Rotor: Develop tool to manipulate BDBs |
||||||||
Issue descriptionCommon boot flow defines Boot Descriptor Block. It's used by firmware and mask rom to run boot verification. We need a tool for it. It should perform: - create: creates a new BDB and signs it - add: adds a hash entry to BDB - resign: resigns a BDB with new pairs of BDB key and data key - verify: checks the validity of BDB using the digest of a BDB key It'll be integrated with futility to avoid the cost of distribution (installation, autoupdate, etc.).
,
Oct 4 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/platform/vboot_reference/+/e43574cd3c3a464268724e2019fa3dd55ccec3d0 commit e43574cd3c3a464268724e2019fa3dd55ccec3d0 Author: Daisuke Nojiri <dnojiri@chromium.org> Date: Fri Sep 16 23:51:42 2016 bdb: add bdb --create command to futility bdb command manipulates BDBs. '--create' sub-command creates a BDB. Other sub-commands will follow in the successive patches. BUG= chromium:649554 BRANCH=none TEST=make runtests. Ran futility bdb --create using test keys and verify it with bdb --verify (to be implemented). Change-Id: Ib0a6165ac93efc7478b9d999d3c837d47cf81ddd Reviewed-on: https://chromium-review.googlesource.com/386794 Commit-Ready: Daisuke Nojiri <dnojiri@chromium.org> Tested-by: Daisuke Nojiri <dnojiri@chromium.org> Reviewed-by: Randall Spangler <rspangler@chromium.org> [modify] https://crrev.com/e43574cd3c3a464268724e2019fa3dd55ccec3d0/Makefile [add] https://crrev.com/e43574cd3c3a464268724e2019fa3dd55ccec3d0/futility/cmd_bdb.c
,
Oct 4 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/platform/vboot_reference/+/84928a0baae6ef508f3dcdd6a4057fb505554dd1 commit 84928a0baae6ef508f3dcdd6a4057fb505554dd1 Author: Daisuke Nojiri <dnojiri@chromium.org> Date: Sat Sep 17 00:25:12 2016 bdb: Assign different codes for data validation errors This patch adds BDB_ERROR_DATA_CHECK_SIG and BD_ERROR_DATA_SIGNED_SIZE to distiniguish data signature validation errors. 'futility bdb --resign' uses these to decide whether to resign is needed or not. BUG= chromium:649554 BRANCH=none TEST=make runtests Change-Id: I19137801ece2424ae575092c51d02664c8b73ba3 Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/386795 Reviewed-by: Randall Spangler <rspangler@chromium.org> [modify] https://crrev.com/84928a0baae6ef508f3dcdd6a4057fb505554dd1/tests/bdb_test.c [modify] https://crrev.com/84928a0baae6ef508f3dcdd6a4057fb505554dd1/firmware/bdb/bdb.c [modify] https://crrev.com/84928a0baae6ef508f3dcdd6a4057fb505554dd1/firmware/bdb/bdb.h
,
Oct 4 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/platform/vboot_reference/+/351bc294ed73b57706e2b1650d6fbdae9418dd61 commit 351bc294ed73b57706e2b1650d6fbdae9418dd61 Author: Daisuke Nojiri <dnojiri@chromium.org> Date: Mon Sep 19 20:37:12 2016 bdb: Add 'bdb --add' to futility futility bdb --add appends a new hash entry to the given BDB. The resulting BDB does not have a valid signature and is expected to be resigned by 'resign' sub-command after all hashes are added. BUG= chromium:649554 BRANCH=none TEST=make runtest. Ran futility bdb --add, then --resign, then --verify (to be implemented) Change-Id: Icdf185f8ac268a23bb3954f5e78df6f80e749e18 Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/387117 Reviewed-by: Randall Spangler <rspangler@chromium.org> [modify] https://crrev.com/351bc294ed73b57706e2b1650d6fbdae9418dd61/firmware/bdb/rsa.c [modify] https://crrev.com/351bc294ed73b57706e2b1650d6fbdae9418dd61/Makefile [modify] https://crrev.com/351bc294ed73b57706e2b1650d6fbdae9418dd61/futility/cmd_bdb.c
,
Oct 5 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/platform/vboot_reference/+/9928e2ffc29ee55c21c98b3e0e495f6186012606 commit 9928e2ffc29ee55c21c98b3e0e495f6186012606 Author: Daisuke Nojiri <dnojiri@chromium.org> Date: Mon Sep 19 23:46:37 2016 bdb: Add 'bdb --resign' to futility 'resign' sub-command signs a BDB using keys provided. It can resign only the data key, the hashes, or both. Required keys vary depending on what part of BDB is invalid and on what public key is specified in the command line. It then detects what key is needed based on the verification result and fails if the required key is not provided. BUG= chromium:649554 BRANCH=none TEST=make runtests. Ran futility bdb --create, --add, --resign, --verify Change-Id: I589a5972f1d7e5066eb56e1c5efb4ee7089d41cd Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/387118 Reviewed-by: Randall Spangler <rspangler@chromium.org> [modify] https://crrev.com/9928e2ffc29ee55c21c98b3e0e495f6186012606/Makefile [modify] https://crrev.com/9928e2ffc29ee55c21c98b3e0e495f6186012606/firmware/bdb/host.c [modify] https://crrev.com/9928e2ffc29ee55c21c98b3e0e495f6186012606/firmware/bdb/host.h [modify] https://crrev.com/9928e2ffc29ee55c21c98b3e0e495f6186012606/futility/cmd_bdb.c
,
Oct 5 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/platform/vboot_reference/+/a1026841a3db4c76288576c8660248fd925763f9 commit a1026841a3db4c76288576c8660248fd925763f9 Author: Daisuke Nojiri <dnojiri@chromium.org> Date: Tue Sep 20 19:42:22 2016 bdb: Add 'bdb --verify' to futility This patch adds 'verify' sub-command to futility bdb. It verifies a BDB. If a key digest is given, it also checks the validity of the embedded BDB key. BUG= chromium:649554 BRANCH=none TEST=make runtests. Ran futility bdb --create, --add, --resign, --verify. Change-Id: Ie19dc0f067c3c6ce65b2b6184bad14b49b188f6d Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/387906 Reviewed-by: Randall Spangler <rspangler@chromium.org> [modify] https://crrev.com/a1026841a3db4c76288576c8660248fd925763f9/futility/cmd_bdb.c
,
Oct 5 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/platform/vboot_reference/+/c3daa95c50ad6976507c2f164f8be87bc7b75c1f commit c3daa95c50ad6976507c2f164f8be87bc7b75c1f Author: Daisuke Nojiri <dnojiri@chromium.org> Date: Thu Sep 22 16:48:20 2016 bdb: Make 'futility show' support BDB This patch makes futility show command support boot block descriptor (BDB) of the common boot flow. BUG= chromium:649554 BRANCH=none TEST=make runtests. Ran futility show bdb.bin. Change-Id: I5f199a32ab1c268351e822e37ed39e41ae19bc7a Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/388631 Reviewed-by: Randall Spangler <rspangler@chromium.org> [modify] https://crrev.com/c3daa95c50ad6976507c2f164f8be87bc7b75c1f/futility/cmd_show.c [modify] https://crrev.com/c3daa95c50ad6976507c2f164f8be87bc7b75c1f/tests/futility/test_file_types.c [add] https://crrev.com/c3daa95c50ad6976507c2f164f8be87bc7b75c1f/tests/futility/data/bdb.bin [modify] https://crrev.com/c3daa95c50ad6976507c2f164f8be87bc7b75c1f/tests/futility/test_file_types.sh [modify] https://crrev.com/c3daa95c50ad6976507c2f164f8be87bc7b75c1f/Makefile [add] https://crrev.com/c3daa95c50ad6976507c2f164f8be87bc7b75c1f/futility/bdb_helper.c [modify] https://crrev.com/c3daa95c50ad6976507c2f164f8be87bc7b75c1f/futility/file_type.inc
,
Oct 6 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/platform/vboot_reference/+/aa77ae1b090e2f29b64531a39b2a632a6d979f87 commit aa77ae1b090e2f29b64531a39b2a632a6d979f87 Author: Daisuke Nojiri <dnojiri@chromium.org> Date: Thu Sep 22 18:45:45 2016 bdb: Add test for futility bdb --create and --verify This script will be testing futility bdb command. BUG= chromium:649554 BRANCH=none TEST=make runtests Change-Id: I3c5b9f9564b3cc67cac4eca02798b8146feeb072 Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/388732 Reviewed-by: Randall Spangler <rspangler@chromium.org> [add] https://crrev.com/aa77ae1b090e2f29b64531a39b2a632a6d979f87/tests/testdata/datakey_digest.bin [add] https://crrev.com/aa77ae1b090e2f29b64531a39b2a632a6d979f87/tests/testdata/bdbkey_digest.bin [add] https://crrev.com/aa77ae1b090e2f29b64531a39b2a632a6d979f87/tests/futility/test_bdb.sh [modify] https://crrev.com/aa77ae1b090e2f29b64531a39b2a632a6d979f87/tests/futility/run_test_scripts.sh
,
Oct 6 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/platform/vboot_reference/+/9e8d3746ac1bac546f9e39569e8158f3fbf6419d commit 9e8d3746ac1bac546f9e39569e8158f3fbf6419d Author: Daisuke Nojiri <dnojiri@chromium.org> Date: Thu Sep 22 18:48:03 2016 bdb: Add test for futility bdb --add BUG= chromium:649554 BRANCH=none TEST=make runtests Change-Id: Ie774a64e9abd6de8f0f96567f6f6a2e930a8624c Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/388733 Reviewed-by: Randall Spangler <rspangler@chromium.org> [modify] https://crrev.com/9e8d3746ac1bac546f9e39569e8158f3fbf6419d/tests/futility/test_bdb.sh
,
Oct 6 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/platform/vboot_reference/+/c3f8de399bc089f973f6766e5dcd06922d5639cd commit c3f8de399bc089f973f6766e5dcd06922d5639cd Author: Daisuke Nojiri <dnojiri@chromium.org> Date: Thu Sep 22 19:03:31 2016 bdb: Add test for futility bdb --resign BUG= chromium:649554 BRANCH=none TEST=make runtests Change-Id: Id33911a1a05375f860c38ee6df3f98fa59066acf Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/388734 Reviewed-by: Randall Spangler <rspangler@chromium.org> [modify] https://crrev.com/c3f8de399bc089f973f6766e5dcd06922d5639cd/tests/futility/test_bdb.sh
,
Oct 14 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/platform/vboot_reference/+/6858261b271322e2c1180f563908ac4111e5000f commit 6858261b271322e2c1180f563908ac4111e5000f Author: Daisuke Nojiri <dnojiri@chromium.org> Date: Tue Oct 04 16:48:18 2016 bdb: Enable futility show to dump data header info This change makes futility show command to dump data header information in a BDB. # of hashes is used to verify 'futility bdb --add' can add a hash in the unit test. BUG= chromium:649554 BRANCH=none TEST=make runtests. run futility show tests/futility/data/bdb.bin BDB Header: Struct Version: 0x1:0x0 BDB key digest: c7895611c24efb2249d97376189eeee07def6bcd8ab162a3850d279354f08ddf size: 1176 Data Header: Struct Version: 0x1:0x0 # of Hashes: 2 Hash Entry Size:56 Signed Size: 272 Description: Hash #0: Offset: 0x2 Size: 35 Partition: 3 Type: 1 Load Address: 0x4 Digest: 72bcf33f448465f035bd58e4b61501db925e67c89feb4a70cb909d8b425861f4 Hash #1: Offset: 0x2 Size: 35 Partition: 3 Type: 1 Load Address: 0x4 Digest: 72bcf33f448465f035bd58e4b61501db925e67c89feb4a70cb909d8b425861f4 Change-Id: I88934b761236f36a5d607c96f6f2543a62e50b68 Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/392949 [modify] https://crrev.com/6858261b271322e2c1180f563908ac4111e5000f/futility/bdb_helper.c [modify] https://crrev.com/6858261b271322e2c1180f563908ac4111e5000f/tests/futility/test_bdb.sh
,
Oct 17 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/platform/vboot_reference/+/8fe8f6ca89c9f6e03486703efd8b2898a8347333 commit 8fe8f6ca89c9f6e03486703efd8b2898a8347333 Author: Daisuke Nojiri <dnojiri@chromium.org> Date: Tue Oct 04 16:48:18 2016 bdb: Enable futility-show to dump key info This change makes futility show command dump information of the keys found in a BDB. BUG= chromium:649554 BRANCH=none TEST=make runtests. run futility show tests/futility/data/bdb.bin Change-Id: I82bb3956b043adf1febe42941618608865525da2 Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/399059 Reviewed-by: Randall Spangler <rspangler@chromium.org> [modify] https://crrev.com/8fe8f6ca89c9f6e03486703efd8b2898a8347333/futility/bdb_helper.c
,
Oct 17 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/platform/vboot_reference/+/1fd0b10f791f045fdf61195f9769d9c637137113 commit 1fd0b10f791f045fdf61195f9769d9c637137113 Author: Daisuke Nojiri <dnojiri@chromium.org> Date: Tue Oct 04 16:48:18 2016 bdb: Enable futility-show to dump more header info This change makes futility show command dump more information of the BDB header. BUG= chromium:649554 BRANCH=none TEST=make runtests $ futility show --type bdb ~/tmp/rotor/bin/coreboot.rom Change-Id: I8a10ed03b673879ab80f777b34863e670d37cd8c Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/399061 Reviewed-by: Randall Spangler <rspangler@chromium.org> [modify] https://crrev.com/1fd0b10f791f045fdf61195f9769d9c637137113/futility/bdb_helper.c
,
Oct 17 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/platform/vboot_reference/+/0d503c7923ed80e1b4d208c81da38116b454cd18 commit 0d503c7923ed80e1b4d208c81da38116b454cd18 Author: Daisuke Nojiri <dnojiri@chromium.org> Date: Tue Oct 04 16:48:18 2016 bdb: Enable futility-show to dump signature info This change makes futility show command dump information of the signatures found in a BDB. BUG= chromium:649554 BRANCH=none TEST=make runtests $ futility show --type bdb ~/tmp/rotor/bin/coreboot.rom Change-Id: I168dcd5adf237ec9989f43e3834577257e9a10ff Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/399060 Reviewed-by: Randall Spangler <rspangler@chromium.org> [modify] https://crrev.com/0d503c7923ed80e1b4d208c81da38116b454cd18/futility/bdb_helper.c
,
Oct 19 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/platform/vboot_reference/+/77d9dd0dd58d2cac1ea6aa8873491afcf2441945 commit 77d9dd0dd58d2cac1ea6aa8873491afcf2441945 Author: Daisuke Nojiri <dnojiri@chromium.org> Date: Tue Oct 04 16:48:18 2016 bdb: Add --data_version to futility-bdb --resign This change makes futility-bdb command take --data_version parameter. BUG= chromium:649554 BRANCH=none TEST=make runtests $ futility bdb --resign test/futility/data/bin.bdb --data_version 2 then futility show --type bdb test/futility/data/bin.bdb Change-Id: I567d5879555f4ae7382fc47ef79135e7a13b7600 Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/399593 Commit-Ready: Daisuke Nojiri <dnojiri@google.com> Tested-by: Daisuke Nojiri <dnojiri@google.com> Reviewed-by: Randall Spangler <rspangler@chromium.org> [modify] https://crrev.com/77d9dd0dd58d2cac1ea6aa8873491afcf2441945/tests/futility/test_bdb.sh [modify] https://crrev.com/77d9dd0dd58d2cac1ea6aa8873491afcf2441945/futility/cmd_bdb.c
,
Oct 19 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/platform/vboot_reference/+/77d9dd0dd58d2cac1ea6aa8873491afcf2441945 commit 77d9dd0dd58d2cac1ea6aa8873491afcf2441945 Author: Daisuke Nojiri <dnojiri@chromium.org> Date: Tue Oct 04 16:48:18 2016 bdb: Add --data_version to futility-bdb --resign This change makes futility-bdb command take --data_version parameter. BUG= chromium:649554 BRANCH=none TEST=make runtests $ futility bdb --resign test/futility/data/bin.bdb --data_version 2 then futility show --type bdb test/futility/data/bin.bdb Change-Id: I567d5879555f4ae7382fc47ef79135e7a13b7600 Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/399593 Commit-Ready: Daisuke Nojiri <dnojiri@google.com> Tested-by: Daisuke Nojiri <dnojiri@google.com> Reviewed-by: Randall Spangler <rspangler@chromium.org> [modify] https://crrev.com/77d9dd0dd58d2cac1ea6aa8873491afcf2441945/tests/futility/test_bdb.sh [modify] https://crrev.com/77d9dd0dd58d2cac1ea6aa8873491afcf2441945/futility/cmd_bdb.c
,
Oct 19 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/platform/vboot_reference/+/77d9dd0dd58d2cac1ea6aa8873491afcf2441945 commit 77d9dd0dd58d2cac1ea6aa8873491afcf2441945 Author: Daisuke Nojiri <dnojiri@chromium.org> Date: Tue Oct 04 16:48:18 2016 bdb: Add --data_version to futility-bdb --resign This change makes futility-bdb command take --data_version parameter. BUG= chromium:649554 BRANCH=none TEST=make runtests $ futility bdb --resign test/futility/data/bin.bdb --data_version 2 then futility show --type bdb test/futility/data/bin.bdb Change-Id: I567d5879555f4ae7382fc47ef79135e7a13b7600 Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/399593 Commit-Ready: Daisuke Nojiri <dnojiri@google.com> Tested-by: Daisuke Nojiri <dnojiri@google.com> Reviewed-by: Randall Spangler <rspangler@chromium.org> [modify] https://crrev.com/77d9dd0dd58d2cac1ea6aa8873491afcf2441945/tests/futility/test_bdb.sh [modify] https://crrev.com/77d9dd0dd58d2cac1ea6aa8873491afcf2441945/futility/cmd_bdb.c
,
Oct 19 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/platform/vboot_reference/+/3875e6191f24ceb83415f553ca91dcac7b71073b commit 3875e6191f24ceb83415f553ca91dcac7b71073b Author: Daisuke Nojiri <dnojiri@chromium.org> Date: Tue Oct 04 16:48:18 2016 bdb: Add --load_address to futility-bdb --create This change makes futility-bdb --create take --load_address parameter, which sets the load address field in the BDB header. BUG= chromium:649554 BRANCH=none TEST=make runtests $ futility bdb --resign test/futility/data/bin.bdb --data_version 2 then futility show --type bdb test/futility/data/bin.bdb Change-Id: Ib4dec86c2a043e0989c91bbc01f39776e3630e4c Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/399594 Commit-Ready: Daisuke Nojiri <dnojiri@google.com> Tested-by: Daisuke Nojiri <dnojiri@google.com> Reviewed-by: Randall Spangler <rspangler@chromium.org> [modify] https://crrev.com/3875e6191f24ceb83415f553ca91dcac7b71073b/tests/futility/test_bdb.sh [modify] https://crrev.com/3875e6191f24ceb83415f553ca91dcac7b71073b/futility/cmd_bdb.c
,
Oct 20 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/platform/vboot_reference/+/ea72ee454aea5e0f378275fe7114cf683b7db938 commit ea72ee454aea5e0f378275fe7114cf683b7db938 Author: Daisuke Nojiri <dnojiri@chromium.org> Date: Tue Oct 04 16:48:18 2016 bdb: Fix uninitialized pointers This change fixes errors reported by coreboot toolchain. BUG= chromium:649554 BRANCH=none TEST=make runtests Change-Id: Icd61899718af64b3d199fff37bbea2ccec6ab2cd Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/400666 Commit-Ready: Dan Shi <dshi@google.com> Reviewed-by: Martin Roth <martinroth@chromium.org> [modify] https://crrev.com/ea72ee454aea5e0f378275fe7114cf683b7db938/futility/cmd_bdb.c
,
Nov 9 2016
,
Jan 21 2017
,
Mar 4 2017
,
Apr 17 2017
,
May 30 2017
,
Aug 1 2017
,
Oct 14 2017
|
||||||||
►
Sign in to add a comment |
||||||||
Comment 1 by dnojiri@chromium.org
, Sep 23 2016