OLD | NEW |
1 /* Copyright (c) 2010 The Chromium OS Authors. All rights reserved. | 1 /* Copyright (c) 2010 The Chromium OS Authors. All rights reserved. |
2 * Use of this source code is governed by a BSD-style license that can be | 2 * Use of this source code is governed by a BSD-style license that can be |
3 * found in the LICENSE file. | 3 * found in the LICENSE file. |
4 * | 4 * |
5 * Data structure and API definitions for a verified boot firmware image. | 5 * Data structure and API definitions for a verified boot firmware image. |
6 */ | 6 */ |
7 | 7 |
8 #ifndef VBOOT_REFERENCE_FIRMWARE_IMAGE_H_ | 8 #ifndef VBOOT_REFERENCE_FIRMWARE_IMAGE_H_ |
9 #define VBOOT_REFERENCE_FIRMWARE_IMAGE_H_ | 9 #define VBOOT_REFERENCE_FIRMWARE_IMAGE_H_ |
10 | 10 |
11 #include <inttypes.h> | 11 #include <inttypes.h> |
12 | 12 |
13 #include "rsa.h" | 13 #include "rsa.h" |
14 #include "sha.h" | 14 #include "sha.h" |
15 | 15 |
16 #define FIRMWARE_MAGIC "CHROMEOS" | 16 #define FIRMWARE_MAGIC "CHROMEOS" |
17 #define FIRMWARE_MAGIC_SIZE 8 | 17 #define FIRMWARE_MAGIC_SIZE 8 |
18 #define FIRMWARE_PREAMBLE_SIZE 8 | 18 #define FIRMWARE_PREAMBLE_SIZE 8 |
19 | 19 |
20 /* RSA 8192 and SHA-512. */ | 20 /* RSA 8192 and SHA-512. */ |
21 #define ROOT_SIGNATURE_ALGORITHM 11 | 21 #define ROOT_SIGNATURE_ALGORITHM 11 |
22 #define ROOT_SIGNATURE_ALGORITHM_STRING "11" | 22 #define ROOT_SIGNATURE_ALGORITHM_STRING "11" |
23 | 23 |
24 typedef struct FirmwareImage { | 24 typedef struct FirmwareImage { |
25 uint8_t magic[FIRMWARE_MAGIC_SIZE]; | 25 uint8_t magic[FIRMWARE_MAGIC_SIZE]; |
26 /* Key Header */ | 26 /* Key Header */ |
27 uint16_t header_len; /* Length of the header. */ | 27 uint16_t header_len; /* Length of the header. */ |
28 uint16_t sign_algorithm; /* Signature algorithm used by the signing key. */ | 28 uint16_t firmware_sign_algorithm; /* Signature algorithm used by the signing |
29 uint8_t* sign_key; /* Pre-processed public half of signing key. */ | 29 * key. */ |
30 uint16_t key_version; /* Key Version# for preventing rollbacks. */ | 30 uint8_t* firmware_sign_key; /* Pre-processed public half of signing key. */ |
| 31 uint16_t firmware_key_version; /* Key Version# for preventing rollbacks. */ |
31 uint8_t header_checksum[SHA512_DIGEST_SIZE]; /* SHA-512 hash of the header.*/ | 32 uint8_t header_checksum[SHA512_DIGEST_SIZE]; /* SHA-512 hash of the header.*/ |
32 | 33 |
33 uint8_t key_signature[RSA8192NUMBYTES]; /* Signature of the header above. */ | 34 uint8_t firmware_key_signature[RSA8192NUMBYTES]; /* Signature of the header |
| 35 * above. */ |
34 | 36 |
35 /* Firmware Preamble. */ | 37 /* Firmware Preamble. */ |
36 uint16_t firmware_version; /* Firmware Version# for preventing rollbacks.*/ | 38 uint16_t firmware_version; /* Firmware Version# for preventing rollbacks.*/ |
37 uint32_t firmware_len; /* Length of the rest of the R/W firmware data. */ | 39 uint32_t firmware_len; /* Length of the rest of the R/W firmware data. */ |
38 uint8_t preamble[FIRMWARE_PREAMBLE_SIZE]; /* Remaining preamble data.*/ | 40 uint8_t preamble[FIRMWARE_PREAMBLE_SIZE]; /* Remaining preamble data.*/ |
39 | 41 |
40 uint8_t* preamble_signature; /* Signature over the preamble. */ | 42 uint8_t* preamble_signature; /* Signature over the preamble. */ |
41 | 43 |
42 /* The firmware signature comes first as it may allow us to parallelize | 44 /* The firmware signature comes first as it may allow us to parallelize |
43 * the firmware data fetch and RSA public operation. | 45 * the firmware data fetch and RSA public operation. |
44 */ | 46 */ |
45 uint8_t* firmware_signature; /* Signature on [firmware_data]. */ | 47 uint8_t* firmware_signature; /* Signature on [firmware_data]. */ |
46 uint8_t* firmware_data; /* Rest of firmware data */ | 48 uint8_t* firmware_data; /* Rest of firmware data */ |
47 | 49 |
48 } FirmwareImage; | 50 } FirmwareImage; |
49 | 51 |
50 /* Allocate and return a new FirmwareImage structure. */ | 52 /* Allocate and return a new FirmwareImage structure. */ |
51 FirmwareImage* FirmwareImageNew(void); | 53 FirmwareImage* FirmwareImageNew(void); |
52 | 54 |
53 /* Deep free the contents of [fw]. */ | 55 /* Deep free the contents of [fw]. */ |
54 void FirmwareImageFree(FirmwareImage* fw); | 56 void FirmwareImageFree(FirmwareImage* fw); |
55 | 57 |
56 /* Read firmware data from file named [input_file].. | 58 /* Read firmware data from file named [input_file]. |
57 * | 59 * |
58 * Returns a filled up FirmwareImage structure on success, NULL on error. | 60 * Returns a filled up FirmwareImage structure on success, NULL on error. |
59 */ | 61 */ |
60 FirmwareImage* ReadFirmwareImage(const char* input_file); | 62 FirmwareImage* ReadFirmwareImage(const char* input_file); |
61 | 63 |
62 /* Write firmware header from [image] to an open file pointed by the | 64 /* Get firmware header binary blob from an [image]. |
63 * file descriptor [fd]. | 65 * |
| 66 * Caller owns the returned pointer and must Free() it. |
64 */ | 67 */ |
65 void WriteFirmwareHeader(int fd, FirmwareImage* image); | 68 uint8_t* GetFirmwareHeaderBlob(const FirmwareImage* image); |
66 | 69 |
67 /* Write firmware preamble from [image] to an open file pointed by the | 70 /* Get firmware preamble binary blob from an [image]. |
68 * file descriptor [fd]. | 71 * |
| 72 * Caller owns the returned pointer and must Free() it. |
69 */ | 73 */ |
70 void WriteFirmwarePreamble(int fd, FirmwareImage* image); | 74 uint8_t* GetFirmwarePreambleBlob(const FirmwareImage* image); |
71 | 75 |
| 76 /* Get a verified firmware binary blob from an [image] and fill its |
| 77 * length into blob_len. |
| 78 * |
| 79 * Caller owns the returned pointer and must Free() it. |
| 80 */ |
| 81 uint8_t* GetFirmwareBlob(const FirmwareImage* image, int* blob_len); |
72 | 82 |
73 /* Write firmware data from [image] into a file named [input_file]. | 83 /* Write firmware data from [image] into a file named [input_file]. |
74 * | 84 * |
75 * Return [image] on success, NULL on error. | 85 * Return 1 on success, 0 on failure. |
76 */ | 86 */ |
77 FirmwareImage* WriteFirmwareImage(const char* input_file, | 87 int WriteFirmwareImage(const char* input_file, |
78 FirmwareImage* image); | 88 const FirmwareImage* image); |
| 89 |
79 | 90 |
80 /* Pretty print the contents of [image]. Only headers and metadata information | 91 /* Pretty print the contents of [image]. Only headers and metadata information |
81 * is printed. | 92 * is printed. |
82 */ | 93 */ |
83 void PrintFirmwareImage(const FirmwareImage* image); | 94 void PrintFirmwareImage(const FirmwareImage* image); |
84 | 95 |
85 /* Error Codes for VerifyFirmware* family of functions. */ | 96 /* Error Codes for VerifyFirmware* family of functions. */ |
86 #define VERIFY_FIRMWARE_SUCCESS 0 | 97 #define VERIFY_FIRMWARE_SUCCESS 0 |
87 #define VERIFY_FIRMWARE_INVALID_IMAGE 1 | 98 #define VERIFY_FIRMWARE_INVALID_IMAGE 1 |
88 #define VERIFY_FIRMWARE_ROOT_SIGNATURE_FAILED 2 | 99 #define VERIFY_FIRMWARE_ROOT_SIGNATURE_FAILED 2 |
(...skipping 77 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
166 * | 177 * |
167 * Return 1 on success, 0 on failure. | 178 * Return 1 on success, 0 on failure. |
168 */ | 179 */ |
169 int AddFirmwareKeySignature(FirmwareImage* image, const char* root_key_file); | 180 int AddFirmwareKeySignature(FirmwareImage* image, const char* root_key_file); |
170 | 181 |
171 /* Add firmware and preamble signature to a firmware image [image] | 182 /* Add firmware and preamble signature to a firmware image [image] |
172 * using the private signing key in file [signing_key_file]. | 183 * using the private signing key in file [signing_key_file]. |
173 * | 184 * |
174 * Return 1 on success, 0 on failure. | 185 * Return 1 on success, 0 on failure. |
175 */ | 186 */ |
176 int AddFirmwareSignature(FirmwareImage* image, const char* signing_key_file, | 187 int AddFirmwareSignature(FirmwareImage* image, const char* signing_key_file); |
177 int algorithm); | |
178 | 188 |
179 #endif /* VBOOT_REFERENCE_FIRMWARE_IMAGE_H_ */ | 189 #endif /* VBOOT_REFERENCE_FIRMWARE_IMAGE_H_ */ |
OLD | NEW |