Add a command line string field to verified boot kernel config image.

src/platform/vboot_reference/utils/kernel_image.c

 /* Copyright (c) 2010 The Chromium OS Authors. All rights reserved.
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  *
  * Functions for generating and manipulating a verified boot kernel image.
  */
 
 #include "kernel_image.h"
 
 #include <fcntl.h>
@@ skipping 114 matching lines @@
   StatefulMemcpy(&st, image->header_checksum, FIELD_LEN(header_checksum));
 
   /* Read key signature. */
   image->kernel_key_signature = (uint8_t*) Malloc(kernel_key_signature_len);
   StatefulMemcpy(&st, image->kernel_key_signature,
                  kernel_key_signature_len);
 
   /* Read the kernel config. */
   StatefulMemcpy(&st, &image->kernel_version, FIELD_LEN(kernel_version));
   StatefulMemcpy(&st, &image->options.version, FIELD_LEN(options.version));
+  StatefulMemcpy(&st, &image->options.cmd_line, FIELD_LEN(options.cmd_line));
   StatefulMemcpy(&st, &image->options.kernel_len,
                  FIELD_LEN(options.kernel_len));
   StatefulMemcpy(&st, &image->options.kernel_load_addr,
                  FIELD_LEN(options.kernel_load_addr));
   StatefulMemcpy(&st, &image->options.kernel_entry_addr,
                  FIELD_LEN(options.kernel_entry_addr));
 
   /* Read kernel config signature. */
   image->config_signature = (uint8_t*) Malloc(kernel_signature_len);
   StatefulMemcpy(&st, image->config_signature, kernel_signature_len);
@@ skipping 41 matching lines @@
   StatefulMemcpy_r(&st, &image->header_checksum, FIELD_LEN(header_checksum));
 
   if (st.remaining_len != 0) {  /* Underrun or Overrun. */
     Free(header_blob);
     return NULL;
   }
   return header_blob;
 }
 
 int GetKernelConfigLen(const KernelImage* image) {
-  return (FIELD_LEN(kernel_version) + FIELD_LEN(options.version) +
+  return (FIELD_LEN(kernel_version) +
+          FIELD_LEN(options.version) + FIELD_LEN(options.cmd_line) +
           FIELD_LEN(options.kernel_len) + FIELD_LEN(options.kernel_load_addr) +
           FIELD_LEN(options.kernel_entry_addr));
 }
 
 uint8_t* GetKernelConfigBlob(const KernelImage* image) {
   uint8_t* config_blob = NULL;
   MemcpyState st;
 
   config_blob = (uint8_t*) Malloc(GetKernelConfigLen(image));
   st.remaining_len = GetKernelConfigLen(image);
   st.remaining_buf = config_blob;
 
   StatefulMemcpy_r(&st, &image->kernel_version, FIELD_LEN(kernel_version));
   StatefulMemcpy_r(&st, image->options.version, FIELD_LEN(options.version));
+  StatefulMemcpy_r(&st, image->options.cmd_line, FIELD_LEN(options.cmd_line));
   StatefulMemcpy_r(&st, &image->options.kernel_len,
                    FIELD_LEN(options.kernel_len));
   StatefulMemcpy_r(&st, &image->options.kernel_load_addr,
         FIELD_LEN(options.kernel_load_addr));
   StatefulMemcpy_r(&st, &image->options.kernel_entry_addr,
         FIELD_LEN(options.kernel_entry_addr));
   if (st.remaining_len != 0) {  /* Overrun or Underrun. */
     Free(config_blob);
     return NULL;
   }
@@ skipping 86 matching lines @@
          "Kernel Key Version = %d\n\n",
          image->header_len,
          image->firmware_sign_algorithm,
          image->kernel_sign_algorithm,
          algo_strings[image->kernel_sign_algorithm],
          image->kernel_key_version);
   /* TODO(gauravsh): Output hash and key signature here? */
   /* Print preamble. */
   printf("Kernel Version = %d\n"
          "Kernel Config Version = %d.%d\n"
+         "Kernel Config command line = %s\n"
          "kernel Length = %" PRId64 "\n"
          "Kernel Load Address = %" PRId64 "\n"
          "Kernel Entry Address = %" PRId64 "\n\n",
          image->kernel_version,
          image->options.version[0], image->options.version[1],
+         image->options.cmd_line,
          image->options.kernel_len,
          image->options.kernel_load_addr,
          image->options.kernel_entry_addr);
   /* TODO(gauravsh): Output kernel signature here? */
 }
 
 char* kVerifyKernelErrors[VERIFY_KERNEL_MAX] = {
   "Success.",
   "Invalid Image.",
   "Kernel Key Signature Failed.",
@@ skipping 81 matching lines @@
       return VERIFY_KERNEL_KEY_SIGNATURE_FAILED;
   }
   return 0;
 }
 
 int VerifyKernelConfig(RSAPublicKey* kernel_sign_key,
                        const uint8_t* config_blob,
                        int algorithm,
                        int* kernel_len) {
   uint32_t len, config_len;
-  config_len = (FIELD_LEN(kernel_version) +
-                FIELD_LEN(options.version)+
-                FIELD_LEN(options.kernel_len) +
-                FIELD_LEN(options.kernel_load_addr) +
-                FIELD_LEN(options.kernel_entry_addr));
+  config_len = GetKernelConfigLen(NULL);
   if (!RSAVerifyBinary_f(NULL, kernel_sign_key,  /* Key to use */
                          config_blob,  /* Data to verify */
                          config_len,  /* Length of data */
                          config_blob + config_len,  /* Expected Signature */
                          algorithm))
     return VERIFY_KERNEL_CONFIG_SIGNATURE_FAILED;
 
-  Memcpy(&len, config_blob + (FIELD_LEN(kernel_version)+
-                              FIELD_LEN(options.version)),
+  Memcpy(&len,
+         config_blob + (FIELD_LEN(kernel_version) + FIELD_LEN(options.version) +
+                              FIELD_LEN(options.cmd_line)),
          sizeof(len));
   *kernel_len = (int) len;
   return 0;
 }
 
 int VerifyKernelData(RSAPublicKey* kernel_sign_key,
                      const uint8_t* kernel_data_start,
                      int kernel_len,
                      int algorithm) {
   int signature_len = siglen_map[algorithm];
@@ skipping 52 matching lines @@
   /* Only continue if config verification succeeds. */
   config_ptr = (header_ptr + header_len + kernel_key_signature_len);
   if ((error_code = VerifyKernelConfig(kernel_sign_key, config_ptr,
                                        kernel_sign_algorithm,
                                        &kernel_len))) {
     RSAPublicKeyFree(kernel_sign_key);
     return error_code;  /* AKA jump to recovery. */
   }
   /* Only continue if kernel data verification succeeds. */
   kernel_ptr = (config_ptr +
-                FIELD_LEN(kernel_version) +
-                FIELD_LEN(options.version) +
-                FIELD_LEN(options.kernel_len) +
-                FIELD_LEN(options.kernel_entry_addr) +
-                FIELD_LEN(options.kernel_load_addr) +
+                GetKernelConfigLen(NULL) +  /* Skip config block/signature. */
                 kernel_signature_len);
 
   if ((error_code = VerifyKernelData(kernel_sign_key, kernel_ptr, kernel_len,
                                      kernel_sign_algorithm))) {
     RSAPublicKeyFree(kernel_sign_key);
     return error_code;  /* AKA jump to recovery. */
   }
   RSAPublicKeyFree(kernel_sign_key);
   return 0;  /* Success! */
 }
@@ skipping 56 matching lines @@
   /* Get kernel signing key to verify the rest of the kernel. */
   kernel_sign_key_size = RSAProcessedKeySize(image->kernel_sign_algorithm);
   kernel_sign_key = RSAPublicKeyFromBuf(image->kernel_sign_key,
                                         kernel_sign_key_size);
   kernel_signature_size = siglen_map[image->kernel_sign_algorithm];
 
   /* Verify kernel config signature. */
   DigestInit(&ctx, image->kernel_sign_algorithm);
   DigestUpdate(&ctx, (uint8_t*) &image->kernel_version,
                FIELD_LEN(kernel_version));
-  DigestUpdate(&ctx, (uint8_t*) &image->options.version,
+  DigestUpdate(&ctx, (uint8_t*) image->options.version,
                FIELD_LEN(options.version));
+  DigestUpdate(&ctx, (uint8_t*) image->options.cmd_line,
+               FIELD_LEN(options.cmd_line));
   DigestUpdate(&ctx, (uint8_t*) &image->options.kernel_len,
                FIELD_LEN(options.kernel_len));
   DigestUpdate(&ctx, (uint8_t*) &image->options.kernel_load_addr,
                FIELD_LEN(options.kernel_load_addr));
   DigestUpdate(&ctx, (uint8_t*) &image->options.kernel_entry_addr,
                FIELD_LEN(options.kernel_entry_addr));
   config_digest = DigestFinal(&ctx);
   if (!RSAVerify(kernel_sign_key, image->config_signature,
                  kernel_signature_size, image->kernel_sign_algorithm,
                  config_digest)) {
@@ skipping 74 matching lines @@
                                         kernel_signing_key_file,
                                         image->kernel_sign_algorithm))) {
     fprintf(stderr, "Could not compute signature on the kernel.\n");
     return 0;
   }
   image->kernel_signature = (uint8_t*) Malloc(signature_len);
   Memcpy(image->kernel_signature, kernel_signature, signature_len);
   Free(kernel_signature);
   return 1;
 }