id: I5c58176f32b41b0a2c2b8f0afb17dddd80fddc70 Signed-off-by: Bill Richardson <wfrichar@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/260495 Reviewed-by: Randall Spangler <rspangler@chromium.org>
* futility: change longhelp functions to take multiple argsBill Richardson2015-03-181-4/+4
| | | | | | | | | | | | | | | | | | Some of the help messages are getting pretty long. We should allow each command to provide additional help details only when asked. BUG=none BRANCH=none TEST=make runtests I also compared the help messages for all commands, both before and after this change to ensure that nothing was different. Change-Id: Ibe92ec80f99d286886fe020c9d826a5a05556471 Signed-off-by: Bill Richardson <wfrichar@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/260494 Reviewed-by: Randall Spangler <rspangler@chromium.org>
* Provert "futility: Make --debug a global option"Bill Richardson2015-03-121-1/+0
| | | | | | | | | | | | | | | | This reverts commit d90b07bd4daa0c1cff7d78b733ef2bb759cc6e5a, which reverted d7e1e4f0befdda52ad48e5a8eb5fc49dbee40247, which didn't actually have anything wrong with it. BUG=chromium:466433 BRANCH=one TEST=None Change-Id: I68a60c38eba1fce1c9332601a57ea8fee72139a3 Signed-off-by: Bill Richardson <wfrichar@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/259650 Reviewed-by: Randall Spangler <rspangler@chromium.org> Reviewed-by: Prathmesh Prabhu <pprabhu@chromium.org>
* Revert "futility: Make --debug a global option"Prathmesh Prabhu2015-03-121-0/+1
| | | | | | | | | | | | This reverts commit d7e1e4f0befdda52ad48e5a8eb5fc49dbee40247. BUG=chromium:466433 TEST=None. Change-Id: Ia1b300e2dbccddbbae9e831709bc49eb53a5feb8 Reviewed-on: https://chromium-review.googlesource.com/259365 Reviewed-by: David James <davidjames@chromium.org> Tested-by: Prathmesh Prabhu <pprabhu@chromium.org>
* futility: Make --debug a global optionBill Richardson2015-03-111-1/+0
| | | | | | | | | | | | | | | Some commands look for a --debug option, others don't. The feature is implemented globally, so let's parse it as a global option. BUG=none BRANCH=none TEST=make runtests Change-Id: I3b169e4a1b93443786913276651113d1c915a834 Signed-off-by: Bill Richardson <wfrichar@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/258500 Reviewed-by: Randall Spangler <rspangler@chromium.org>
* futility: Add global args to specify vboot API and formatstabilize-6842.Bstabilize-6835.BBill Richardson2015-02-281-0/+1
| | | | | | | | | | | | | | | | | | | | | | The host-side futility tool will need to support all extant vboot implementations. Some legacy futility commands only support the original vb1 format, but others ("show" or "sign", for example) may need to be instructed which formats to expect or emit. This change adds some global args to specify the preferred formats. It also cleans up a few [unused AFAICT] one-letter args to avoid conflicts. BUG=chromium:231574 BRANCH=none TEST=make runtests Nothing makes use of this yet, except the "help" command. Change-Id: Ib79fa12af72b8860b9494e5d9e90b9572c006107 Signed-off-by: Bill Richardson <wfrichar@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/246765 Reviewed-by: Randall Spangler <rspangler@chromium.org>
* kernel flags: Add flags field to kernel preamble.Furquan Shaikh2015-02-121-3/+11
| | | | | | | | | | | | | | | | | | | | | | 1. Increase kernel preamble revision from 2.1 to 2.2. 2. Add flags field to kernel preamble. 3. Update futility to accept flags parameter for vbutil_kernel and cmd_sign for kernel. 4. Pass in an extra flags field to SignKernelBlob and CreateKernelPreamble. BUG=chrome-os-partner:35861 BRANCH=None TEST=1) "make runalltests" completes successfully. 2) vboot_reference compiles successfully for ryu. 3) Verified flags field in header using futility show. Change-Id: If9f06f98778a7339194c77090cbef4807d5e34e2 Signed-off-by: Furquan Shaikh <furquan@google.com> Reviewed-on: https://chromium-review.googlesource.com/245950 Tested-by: Furquan Shaikh <furquan@chromium.org> Reviewed-by: Randall Spangler <rspangler@chromium.org> Commit-Queue: Furquan Shaikh <furquan@chromium.org>
* futility: refactor file type detection into new filesBill Richardson2015-01-311-2/+11
| | | | | | | | | | | | | | | | This moves the what-kind-of-file-is-this logic into a separate file, and makes it work by calling distinct recognizers until one hits. A new "-t" option to the show command prints what it's doing. BUG=chromium:228932 BRANCH=ToT TEST=make runtests Change-Id: Id8f60bdf3fe6a9adf41b4555b3448a261fa52fea Signed-off-by: Bill Richardson <wfrichar@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/245122 Reviewed-by: Randall Spangler <rspangler@chromium.org>
* futility: Don't copy the entire kernel partition just to sign a blobBill Richardson2014-12-041-29/+34
| | | | | | | | | | | | | | | | | | When re-signing a kernel partition and writing the result into a new file, make sure we only emit the vblock and kernel blob instead of creating a new file that's the size of the entire partition. Also add a test for that. BUG=chromium:418647 BRANCH=none TEST=make runtests Signed-off-by: Bill Richardson <wfrichar@chromium.org> Change-Id: I2c42aec6816e7e7abbeed360089c9b51fdcfe786 Reviewed-on: https://chromium-review.googlesource.com/233039 Reviewed-by: Randall Spangler <rspangler@chromium.org>
View Lorry Controller Status