vboot2: Add api-level functions to use new data structures

And associated unit tests.

And fix a memory overwrite in the old vb_api_tests.c, which apparently
didn't touch a critical piece of the shared work buffer, but was still
wrong.  (This was a problem in the test, not in the code being
tested.)

BUG=chromium:423882
BRANCH=none
TEST=VBOOT2=1 make runtests

Change-Id: I322fb7e6bb5214b0adcf5d6d48a0cd238abba88e
Signed-off-by: Randall Spangler <rspangler@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/229738
Reviewed-by: Bill Richardson <wfrichar@chromium.org>

Makefile

@@ -282,6 +282,7 @@ VBSLK_SRCS = \
 # Firmware library source needed for smaller library 2
 FWLIB2_SRCS = \
 	firmware/2lib/2api.c \
+	firmware/2lib/2api2.c \
 	firmware/2lib/2common.c \
 	firmware/2lib/2common2.c \
 	firmware/2lib/2crc8.c \
@@ -633,6 +634,7 @@ endif
 ifneq (${VBOOT2},)
 TEST_NAMES += \
 	tests/vb2_api_tests \
+	tests/vb2_api2_tests \
 	tests/vb2_common_tests \
 	tests/vb2_common2_tests \
 	tests/vb2_common3_tests \
@@ -936,7 +938,7 @@ tests: ${TEST_BINS}
 
 ${TEST_BINS}: ${UTILLIB} ${TESTLIB}
 ${TEST_BINS}: INCLUDES += -Itests
-${TEST_BINS}: LIBS = ${UTILLIB} ${TESTLIB}
+${TEST_BINS}: LIBS = ${TESTLIB} ${UTILLIB}
 
 ${TESTLIB}: ${TESTLIB_OBJS}
 	@$(PRINTF) "    RM            $(subst ${BUILD}/,,$@)\n"
@@ -1170,6 +1172,7 @@ runmisctests: test_setup
 .PHONY: run2tests
 run2tests: test_setup
 	${RUNTEST} ${BUILD_RUN}/tests/vb2_api_tests
+	${RUNTEST} ${BUILD_RUN}/tests/vb2_api2_tests
 	${RUNTEST} ${BUILD_RUN}/tests/vb2_common_tests
 	${RUNTEST} ${BUILD_RUN}/tests/vb2_common2_tests ${TEST_KEYS}
 	${RUNTEST} ${BUILD_RUN}/tests/vb2_common3_tests ${TEST_KEYS}

firmware/2lib/2api2.c

@@ -0,0 +1,146 @@
+/* Copyright (c) 2014 The Chromium OS Authors. All rights reserved.
+ * Use of this source code is governed by a BSD-style license that can be
+ * found in the LICENSE file.
+ *
+ * Externally-callable APIs
+ * (Firmware portion)
+ */
+
+#include "2sysincludes.h"
+#include "2api.h"
+#include "2common.h"
+#include "2misc.h"
+#include "2nvstorage.h"
+#include "2secdata.h"
+#include "2sha.h"
+#include "2rsa.h"
+
+int vb2api_fw_phase3_2(struct vb2_context *ctx)
+{
+	int rv;
+
+	/* Verify firmware keyblock */
+	rv = vb2_load_fw_keyblock2(ctx);
+	if (rv) {
+		vb2_fail(ctx, VB2_RECOVERY_RO_INVALID_RW, rv);
+		return rv;
+	}
+
+	/* Verify firmware preamble */
+	rv = vb2_load_fw_preamble2(ctx);
+	if (rv) {
+		vb2_fail(ctx, VB2_RECOVERY_RO_INVALID_RW, rv);
+		return rv;
+	}
+
+	return VB2_SUCCESS;
+}
+
+int vb2api_init_hash2(struct vb2_context *ctx,
+		      const struct vb2_guid *guid,
+		      uint32_t *size)
+{
+	struct vb2_shared_data *sd = vb2_get_sd(ctx);
+	const struct vb2_fw_preamble2 *pre;
+	const struct vb2_signature2 *sig = NULL;
+	struct vb2_digest_context *dc;
+	struct vb2_workbuf wb;
+	uint32_t hash_offset;
+	int i;
+
+	vb2_workbuf_from_ctx(ctx, &wb);
+
+	/* Get preamble pointer */
+	if (!sd->workbuf_preamble_size)
+		return VB2_ERROR_API_INIT_HASH_PREAMBLE;
+	pre = (const struct vb2_fw_preamble2 *)
+		(ctx->workbuf + sd->workbuf_preamble_offset);
+
+	/* Find the matching signature */
+	hash_offset = pre->hash_offset;
+	for (i = 0; i < pre->hash_count; i++) {
+		sig = (const struct vb2_signature2 *)
+			((uint8_t *)pre + hash_offset);
+
+		if (!memcmp(guid, &sig->guid, sizeof(*guid)))
+			break;
+
+		hash_offset += sig->c.total_size;
+	}
+	if (i >= pre->hash_count)
+		return VB2_ERROR_API_INIT_HASH_GUID;  /* No match */
+
+	/* Allocate workbuf space for the hash */
+	if (sd->workbuf_hash_size) {
+		dc = (struct vb2_digest_context *)
+			(ctx->workbuf + sd->workbuf_hash_offset);
+	} else {
+		uint32_t dig_size = sizeof(*dc);
+
+		dc = vb2_workbuf_alloc(&wb, dig_size);
+		if (!dc)
+			return VB2_ERROR_API_INIT_HASH_WORKBUF;
+
+		sd->workbuf_hash_offset = vb2_offset_of(ctx->workbuf, dc);
+		sd->workbuf_hash_size = dig_size;
+		ctx->workbuf_used = sd->workbuf_hash_offset + dig_size;
+	}
+
+	sd->hash_tag = vb2_offset_of(ctx->workbuf, sig);
+	sd->hash_remaining_size = sig->data_size;
+
+	if (size)
+		*size = sig->data_size;
+
+	return vb2_digest_init(dc, sig->hash_alg);
+}
+
+int vb2api_check_hash2(struct vb2_context *ctx)
+{
+	struct vb2_shared_data *sd = vb2_get_sd(ctx);
+	struct vb2_digest_context *dc = (struct vb2_digest_context *)
+		(ctx->workbuf + sd->workbuf_hash_offset);
+	struct vb2_workbuf wb;
+
+	uint8_t *digest;
+	uint32_t digest_size = vb2_digest_size(dc->hash_alg);
+
+	const struct vb2_signature2 *sig;
+
+	int rv;
+
+	vb2_workbuf_from_ctx(ctx, &wb);
+
+	/* Get signature pointer */
+	if (!sd->hash_tag)
+		return VB2_ERROR_API_CHECK_HASH_TAG;
+	sig = (const struct vb2_signature2 *)(ctx->workbuf + sd->hash_tag);
+
+	/* Must have initialized hash digest work area */
+	if (!sd->workbuf_hash_size)
+		return VB2_ERROR_API_CHECK_HASH_WORKBUF;
+
+	/* Should have hashed the right amount of data */
+	if (sd->hash_remaining_size)
+		return VB2_ERROR_API_CHECK_HASH_SIZE;
+
+	/* Allocate the digest */
+	digest = vb2_workbuf_alloc(&wb, digest_size);
+	if (!digest)
+		return VB2_ERROR_API_CHECK_HASH_WORKBUF_DIGEST;
+
+	/* Finalize the digest */
+	rv = vb2_digest_finalize(dc, digest, digest_size);
+	if (rv)
+		return rv;
+
+	/* Compare with the signature */
+	if (vb2_safe_memcmp(digest, (const uint8_t *)sig + sig->sig_offset,
+			    digest_size))
+		return VB2_ERROR_API_CHECK_HASH_SIG;
+
+	// TODO: the old check-hash function called vb2_fail() on any mismatch.
+	// I don't think it should do that; the caller should.
+
+	return VB2_SUCCESS;
+}

firmware/2lib/include/2api.h

@@ -296,6 +296,11 @@ int vb2api_fw_phase2(struct vb2_context *ctx);
  */
 int vb2api_fw_phase3(struct vb2_context *ctx);
 
+/**
+ * Same, but for new-style structs.
+ */
+int vb2api_fw_phase3_2(struct vb2_context *ctx);
+
 /**
  * Initialize hashing data for the specified tag.
  *
@@ -307,9 +312,18 @@ int vb2api_fw_phase3(struct vb2_context *ctx);
  */
 int vb2api_init_hash(struct vb2_context *ctx, uint32_t tag, uint32_t *size);
 
+/**
+ * Same, but for new-style structs.
+ */
+int vb2api_init_hash2(struct vb2_context *ctx,
+		      const struct vb2_guid *guid,
+		      uint32_t *size);
+
 /**
  * Extend the hash started by vb2api_init_hash() with additional data.
  *
+ * (This is the same for both old and new style structs.)
+ *
  * @param ctx		Vboot context
  * @param buf		Data to hash
  * @param size		Size of data in bytes
@@ -327,9 +341,10 @@ int vb2api_extend_hash(struct vb2_context *ctx,
  */
 int vb2api_check_hash(struct vb2_context *ctx);
 
-int vb2api_get_kernel_subkey(struct vb2_context *ctx,
-			     uint8_t *buf,
-			     uint32_t *size);
+/**
+ * Same, but for new-style structs.
+ */
+int vb2api_check_hash2(struct vb2_context *ctx);
 
 /*****************************************************************************/
 /* APIs provided by the caller to verified boot */

firmware/2lib/include/2return_codes.h

@@ -414,6 +414,12 @@ enum vb2_return_code {
 	/* Phase one needs recovery mode */
 	VB2_ERROR_API_PHASE1_RECOVERY,
 
+	/* Bag tag in vb2api_check_hash() */
+	VB2_ERROR_API_INIT_HASH_GUID,
+
+	/* Siganature mismatch in vb2api_check_hash() */
+	VB2_ERROR_API_CHECK_HASH_SIG,
+
         /**********************************************************************
 	 * Errors which may be generated by implementations of vb2ex functions.
 	 * Implementation may also return its own specific errors, which should

firmware/2lib/include/2struct.h

@@ -611,7 +611,15 @@ struct vb2_shared_data {
 	uint32_t workbuf_hash_offset;
 	uint32_t workbuf_hash_size;
 
-	/* Current tag we're hashing */
+	/*
+	 * Current tag we're hashing
+	 *
+	 * For new structs, this is the offset of the vb2_signature2 struct
+	 * in the work buffer.
+	 *
+	 * TODO: rename to workbuf_hash_sig_offset when vboot1 structs are
+	 * deprecated.
+	 */
 	uint32_t hash_tag;
 
 	/* Amount of data we still expect to hash */

tests/vb2_api2_tests.c

@@ -0,0 +1,249 @@
+/* Copyright (c) 2014 The Chromium OS Authors. All rights reserved.
+ * Use of this source code is governed by a BSD-style license that can be
+ * found in the LICENSE file.
+ *
+ * Tests for api library, new style structs
+ */
+
+#include <stdio.h>
+
+#include "2sysincludes.h"
+#include "2api.h"
+#include "2common.h"
+#include "2misc.h"
+#include "2nvstorage.h"
+#include "2rsa.h"
+#include "2secdata.h"
+
+#include "test_common.h"
+#include "vb2_convert_structs.h"
+
+/* Common context for tests */
+static uint8_t workbuf[VB2_WORKBUF_RECOMMENDED_SIZE]
+	__attribute__ ((aligned (16)));
+static struct vb2_context ctx;
+static struct vb2_shared_data *sd;
+
+static const uint8_t mock_body[320] = "Mock body";
+static const int mock_body_size = sizeof(mock_body);
+static const int mock_algorithm = VB2_ALG_RSA2048_SHA256;
+static const int mock_hash_alg = VB2_HASH_SHA256;
+static int mock_sig_size;
+
+static const struct vb2_guid test_guid[4] = {
+	{.raw = {0x11}},
+	{.raw = {0x22}},
+	{.raw = {0x33}},
+	{.raw = {0x44}},
+};
+
+/* Mocked function data */
+static int retval_vb2_load_fw_keyblock;
+static int retval_vb2_load_fw_preamble;
+
+/* Type of test to reset for */
+enum reset_type {
+	FOR_MISC,
+	FOR_EXTEND_HASH,
+	FOR_CHECK_HASH,
+};
+
+static void reset_common_data(enum reset_type t)
+{
+	struct vb2_fw_preamble2 *pre;
+	struct vb2_signature2 *sig;
+	uint32_t sig_offset;
+
+	int i;
+
+	memset(workbuf, 0xaa, sizeof(workbuf));
+
+	memset(&ctx, 0, sizeof(ctx));
+	ctx.workbuf = workbuf;
+	ctx.workbuf_size = sizeof(workbuf);
+
+	vb2_init_context(&ctx);
+	sd = vb2_get_sd(&ctx);
+
+	vb2_nv_init(&ctx);
+
+	vb2_secdata_create(&ctx);
+	vb2_secdata_init(&ctx);
+
+	retval_vb2_load_fw_keyblock = VB2_SUCCESS;
+	retval_vb2_load_fw_preamble = VB2_SUCCESS;
+
+	sd->workbuf_preamble_offset = ctx.workbuf_used;
+	pre = (struct vb2_fw_preamble2 *)
+		(ctx.workbuf + sd->workbuf_preamble_offset);
+	pre->hash_count = 3;
+	pre->hash_offset = sig_offset = sizeof(*pre);
+
+	for (i = 0; i < 3; i++) {
+		sig = vb2_create_hash_sig(mock_body,
+					  mock_body_size - 16 * i,
+					  mock_hash_alg);
+		memcpy(&sig->guid, test_guid + i, sizeof(sig->guid));
+		memcpy((uint8_t *)pre + sig_offset, sig, sig->c.total_size);
+		sig_offset += sig->c.total_size;
+		mock_sig_size = sig->c.total_size;
+		free(sig);
+	}
+
+	sd->workbuf_preamble_size = sig_offset;
+	ctx.workbuf_used = sd->workbuf_preamble_offset
+		+ sd->workbuf_preamble_size;
+
+	if (t == FOR_EXTEND_HASH || t == FOR_CHECK_HASH)
+		vb2api_init_hash2(&ctx, test_guid, NULL);
+
+	if (t == FOR_CHECK_HASH)
+		vb2api_extend_hash(&ctx, mock_body, mock_body_size);
+};
+
+/* Mocked functions */
+
+int vb2_load_fw_keyblock2(struct vb2_context *ctx)
+{
+	return retval_vb2_load_fw_keyblock;
+}
+
+int vb2_load_fw_preamble2(struct vb2_context *ctx)
+{
+	return retval_vb2_load_fw_preamble;
+}
+
+/* Tests */
+
+static void phase3_tests(void)
+{
+	reset_common_data(FOR_MISC);
+	TEST_SUCC(vb2api_fw_phase3_2(&ctx), "phase3 good");
+
+	reset_common_data(FOR_MISC);
+	retval_vb2_load_fw_keyblock = VB2_ERROR_MOCK;
+	TEST_EQ(vb2api_fw_phase3_2(&ctx), VB2_ERROR_MOCK, "phase3 keyblock");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST),
+		VB2_RECOVERY_RO_INVALID_RW, "  recovery reason");
+
+	reset_common_data(FOR_MISC);
+	retval_vb2_load_fw_preamble = VB2_ERROR_MOCK;
+	TEST_EQ(vb2api_fw_phase3_2(&ctx), VB2_ERROR_MOCK, "phase3 keyblock");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST),
+		VB2_RECOVERY_RO_INVALID_RW, "  recovery reason");
+}
+
+static void init_hash_tests(void)
+{
+	struct vb2_fw_preamble2 *pre;
+	struct vb2_signature2 *sig;
+	int wb_used_before;
+	uint32_t size;
+
+	reset_common_data(FOR_MISC);
+	pre = (struct vb2_fw_preamble2 *)
+		(ctx.workbuf + sd->workbuf_preamble_offset);
+	sig = (struct vb2_signature2 *)((uint8_t *)pre + pre->hash_offset);
+
+	wb_used_before = ctx.workbuf_used;
+	TEST_SUCC(vb2api_init_hash2(&ctx, test_guid, &size),
+		  "init hash good");
+	TEST_EQ(sd->workbuf_hash_offset,
+		(wb_used_before + (VB2_WORKBUF_ALIGN - 1)) &
+		~(VB2_WORKBUF_ALIGN - 1),
+		"hash context offset");
+	TEST_EQ(sd->workbuf_hash_size, sizeof(struct vb2_digest_context),
+		"hash context size");
+	TEST_EQ(ctx.workbuf_used,
+		sd->workbuf_hash_offset + sd->workbuf_hash_size,
+		"hash uses workbuf");
+	TEST_EQ(sd->hash_tag,
+		sd->workbuf_preamble_offset + pre->hash_offset,
+		"hash signature offset");
+	TEST_EQ(sd->hash_remaining_size, mock_body_size, "hash remaining");
+
+	wb_used_before = ctx.workbuf_used;
+	TEST_SUCC(vb2api_init_hash2(&ctx, test_guid + 2, NULL),
+		  "init hash again");
+	TEST_EQ(ctx.workbuf_used, wb_used_before, "init hash reuses context");
+	TEST_EQ(sd->hash_tag,
+		sd->workbuf_preamble_offset + pre->hash_offset +
+		2 * mock_sig_size,
+		"hash signature offset 2");
+
+	reset_common_data(FOR_MISC);
+	TEST_EQ(vb2api_init_hash2(&ctx, test_guid + 3, &size),
+		VB2_ERROR_API_INIT_HASH_GUID, "init hash invalid guid");
+
+	reset_common_data(FOR_MISC);
+	sd->workbuf_preamble_size = 0;
+	TEST_EQ(vb2api_init_hash2(&ctx, test_guid, &size),
+		VB2_ERROR_API_INIT_HASH_PREAMBLE, "init hash preamble");
+
+	reset_common_data(FOR_MISC);
+	ctx.workbuf_used =
+		ctx.workbuf_size - sizeof(struct vb2_digest_context) + 8;
+	TEST_EQ(vb2api_init_hash2(&ctx, test_guid, &size),
+		VB2_ERROR_API_INIT_HASH_WORKBUF, "init hash workbuf");
+
+	reset_common_data(FOR_MISC);
+	sig->hash_alg = VB2_HASH_INVALID;
+	TEST_EQ(vb2api_init_hash2(&ctx, test_guid, &size),
+		VB2_ERROR_SHA_INIT_ALGORITHM, "init hash algorithm");
+}
+
+static void check_hash_tests(void)
+{
+	struct vb2_fw_preamble2 *pre;
+	struct vb2_signature2 *sig;
+	struct vb2_digest_context *dc;
+
+	reset_common_data(FOR_CHECK_HASH);
+	pre = (struct vb2_fw_preamble2 *)
+		(ctx.workbuf + sd->workbuf_preamble_offset);
+	sig = (struct vb2_signature2 *)((uint8_t *)pre + pre->hash_offset);
+	dc = (struct vb2_digest_context *)
+		(ctx.workbuf + sd->workbuf_hash_offset);
+
+	TEST_SUCC(vb2api_check_hash2(&ctx), "check hash good");
+
+	reset_common_data(FOR_CHECK_HASH);
+	sd->hash_tag = 0;
+	TEST_EQ(vb2api_check_hash2(&ctx),
+		VB2_ERROR_API_CHECK_HASH_TAG, "check hash tag");
+
+	reset_common_data(FOR_CHECK_HASH);
+	sd->workbuf_hash_size = 0;
+	TEST_EQ(vb2api_check_hash2(&ctx),
+		VB2_ERROR_API_CHECK_HASH_WORKBUF, "check hash no workbuf");
+
+	reset_common_data(FOR_CHECK_HASH);
+	sd->hash_remaining_size = 1;
+	TEST_EQ(vb2api_check_hash2(&ctx),
+		VB2_ERROR_API_CHECK_HASH_SIZE, "check hash size");
+
+	reset_common_data(FOR_CHECK_HASH);
+	ctx.workbuf_used = ctx.workbuf_size;
+	TEST_EQ(vb2api_check_hash2(&ctx),
+		VB2_ERROR_API_CHECK_HASH_WORKBUF_DIGEST, "check hash workbuf");
+
+	reset_common_data(FOR_CHECK_HASH);
+	dc->hash_alg = VB2_HASH_INVALID;
+	*((uint8_t *)sig + sig->sig_offset) ^= 0x55;
+	TEST_EQ(vb2api_check_hash2(&ctx),
+		VB2_ERROR_SHA_FINALIZE_ALGORITHM, "check hash finalize");
+
+	reset_common_data(FOR_CHECK_HASH);
+	*((uint8_t *)sig + sig->sig_offset) ^= 0x55;
+	TEST_EQ(vb2api_check_hash2(&ctx),
+		VB2_ERROR_API_CHECK_HASH_SIG, "check hash sig");
+}
+
+int main(int argc, char* argv[])
+{
+	phase3_tests();
+	init_hash_tests();
+	check_hash_tests();
+
+	return gTestSuccess ? 0 : 255;
+}

tests/vb2_api_tests.c

@@ -75,7 +75,7 @@ static void reset_common_data(enum reset_type t)
 	retval_vb2_digest_finalize = VB2_SUCCESS;
 	retval_vb2_verify_digest = VB2_SUCCESS;
 
-	sd->workbuf_preamble_offset = 8;
+	sd->workbuf_preamble_offset = cc.workbuf_used;
 	sd->workbuf_preamble_size = sizeof(*pre);
 	cc.workbuf_used = sd->workbuf_preamble_offset
 		+ sd->workbuf_preamble_size;