OLD | NEW |
| (Empty) |
1 /* Copyright (c) 2010 The Chromium OS Authors. All rights reserved. | |
2 * Use of this source code is governed by a BSD-style license that can be | |
3 * found in the LICENSE file. | |
4 * | |
5 * Data structure and API definitions for a verified boot firmware image. | |
6 * (Firmware Portion) | |
7 */ | |
8 | |
9 #ifndef VBOOT_REFERENCE_FIRMWARE_IMAGE_FW_H_ | |
10 #define VBOOT_REFERENCE_FIRMWARE_IMAGE_FW_H_ | |
11 | |
12 #include <stdint.h> | |
13 #include "cryptolib.h" | |
14 | |
15 #define FIRMWARE_MAGIC "CHROMEOS" | |
16 #define FIRMWARE_MAGIC_SIZE 8 | |
17 #define FIRMWARE_PREAMBLE_SIZE 8 | |
18 | |
19 /* RSA 8192 and SHA-512. */ | |
20 #define ROOT_SIGNATURE_ALGORITHM 11 | |
21 #define ROOT_SIGNATURE_ALGORITHM_STRING "11" | |
22 | |
23 typedef struct FirmwareImage { | |
24 uint8_t magic[FIRMWARE_MAGIC_SIZE]; | |
25 /* Key Header */ | |
26 uint16_t header_len; /* Length of the header. */ | |
27 uint16_t firmware_sign_algorithm; /* Signature algorithm used by the signing | |
28 * key. */ | |
29 uint16_t firmware_key_version; /* Key Version# for preventing rollbacks. */ | |
30 uint8_t* firmware_sign_key; /* Pre-processed public half of signing key. */ | |
31 uint8_t header_checksum[SHA512_DIGEST_SIZE]; /* SHA-512 hash of the header.*/ | |
32 | |
33 uint8_t firmware_key_signature[RSA8192NUMBYTES]; /* Signature of the header | |
34 * above. */ | |
35 | |
36 /* Firmware Preamble. */ | |
37 uint16_t firmware_version; /* Firmware Version# for preventing rollbacks.*/ | |
38 uint64_t firmware_len; /* Length of the rest of the R/W firmware data. */ | |
39 uint16_t kernel_subkey_sign_algorithm; /* Signature algorithm used for | |
40 * signing the kernel subkey. */ | |
41 uint8_t* kernel_subkey_sign_key; /* Pre-processed public half of the kernel | |
42 * subkey signing key. */ | |
43 uint8_t preamble[FIRMWARE_PREAMBLE_SIZE]; /* Remaining preamble data.*/ | |
44 | |
45 uint8_t* preamble_signature; /* Signature over the preamble. */ | |
46 | |
47 /* The firmware signature comes first as it may allow us to parallelize | |
48 * the firmware data fetch and RSA public operation. | |
49 */ | |
50 uint8_t* firmware_signature; /* Signature on the Preamble + | |
51 [firmware_data]. */ | |
52 uint8_t* firmware_data; /* Rest of firmware data */ | |
53 | |
54 } FirmwareImage; | |
55 | |
56 | |
57 /* Error Codes for VerifyFirmware* family of functions. */ | |
58 #define VERIFY_FIRMWARE_SUCCESS 0 | |
59 #define VERIFY_FIRMWARE_INVALID_IMAGE 1 | |
60 #define VERIFY_FIRMWARE_ROOT_SIGNATURE_FAILED 2 | |
61 #define VERIFY_FIRMWARE_INVALID_ALGORITHM 3 | |
62 #define VERIFY_FIRMWARE_PREAMBLE_SIGNATURE_FAILED 4 | |
63 #define VERIFY_FIRMWARE_SIGNATURE_FAILED 5 | |
64 #define VERIFY_FIRMWARE_WRONG_MAGIC 6 | |
65 #define VERIFY_FIRMWARE_WRONG_HEADER_CHECKSUM 7 | |
66 #define VERIFY_FIRMWARE_KEY_ROLLBACK 8 | |
67 #define VERIFY_FIRMWARE_VERSION_ROLLBACK 9 | |
68 #define VERIFY_FIRMWARE_TPM_ERROR 10 | |
69 #define VERIFY_FIRMWARE_MAX 11 /* Total number of error codes. */ | |
70 | |
71 extern char* kVerifyFirmwareErrors[VERIFY_FIRMWARE_MAX]; | |
72 | |
73 /* Returns the length of the verified boot firmware preamble based on | |
74 * kernel subkey signing algorithm [algorithm]. */ | |
75 uint64_t GetFirmwarePreambleLen(int algorithm); | |
76 | |
77 /* Checks for the sanity of the firmware header pointed by [header_blob]. | |
78 * | |
79 * On success, put signature algorithm in [algorithm], header length | |
80 * in [header_len], and return 0. | |
81 * Else, return error code on failure. | |
82 */ | |
83 int VerifyFirmwareHeader(const uint8_t* root_key_blob, | |
84 const uint8_t* header_blob, | |
85 int* algorithm, | |
86 int* header_len); | |
87 | |
88 /* Checks the preamble signature on firmware preamble pointed by | |
89 * [preamble_blob] using the signing key [sign_key]. | |
90 * | |
91 * On success, put firmware length into [firmware_len], and return 0. | |
92 * Else, return error code on failure. | |
93 */ | |
94 int VerifyFirmwarePreamble(RSAPublicKey* sign_key, | |
95 const uint8_t* preamble_blob, | |
96 int algorithm, | |
97 uint64_t* firmware_len); | |
98 | |
99 /* Checks the signature on the preamble + firmware data at | |
100 * [preamble_start] and [firmware_data]. | |
101 * The length of the actual firmware data is firmware_len and it is assumed to | |
102 * be prepended with the signature whose size depends on the signature_algorithm | |
103 * [algorithm]. This signature also covers the preamble data (but not the | |
104 * preamble signature itself). | |
105 * | |
106 * Return 0 on success, error code on failure. | |
107 */ | |
108 int VerifyFirmwareData(RSAPublicKey* sign_key, | |
109 const uint8_t* preamble_start, | |
110 const uint8_t* firmware_data, | |
111 uint64_t firmware_len, | |
112 int algorithm); | |
113 | |
114 /* Performs a chained verify of the firmware blob [firmware_blob], using root | |
115 * key [root_key] and verification header [verification_header_blob]. | |
116 * | |
117 * Returns 0 on success, error code on failure. | |
118 * | |
119 * NOTE: The length of the firmware blob is derived from reading the fields | |
120 * in the first few bytes of the verification header. This might look risky but | |
121 * in firmware land, the start address of the firmware_blob will always be fixed | |
122 * depending on the memory map on the particular platform. In addition, the | |
123 * signature on length itself is checked early in the verification process for | |
124 * extra safety. | |
125 */ | |
126 int VerifyFirmware(const uint8_t* root_key_blob, | |
127 const uint8_t* verification_header_blob, | |
128 const uint8_t* firmware_blob); | |
129 | |
130 /* Returns the logical version of a firmware blob which is calculated as | |
131 * (firmware_key_version << 16 | firmware_version). */ | |
132 uint32_t GetLogicalFirmwareVersion(uint8_t* firmware_blob); | |
133 | |
134 #define BOOT_FIRMWARE_A_CONTINUE 1 | |
135 #define BOOT_FIRMWARE_B_CONTINUE 2 | |
136 #define BOOT_FIRMWARE_RECOVERY_CONTINUE 3 | |
137 | |
138 /* This function is the driver used by the RO firmware to | |
139 * determine which copy of the firmware to boot from. It performs | |
140 * the requisite rollback index checking, including updating them, | |
141 * if required. | |
142 * | |
143 * Returns the code path to follow. It is one of: | |
144 * BOOT_FIRMWARE_A_CONTINUE Boot from Firmware A | |
145 * BOOT_FIRMWARE_B_CONTINUE Boot from Firmware B | |
146 * BOOT_FIRMWARE_RECOVERY_CONTINUE Jump to recovery mode | |
147 */ | |
148 int VerifyFirmwareDriver_f(uint8_t* root_key_blob, | |
149 uint8_t* verification_headerA, | |
150 uint8_t* firmwareA, | |
151 uint8_t* verification_headerB, | |
152 uint8_t* firmwareB); | |
153 | |
154 #endif /* VBOOT_REFERENCE_FIRMWARE_IMAGE_FW_H_ */ | |
OLD | NEW |