New tools to help debug vboot failures.

utility/vbutil_firmware.c

 /* Copyright (c) 2010 The Chromium OS Authors. All rights reserved.
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  *
  * Verified boot firmware utility
  */
 
 #include <getopt.h>
 #include <inttypes.h>  /* For PRIu64 */
 #include <stddef.h>
@@ skipping 42 matching lines @@
        "For '--vblock <file>', required OPTIONS are:\n"
        "  --keyblock <file>           Key block in .keyblock format\n"
        "  --signprivate <file>        Signing private key in .vbprivk format\n"
        "  --version <number>          Firmware version\n"
        "  --fv <file>                 Firmware volume to sign\n"
        "  --kernelkey <file>          Kernel subkey in .vbpubk format\n"
        "\n"
        "For '--verify <file>', required OPTIONS are:\n"
        "  --signpubkey <file>         Signing public key in .vbpubk format\n"
        "  --fv <file>                 Firmware volume to verify\n"
+       "\n"
+       "For '--verify <file>', optional OPTIONS are:\n"
+       "  --kernelkey <file>          Write the kernel subkey to this file\n"
        "");
   return 1;
 }
 
 
 /* Create a firmware .vblock */
 static int Vblock(const char* outfile, const char* keyblock_file,
                   const char* signprivate, uint64_t version,
                   const char* fv_file, const char* kernelkey_file) {
 
@@ skipping 77 matching lines @@
   if (i) {
     error("Can't write output file %s\n", outfile);
     unlink(outfile);
     return 1;
   }
 
   /* Success */
   return 0;
 }
 
-
 static int Verify(const char* infile, const char* signpubkey,
-                  const char* fv_file) {
+                  const char* fv_file, const char* kernelkey_file) {
 
   VbKeyBlockHeader* key_block;
   VbFirmwarePreambleHeader* preamble;
   VbPublicKey* data_key;
   VbPublicKey* sign_key;
+  VbPublicKey* kernel_subkey;
   RSAPublicKey* rsa;
   uint8_t* blob;
   uint64_t blob_size;
   uint8_t* fv_data;
   uint64_t fv_size;
   uint64_t now = 0;
 
   if (!infile || !signpubkey || !fv_file) {
     error("Must specify filename, signpubkey, and fv\n");
     return 1;
@@ skipping 25 matching lines @@
   if (0 != KeyBlockVerify(key_block, blob_size, sign_key, 0)) {
     error("Error verifying key block.\n");
     return 1;
   }
   Free(sign_key);
   now += key_block->key_block_size;
 
   printf("Key block:\n");
   data_key = &key_block->data_key;
   printf("  Size:                %" PRIu64 "\n", key_block->key_block_size);
+  printf("  Flags:               %" PRIu64 " (ignored)\n",
+         key_block->key_block_flags);
   printf("  Data key algorithm:  %" PRIu64 " %s\n", data_key->algorithm,
          (data_key->algorithm < kNumAlgorithms ?
           algo_strings[data_key->algorithm] : "(invalid)"));
   printf("  Data key version:    %" PRIu64 "\n", data_key->key_version);
-  printf("  Flags:               %" PRIu64 "\n", key_block->key_block_flags);
+  printf("  Data key sha1sum:    ");
+  PrintPubKeySha1Sum(data_key);
+  printf("\n");
 
   rsa = PublicKeyToRSA(&key_block->data_key);
   if (!rsa) {
     error("Error parsing data key.\n");
     return 1;
   }
 
   /* Verify preamble */
   preamble = (VbFirmwarePreambleHeader*)(blob + now);
   if (0 != VerifyFirmwarePreamble(preamble, blob_size - now, rsa)) {
     error("Error verifying preamble.\n");
     return 1;
   }
   now += preamble->preamble_size;
 
   printf("Preamble:\n");
   printf("  Size:                  %" PRIu64 "\n", preamble->preamble_size);
   printf("  Header version:        %" PRIu32 ".%" PRIu32"\n",
          preamble->header_version_major, preamble->header_version_minor);
   printf("  Firmware version:      %" PRIu64 "\n", preamble->firmware_version);
+  kernel_subkey = &preamble->kernel_subkey;
   printf("  Kernel key algorithm:  %" PRIu64 " %s\n",
-         preamble->kernel_subkey.algorithm,
-         (preamble->kernel_subkey.algorithm < kNumAlgorithms ?
-          algo_strings[preamble->kernel_subkey.algorithm] : "(invalid)"));
+         kernel_subkey->algorithm,
+         (kernel_subkey->algorithm < kNumAlgorithms ?
+          algo_strings[kernel_subkey->algorithm] : "(invalid)"));
   printf("  Kernel key version:    %" PRIu64 "\n",
-         preamble->kernel_subkey.key_version);
+         kernel_subkey->key_version);
+  printf("  Kernel key sha1sum:    ");
+  PrintPubKeySha1Sum(kernel_subkey);
+  printf("\n");
   printf("  Firmware body size:    %" PRIu64 "\n",
          preamble->body_signature.data_size);
 
   /* TODO: verify body size same as signature size */
 
   /* Verify body */
   if (0 != VerifyData(fv_data, fv_size, &preamble->body_signature, rsa)) {
     error("Error verifying firmware body.\n");
     return 1;
   }
   printf("Body verification succeeded.\n");
+
+  if (kernelkey_file) {
+    if (0 != PublicKeyWrite(kernelkey_file, kernel_subkey)) {
+      fprintf(stderr,
+              "vbutil_firmware: unable to write kernel subkey\n");
+      return 1;
+    }
+  }
+
   return 0;
 }
 
 
 int main(int argc, char* argv[]) {
 
   char* filename = NULL;
   char* key_block_file = NULL;
   char* signpubkey = NULL;
   char* signprivate = NULL;
@@ skipping 50 matching lines @@
   }
 
   if (parse_error)
     return PrintHelp();
 
   switch(mode) {
     case OPT_MODE_VBLOCK:
       return Vblock(filename, key_block_file, signprivate, version, fv_file,
                     kernelkey_file);
     case OPT_MODE_VERIFY:
-      return Verify(filename, signpubkey, fv_file);
+      return Verify(filename, signpubkey, fv_file, kernelkey_file);
     default:
       printf("Must specify a mode.\n");
       return PrintHelp();
   }
 }