| OLD | NEW |
|---|
| (Empty) |
| 1 /* Copyright (c) 2010 The Chromium OS Authors. All rights reserved. | |
| 2 * Use of this source code is governed by a BSD-style license that can be | |
| 3 * found in the LICENSE file. | |
| 4 * | |
| 5 * Data structure and API definitions for a verified boot firmware image. | |
| 6 * (Firmware Portion) | |
| 7 */ | |
| 8 | |
| 9 #ifndef VBOOT_REFERENCE_FIRMWARE_IMAGE_FW_H_ | |
| 10 #define VBOOT_REFERENCE_FIRMWARE_IMAGE_FW_H_ | |
| 11 | |
| 12 #include <stdint.h> | |
| 13 #include "cryptolib.h" | |
| 14 | |
| 15 #define FIRMWARE_MAGIC "CHROMEOS" | |
| 16 #define FIRMWARE_MAGIC_SIZE 8 | |
| 17 #define FIRMWARE_PREAMBLE_SIZE 8 | |
| 18 | |
| 19 /* RSA 8192 and SHA-512. */ | |
| 20 #define ROOT_SIGNATURE_ALGORITHM 11 | |
| 21 #define ROOT_SIGNATURE_ALGORITHM_STRING "11" | |
| 22 | |
| 23 typedef struct FirmwareImage { | |
| 24 uint8_t magic[FIRMWARE_MAGIC_SIZE]; | |
| 25 /* Key Header */ | |
| 26 uint16_t header_len; /* Length of the header. */ | |
| 27 uint16_t firmware_sign_algorithm; /* Signature algorithm used by the signing | |
| 28 * key. */ | |
| 29 uint16_t firmware_key_version; /* Key Version# for preventing rollbacks. */ | |
| 30 uint8_t* firmware_sign_key; /* Pre-processed public half of signing key. */ | |
| 31 uint8_t header_checksum[SHA512_DIGEST_SIZE]; /* SHA-512 hash of the header.*/ | |
| 32 | |
| 33 uint8_t firmware_key_signature[RSA8192NUMBYTES]; /* Signature of the header | |
| 34 * above. */ | |
| 35 | |
| 36 /* Firmware Preamble. */ | |
| 37 uint16_t firmware_version; /* Firmware Version# for preventing rollbacks.*/ | |
| 38 uint64_t firmware_len; /* Length of the rest of the R/W firmware data. */ | |
| 39 uint16_t kernel_subkey_sign_algorithm; /* Signature algorithm used for | |
| 40 * signing the kernel subkey. */ | |
| 41 uint8_t* kernel_subkey_sign_key; /* Pre-processed public half of the kernel | |
| 42 * subkey signing key. */ | |
| 43 uint8_t preamble[FIRMWARE_PREAMBLE_SIZE]; /* Remaining preamble data.*/ | |
| 44 | |
| 45 uint8_t* preamble_signature; /* Signature over the preamble. */ | |
| 46 | |
| 47 /* The firmware signature comes first as it may allow us to parallelize | |
| 48 * the firmware data fetch and RSA public operation. | |
| 49 */ | |
| 50 uint8_t* firmware_signature; /* Signature on the Preamble + | |
| 51 [firmware_data]. */ | |
| 52 uint8_t* firmware_data; /* Rest of firmware data */ | |
| 53 | |
| 54 } FirmwareImage; | |
| 55 | |
| 56 | |
| 57 /* Error Codes for VerifyFirmware* family of functions. */ | |
| 58 #define VERIFY_FIRMWARE_SUCCESS 0 | |
| 59 #define VERIFY_FIRMWARE_INVALID_IMAGE 1 | |
| 60 #define VERIFY_FIRMWARE_ROOT_SIGNATURE_FAILED 2 | |
| 61 #define VERIFY_FIRMWARE_INVALID_ALGORITHM 3 | |
| 62 #define VERIFY_FIRMWARE_PREAMBLE_SIGNATURE_FAILED 4 | |
| 63 #define VERIFY_FIRMWARE_SIGNATURE_FAILED 5 | |
| 64 #define VERIFY_FIRMWARE_WRONG_MAGIC 6 | |
| 65 #define VERIFY_FIRMWARE_WRONG_HEADER_CHECKSUM 7 | |
| 66 #define VERIFY_FIRMWARE_KEY_ROLLBACK 8 | |
| 67 #define VERIFY_FIRMWARE_VERSION_ROLLBACK 9 | |
| 68 #define VERIFY_FIRMWARE_TPM_ERROR 10 | |
| 69 #define VERIFY_FIRMWARE_MAX 11 /* Total number of error codes. */ | |
| 70 | |
| 71 extern char* kVerifyFirmwareErrors[VERIFY_FIRMWARE_MAX]; | |
| 72 | |
| 73 /* Returns the length of the verified boot firmware preamble based on | |
| 74 * kernel subkey signing algorithm [algorithm]. */ | |
| 75 uint64_t GetFirmwarePreambleLen(int algorithm); | |
| 76 | |
| 77 /* Checks for the sanity of the firmware header pointed by [header_blob]. | |
| 78 * | |
| 79 * On success, put signature algorithm in [algorithm], header length | |
| 80 * in [header_len], and return 0. | |
| 81 * Else, return error code on failure. | |
| 82 */ | |
| 83 int VerifyFirmwareHeader(const uint8_t* root_key_blob, | |
| 84 const uint8_t* header_blob, | |
| 85 int* algorithm, | |
| 86 int* header_len); | |
| 87 | |
| 88 /* Checks the preamble signature on firmware preamble pointed by | |
| 89 * [preamble_blob] using the signing key [sign_key]. | |
| 90 * | |
| 91 * On success, put firmware length into [firmware_len], and return 0. | |
| 92 * Else, return error code on failure. | |
| 93 */ | |
| 94 int VerifyFirmwarePreamble(RSAPublicKey* sign_key, | |
| 95 const uint8_t* preamble_blob, | |
| 96 int algorithm, | |
| 97 uint64_t* firmware_len); | |
| 98 | |
| 99 /* Checks the signature on the preamble + firmware data at | |
| 100 * [preamble_start] and [firmware_data]. | |
| 101 * The length of the actual firmware data is firmware_len and it is assumed to | |
| 102 * be prepended with the signature whose size depends on the signature_algorithm | |
| 103 * [algorithm]. This signature also covers the preamble data (but not the | |
| 104 * preamble signature itself). | |
| 105 * | |
| 106 * Return 0 on success, error code on failure. | |
| 107 */ | |
| 108 int VerifyFirmwareData(RSAPublicKey* sign_key, | |
| 109 const uint8_t* preamble_start, | |
| 110 const uint8_t* firmware_data, | |
| 111 uint64_t firmware_len, | |
| 112 int algorithm); | |
| 113 | |
| 114 /* Performs a chained verify of the firmware blob [firmware_blob], using root | |
| 115 * key [root_key] and verification header [verification_header_blob]. | |
| 116 * | |
| 117 * Returns 0 on success, error code on failure. | |
| 118 * | |
| 119 * NOTE: The length of the firmware blob is derived from reading the fields | |
| 120 * in the first few bytes of the verification header. This might look risky but | |
| 121 * in firmware land, the start address of the firmware_blob will always be fixed | |
| 122 * depending on the memory map on the particular platform. In addition, the | |
| 123 * signature on length itself is checked early in the verification process for | |
| 124 * extra safety. | |
| 125 */ | |
| 126 int VerifyFirmware(const uint8_t* root_key_blob, | |
| 127 const uint8_t* verification_header_blob, | |
| 128 const uint8_t* firmware_blob); | |
| 129 | |
| 130 /* Returns the logical version of a firmware blob which is calculated as | |
| 131 * (firmware_key_version << 16 | firmware_version). */ | |
| 132 uint32_t GetLogicalFirmwareVersion(uint8_t* firmware_blob); | |
| 133 | |
| 134 #define BOOT_FIRMWARE_A_CONTINUE 1 | |
| 135 #define BOOT_FIRMWARE_B_CONTINUE 2 | |
| 136 #define BOOT_FIRMWARE_RECOVERY_CONTINUE 3 | |
| 137 | |
| 138 /* This function is the driver used by the RO firmware to | |
| 139 * determine which copy of the firmware to boot from. It performs | |
| 140 * the requisite rollback index checking, including updating them, | |
| 141 * if required. | |
| 142 * | |
| 143 * Returns the code path to follow. It is one of: | |
| 144 * BOOT_FIRMWARE_A_CONTINUE Boot from Firmware A | |
| 145 * BOOT_FIRMWARE_B_CONTINUE Boot from Firmware B | |
| 146 * BOOT_FIRMWARE_RECOVERY_CONTINUE Jump to recovery mode | |
| 147 */ | |
| 148 int VerifyFirmwareDriver_f(uint8_t* root_key_blob, | |
| 149 uint8_t* verification_headerA, | |
| 150 uint8_t* firmwareA, | |
| 151 uint8_t* verification_headerB, | |
| 152 uint8_t* firmwareB); | |
| 153 | |
| 154 #endif /* VBOOT_REFERENCE_FIRMWARE_IMAGE_FW_H_ */ | |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 2866006:
Move old vkernel code out of vboot_firmware. (Closed)
Base URL: ssh://gitrw.chromium.org/vboot_reference.git