summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorHaoran Wang <elven.wang@nxp.com>2017-04-10 13:47:43 +0800
committerHaoran Wang <elven.wang@nxp.com>2017-04-10 14:15:54 +0800
commit94734eeca56e8d1b9f1baedf67e16cd0397fc178 (patch)
treefe5bb4b50a4deb0fc4932a76f22052a8de0ea40e
parentfd6ee4e63dd34c466d2ba1881655f2b6a59add4c (diff)
downloaduboot-imx-94734eeca56e8d1b9f1baedf67e16cd0397fc178.tar.gz
libavb: upgrade avb
Upgrade avb libs to: AndroidPartnerRepo/brillo/platform/external/avb: commit 030120cf1c89345deecbd94c9c0d12f61718ba39 Change-Id: I71a84a8b7afa5661a5e008f5a509f8cc790f154f Signed-off-by: Haoran Wang <elven.wang@nxp.com>
Diffstat
-rwxr-xr-xdrivers/usb/gadget/f_fastboot.c42
-rw-r--r--include/fsl_avb.h2
-rw-r--r--lib/avb/fsl/fsl_avbkey.c10
-rw-r--r--lib/avb/fsl/fsl_avbkey.h2
-rw-r--r--lib/avb/libavb/avb_chain_partition_descriptor.c6
-rw-r--r--lib/avb/libavb/avb_chain_partition_descriptor.h4
-rw-r--r--lib/avb/libavb/avb_crc32.c7
-rw-r--r--lib/avb/libavb/avb_crypto.c335
-rw-r--r--lib/avb/libavb/avb_crypto.h28
-rw-r--r--lib/avb/libavb/avb_descriptor.c11
-rw-r--r--lib/avb/libavb/avb_descriptor.h10
-rw-r--r--lib/avb/libavb/avb_footer.c2
-rw-r--r--lib/avb/libavb/avb_footer.h6
-rw-r--r--lib/avb/libavb/avb_kernel_cmdline_descriptor.c1
-rw-r--r--lib/avb/libavb/avb_kernel_cmdline_descriptor.h19
-rw-r--r--lib/avb/libavb/avb_ops.h69
-rw-r--r--lib/avb/libavb/avb_property_descriptor.c46
-rw-r--r--lib/avb/libavb/avb_property_descriptor.h18
-rw-r--r--lib/avb/libavb/avb_rsa.c60
-rw-r--r--lib/avb/libavb/avb_rsa.h19
-rw-r--r--lib/avb/libavb/avb_sha.h6
-rw-r--r--lib/avb/libavb/avb_sha256.c14
-rw-r--r--lib/avb/libavb/avb_sha512.c24
-rw-r--r--lib/avb/libavb/avb_slot_verify.c727
-rw-r--r--lib/avb/libavb/avb_slot_verify.h102
-rw-r--r--lib/avb/libavb/avb_sysdeps.h22
-rw-r--r--lib/avb/libavb/avb_sysdeps_posix.c78
-rw-r--r--lib/avb/libavb/avb_util.c104
-rw-r--r--lib/avb/libavb/avb_util.h113
-rw-r--r--lib/avb/libavb/avb_vbmeta_image.c472
-rw-r--r--lib/avb/libavb/avb_vbmeta_image.h100
-rw-r--r--lib/avb/libavb/avb_version.c34
-rw-r--r--lib/avb/libavb/avb_version.h63
-rw-r--r--lib/avb/libavb/libavb.h1
-rw-r--r--lib/avb/libavb_ab/avb_ab_flow.c145
-rw-r--r--lib/avb/libavb_ab/avb_ab_flow.h43
-rw-r--r--lib/avb/libavb_ab/avb_ab_ops.h7
37 files changed, 1921 insertions, 831 deletions
diff --git a/drivers/usb/gadget/f_fastboot.c b/drivers/usb/gadget/f_fastboot.c
index 271843e7b2..a2481e8107 100755
--- a/drivers/usb/gadget/f_fastboot.c
+++ b/drivers/usb/gadget/f_fastboot.c
@@ -1816,6 +1816,26 @@ void board_fastboot_setup(void) \
__attribute__((weak, alias("__def_fastboot_setup")));
+#if defined(CONFIG_AVB_SUPPORT) && defined(CONFIG_MMC)
+static AvbABOps fsl_avb_ab_ops = {
+ .read_ab_metadata = fsl_read_ab_metadata,
+ .write_ab_metadata = fsl_write_ab_metadata,
+ .ops = NULL
+};
+
+static AvbOps fsl_avb_ops = {
+ .ab_ops = &fsl_avb_ab_ops,
+ .read_from_partition = fsl_read_from_partition_multi,
+ .write_to_partition = fsl_write_to_partition,
+ .validate_vbmeta_public_key = fsl_validate_vbmeta_public_key_rpmb,
+ .read_rollback_index = fsl_read_rollback_index_rpmb,
+ .write_rollback_index = fsl_write_rollback_index_rpmb,
+ .read_is_device_unlocked = fsl_read_is_device_unlocked,
+ .get_unique_guid_for_partition = fsl_get_unique_guid_for_partition
+
+};
+#endif
+
void fastboot_setup(void)
{
struct tag_serialnr serialnr;
@@ -1835,6 +1855,10 @@ void fastboot_setup(void)
_fastboot_load_partitions();
parameters_setup();
+
+#ifdef CONFIG_AVB_SUPPORT
+ fsl_avb_ab_ops.ops = &fsl_avb_ops;
+#endif
}
/* Write the bcb with fastboot bootloader commands */
@@ -1981,20 +2005,6 @@ bootimg_print_image_hdr(struct andr_img_hdr *hdr)
static struct andr_img_hdr boothdr __aligned(ARCH_DMA_MINALIGN);
#if defined(CONFIG_AVB_SUPPORT) && defined(CONFIG_MMC)
-static AvbABOps fsl_avb_ab_ops = {
- .ops = {
- .read_from_partition = fsl_read_from_partition_multi,
- .write_to_partition = fsl_write_to_partition,
- .validate_vbmeta_public_key = fsl_validate_vbmeta_public_key_rpmb,
- .read_rollback_index = fsl_read_rollback_index_rpmb,
- .write_rollback_index = fsl_write_rollback_index_rpmb,
- .read_is_device_unlocked = fsl_read_is_device_unlocked,
- .get_unique_guid_for_partition = fsl_get_unique_guid_for_partition
- },
- .read_ab_metadata = fsl_read_ab_metadata,
- .write_ab_metadata = fsl_write_ab_metadata
-};
-
/* we can use avb to verify Trusty if we want */
const char *requested_partitions[] = {"boot", 0};
@@ -2008,7 +2018,6 @@ int do_boota(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[]) {
AvbABFlowResult avb_result;
AvbSlotVerifyData *avb_out_data;
AvbPartitionData *avb_loadpart;
- AvbOps fsl_avb_ops = fsl_avb_ab_ops.ops;
#ifdef CONFIG_FASTBOOT_LOCK
/* check lock state */
@@ -2018,8 +2027,9 @@ int do_boota(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[]) {
fastboot_set_lock_stat(FASTBOOT_LOCK);
lock_status = FASTBOOT_LOCK;
}
+ bool allow_fail = (lock_status == FASTBOOT_UNLOCK ? true : false);
/* if in lock state, do avb verify */
- avb_result = avb_ab_flow(&fsl_avb_ab_ops, requested_partitions, &avb_out_data);
+ avb_result = avb_ab_flow(&fsl_avb_ab_ops, requested_partitions, allow_fail, &avb_out_data);
if (avb_result == AVB_AB_FLOW_RESULT_OK) {
assert(avb_out_data != NULL);
/* load the first partition */
diff --git a/include/fsl_avb.h b/include/fsl_avb.h
index c8155a4aab..66aaec609a 100644
--- a/include/fsl_avb.h
+++ b/include/fsl_avb.h
@@ -88,6 +88,8 @@ AvbIOResult fsl_write_ab_metadata(AvbABOps* ab_ops, const struct AvbABData* data
AvbIOResult fsl_validate_vbmeta_public_key_rpmb(AvbOps* ops,
const uint8_t* public_key_data,
size_t public_key_length,
+ const uint8_t* public_key_metadata,
+ size_t public_key_metadata_length,
bool* out_is_trusted);
/* Gets the rollback index corresponding to the slot given by
diff --git a/lib/avb/fsl/fsl_avbkey.c b/lib/avb/fsl/fsl_avbkey.c
index 1cd76c52b1..c40dc9e714 100644
--- a/lib/avb/fsl/fsl_avbkey.c
+++ b/lib/avb/fsl/fsl_avbkey.c
@@ -405,7 +405,7 @@ int rbkidx_erase(void) {
return -1;
memset(rbidx, 0, rbidx_len);
*(uint64_t *)rbidx = AVB_RBIDX_INITVAL;
- for (i = 0; i < AVB_MAX_NUMBER_OF_ROLLBACK_INDEX_SLOTS; i++) {
+ for (i = 0; i < AVB_MAX_NUMBER_OF_ROLLBACK_INDEX_LOCATIONS; i++) {
tag = &hdr.rbk_tags[i];
tag->flag = AVB_RBIDX_FLAG;
tag->offset = offset;
@@ -490,7 +490,7 @@ int avbkey_init(uint8_t *plainkey, uint32_t keylen) {
return -1;
memset(rbidx, 0, rbidx_len);
*(uint64_t *)rbidx = AVB_RBIDX_INITVAL;
- for (i = 0; i < AVB_MAX_NUMBER_OF_ROLLBACK_INDEX_SLOTS; i++) {
+ for (i = 0; i < AVB_MAX_NUMBER_OF_ROLLBACK_INDEX_LOCATIONS; i++) {
tag = &hdr.rbk_tags[i];
tag->flag = AVB_RBIDX_FLAG;
tag->offset = offset;
@@ -525,6 +525,8 @@ int avbkey_init(uint8_t *plainkey, uint32_t keylen) {
AvbIOResult fsl_validate_vbmeta_public_key_rpmb(AvbOps* ops,
const uint8_t* public_key_data,
size_t public_key_length,
+ const uint8_t* public_key_metadata,
+ size_t public_key_metadata_length,
bool* out_is_trusted) {
kblb_hdr_t hdr;
kblb_tag_t *pubk;
@@ -609,7 +611,7 @@ AvbIOResult fsl_read_rollback_index_rpmb(AvbOps* ops, size_t rollback_index_slot
DEBUGAVB("[rpmb] read rollback slot: %zu\n", rollback_index_slot);
- if (rollback_index_slot >= AVB_MAX_NUMBER_OF_ROLLBACK_INDEX_SLOTS)
+ if (rollback_index_slot >= AVB_MAX_NUMBER_OF_ROLLBACK_INDEX_LOCATIONS)
return AVB_IO_RESULT_ERROR_IO;
if ((mmc_dev = get_mmc()) == NULL) {
@@ -676,7 +678,7 @@ AvbIOResult fsl_write_rollback_index_rpmb(AvbOps* ops, size_t rollback_index_slo
assert(ops != NULL);
- if (rollback_index_slot >= AVB_MAX_NUMBER_OF_ROLLBACK_INDEX_SLOTS)
+ if (rollback_index_slot >= AVB_MAX_NUMBER_OF_ROLLBACK_INDEX_LOCATIONS)
return AVB_IO_RESULT_ERROR_IO;
if ((mmc_dev = get_mmc()) == NULL) {
diff --git a/lib/avb/fsl/fsl_avbkey.h b/lib/avb/fsl/fsl_avbkey.h
index 9d2cc12a3f..b671f03335 100644
--- a/lib/avb/fsl/fsl_avbkey.h
+++ b/lib/avb/fsl/fsl_avbkey.h
@@ -37,7 +37,7 @@ struct kblb_hdr {
/* public key keyblb tag */
kblb_tag_t pubk_tag;
/* rollback index keyblb tag */
- kblb_tag_t rbk_tags[AVB_MAX_NUMBER_OF_ROLLBACK_INDEX_SLOTS];
+ kblb_tag_t rbk_tags[AVB_MAX_NUMBER_OF_ROLLBACK_INDEX_LOCATIONS];
};
typedef struct kblb_hdr kblb_hdr_t;
diff --git a/lib/avb/libavb/avb_chain_partition_descriptor.c b/lib/avb/libavb/avb_chain_partition_descriptor.c
index 40e8bb538a..3f14232593 100644
--- a/lib/avb/libavb/avb_chain_partition_descriptor.c
+++ b/lib/avb/libavb/avb_chain_partition_descriptor.c
@@ -40,12 +40,12 @@ bool avb_chain_partition_descriptor_validate_and_byteswap(
return false;
}
- dest->rollback_index_slot = avb_be32toh(dest->rollback_index_slot);
+ dest->rollback_index_location = avb_be32toh(dest->rollback_index_location);
dest->partition_name_len = avb_be32toh(dest->partition_name_len);
dest->public_key_len = avb_be32toh(dest->public_key_len);
- if (dest->rollback_index_slot < 1) {
- avb_error("Invalid rollback index slot value.\n");
+ if (dest->rollback_index_location < 1) {
+ avb_error("Invalid rollback index location value.\n");
return false;
}
diff --git a/lib/avb/libavb/avb_chain_partition_descriptor.h b/lib/avb/libavb/avb_chain_partition_descriptor.h
index 817f74f810..f2c9250156 100644
--- a/lib/avb/libavb/avb_chain_partition_descriptor.h
+++ b/lib/avb/libavb/avb_chain_partition_descriptor.h
@@ -38,7 +38,7 @@ extern "C" {
/* A descriptor containing a pointer to signed integrity data stored
* on another partition. The descriptor contains the partition name in
* question (without the A/B suffix), the public key used to sign the
- * integrity data, and rollback index slot to use for rollback
+ * integrity data, and rollback index location to use for rollback
* protection.
*
* Following this struct are |partition_name_len| bytes of the
@@ -50,7 +50,7 @@ extern "C" {
*/
typedef struct AvbChainPartitionDescriptor {
AvbDescriptor parent_descriptor;
- uint32_t rollback_index_slot;
+ uint32_t rollback_index_location;
uint32_t partition_name_len;
uint32_t public_key_len;
uint8_t reserved[64];
diff --git a/lib/avb/libavb/avb_crc32.c b/lib/avb/libavb/avb_crc32.c
index 55971af5bc..a6b806d358 100644
--- a/lib/avb/libavb/avb_crc32.c
+++ b/lib/avb/libavb/avb_crc32.c
@@ -98,15 +98,16 @@ static uint32_t crc32_tab[] = {
* in sys/libkern.h, where it can be inlined.
*/
-static uint32_t crc32(uint32_t crc_in, const uint8_t* buf, int size) {
+static uint32_t _crc32(uint32_t crc_in, const uint8_t* buf, int size) {
const uint8_t* p = buf;
uint32_t crc;
crc = crc_in ^ ~0U;
- while (size--) crc = crc32_tab[(crc ^ *p++) & 0xFF] ^ (crc >> 8);
+ while (size--)
+ crc = crc32_tab[(crc ^ *p++) & 0xFF] ^ (crc >> 8);
return crc ^ ~0U;
}
uint32_t avb_crc32(const uint8_t* buf, size_t size) {
- return crc32(0, buf, size);
+ return _crc32(0, buf, size);
}
diff --git a/lib/avb/libavb/avb_crypto.c b/lib/avb/libavb/avb_crypto.c
index 9bd4720ef3..a428443ae3 100644
--- a/lib/avb/libavb/avb_crypto.c
+++ b/lib/avb/libavb/avb_crypto.c
@@ -27,6 +27,341 @@
#include "avb_sha.h"
#include "avb_util.h"
+/* NOTE: The PKC1-v1.5 padding is a blob of binary DER of ASN.1 and is
+ * obtained from section 5.2.2 of RFC 4880.
+ */
+
+static const uint8_t
+ padding_RSA2048_SHA256[AVB_RSA2048_NUM_BYTES - AVB_SHA256_DIGEST_SIZE] = {
+ 0x00, 0x01, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0x00, 0x30, 0x31, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65,
+ 0x03, 0x04, 0x02, 0x01, 0x05, 0x00, 0x04, 0x20};
+
+static const uint8_t
+ padding_RSA4096_SHA256[AVB_RSA4096_NUM_BYTES - AVB_SHA256_DIGEST_SIZE] = {
+ 0x00, 0x01, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0x00, 0x30, 0x31, 0x30, 0x0d, 0x06, 0x09, 0x60,
+ 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, 0x05, 0x00, 0x04, 0x20};
+
+static const uint8_t
+ padding_RSA8192_SHA256[AVB_RSA8192_NUM_BYTES - AVB_SHA256_DIGEST_SIZE] = {
+ 0x00, 0x01, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0x00, 0x30, 0x31, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65,
+ 0x03, 0x04, 0x02, 0x01, 0x05, 0x00, 0x04, 0x20};
+
+static const uint8_t
+ padding_RSA2048_SHA512[AVB_RSA2048_NUM_BYTES - AVB_SHA512_DIGEST_SIZE] = {
+ 0x00, 0x01, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0x00, 0x30, 0x51, 0x30, 0x0d, 0x06, 0x09, 0x60,
+ 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03, 0x05, 0x00, 0x04, 0x40};
+
+static const uint8_t
+ padding_RSA4096_SHA512[AVB_RSA4096_NUM_BYTES - AVB_SHA512_DIGEST_SIZE] = {
+ 0x00, 0x01, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00, 0x30, 0x51, 0x30,
+ 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03,
+ 0x05, 0x00, 0x04, 0x40};
+
+static const uint8_t
+ padding_RSA8192_SHA512[AVB_RSA8192_NUM_BYTES - AVB_SHA512_DIGEST_SIZE] = {
+ 0x00, 0x01, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0x00, 0x30, 0x51, 0x30, 0x0d, 0x06, 0x09, 0x60,
+ 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03, 0x05, 0x00, 0x04, 0x40};
+
+static AvbAlgorithmData algorithm_data[_AVB_ALGORITHM_NUM_TYPES] = {
+ /* AVB_ALGORITHM_TYPE_NONE */
+ {.padding = NULL, .padding_len = 0, .hash_len = 0},
+ /* AVB_ALGORITHM_TYPE_SHA256_RSA2048 */
+ {.padding = padding_RSA2048_SHA256,
+ .padding_len = sizeof(padding_RSA2048_SHA256),
+ .hash_len = AVB_SHA256_DIGEST_SIZE},
+ /* AVB_ALGORITHM_TYPE_SHA256_RSA4096 */
+ {.padding = padding_RSA4096_SHA256,
+ .padding_len = sizeof(padding_RSA4096_SHA256),
+ .hash_len = AVB_SHA256_DIGEST_SIZE},
+ /* AVB_ALGORITHM_TYPE_SHA256_RSA8192 */
+ {.padding = padding_RSA8192_SHA256,
+ .padding_len = sizeof(padding_RSA8192_SHA256),
+ .hash_len = AVB_SHA256_DIGEST_SIZE},
+ /* AVB_ALGORITHM_TYPE_SHA512_RSA2048 */
+ {.padding = padding_RSA2048_SHA512,
+ .padding_len = sizeof(padding_RSA2048_SHA512),
+ .hash_len = AVB_SHA512_DIGEST_SIZE},
+ /* AVB_ALGORITHM_TYPE_SHA512_RSA4096 */
+ {.padding = padding_RSA4096_SHA512,
+ .padding_len = sizeof(padding_RSA4096_SHA512),
+ .hash_len = AVB_SHA512_DIGEST_SIZE},
+ /* AVB_ALGORITHM_TYPE_SHA512_RSA8192 */
+ {.padding = padding_RSA8192_SHA512,
+ .padding_len = sizeof(padding_RSA8192_SHA512),
+ .hash_len = AVB_SHA512_DIGEST_SIZE},
+};
+
+const AvbAlgorithmData* avb_get_algorithm_data(AvbAlgorithmType algorithm) {
+ if (algorithm >= AVB_ALGORITHM_TYPE_NONE &&
+ algorithm < _AVB_ALGORITHM_NUM_TYPES) {
+ return &algorithm_data[algorithm];
+ }
+ return NULL;
+}
+
bool avb_rsa_public_key_header_validate_and_byteswap(
const AvbRSAPublicKeyHeader* src, AvbRSAPublicKeyHeader* dest) {
avb_memcpy(dest, src, sizeof(AvbRSAPublicKeyHeader));
diff --git a/lib/avb/libavb/avb_crypto.h b/lib/avb/libavb/avb_crypto.h
index 40740c3bf1..7e8d7e21ca 100644
--- a/lib/avb/libavb/avb_crypto.h
+++ b/lib/avb/libavb/avb_crypto.h
@@ -35,6 +35,21 @@
extern "C" {
#endif
+/* Size of a RSA-2048 signature. */
+#define AVB_RSA2048_NUM_BYTES 256
+
+/* Size of a RSA-4096 signature. */
+#define AVB_RSA4096_NUM_BYTES 512
+
+/* Size of a RSA-8192 signature. */
+#define AVB_RSA8192_NUM_BYTES 1024
+
+/* Size in bytes of a SHA-256 digest. */
+#define AVB_SHA256_DIGEST_SIZE 32
+
+/* Size in bytes of a SHA-512 digest. */
+#define AVB_SHA512_DIGEST_SIZE 64
+
/* Algorithms that can be used in the vbmeta image for
* verification. An algorithm consists of a hash type and a signature
* type.
@@ -88,6 +103,19 @@ typedef enum {
_AVB_ALGORITHM_NUM_TYPES
} AvbAlgorithmType;
+/* Holds algorithm-specific data. The |padding| is needed by avb_rsa_verify. */
+typedef struct {
+ const uint8_t* padding;
+ size_t padding_len;
+ size_t hash_len;
+} AvbAlgorithmData;
+
+/* Provides algorithm-specific data for a given |algorithm|. Returns NULL if
+ * |algorithm| is invalid.
+ */
+const AvbAlgorithmData* avb_get_algorithm_data(AvbAlgorithmType algorithm)
+ AVB_ATTR_WARN_UNUSED_RESULT;
+
/* The header for a serialized RSA public key.
*
* The size of the key is given by |key_num_bits|, for example 2048
diff --git a/lib/avb/libavb/avb_descriptor.c b/lib/avb/libavb/avb_descriptor.c
index db465aae6e..4f8e92534e 100644
--- a/lib/avb/libavb/avb_descriptor.c
+++ b/lib/avb/libavb/avb_descriptor.c
@@ -38,7 +38,8 @@ bool avb_descriptor_validate_and_byteswap(const AvbDescriptor* src,
return true;
}
-bool avb_descriptor_foreach(const uint8_t* image_data, size_t image_size,
+bool avb_descriptor_foreach(const uint8_t* image_data,
+ size_t image_size,
AvbDescriptorForeachFunc foreach_func,
void* user_data) {
const AvbVBMetaImageHeader* header = NULL;
@@ -70,7 +71,7 @@ bool avb_descriptor_foreach(const uint8_t* image_data, size_t image_size,
}
/* Careful, not byteswapped - also ensure it's aligned properly. */
- avb_assert_word_aligned(image_data);
+ avb_assert_aligned(image_data);
header = (const AvbVBMetaImageHeader*)image_data;
image_end = image_data + image_size;
@@ -88,7 +89,7 @@ bool avb_descriptor_foreach(const uint8_t* image_data, size_t image_size,
for (p = desc_start; p < desc_end;) {
const AvbDescriptor* dh = (const AvbDescriptor*)p;
- avb_assert_word_aligned(dh);
+ avb_assert_aligned(dh);
uint64_t nb_following = avb_be64toh(dh->num_bytes_following);
uint64_t nb_total = sizeof(AvbDescriptor) + nb_following;
@@ -139,8 +140,8 @@ const AvbDescriptor** avb_descriptor_get_all(const uint8_t* image_data,
size_t num_descriptors = 0;
SetDescriptorData data;
- avb_descriptor_foreach(image_data, image_size, count_descriptors,
- &num_descriptors);
+ avb_descriptor_foreach(
+ image_data, image_size, count_descriptors, &num_descriptors);
data.descriptor_number = 0;
data.descriptors =
diff --git a/lib/avb/libavb/avb_descriptor.h b/lib/avb/libavb/avb_descriptor.h
index 8086a1278c..5d0f0c699f 100644
--- a/lib/avb/libavb/avb_descriptor.h
+++ b/lib/avb/libavb/avb_descriptor.h
@@ -100,7 +100,8 @@ typedef bool AvbDescriptorForeachFunc(const AvbDescriptor* descriptor,
* avb_vbmeta_image_verify() and reject it unless it's signed by a known
* good public key. Additionally, |image_data| must be word-aligned.
*/
-bool avb_descriptor_foreach(const uint8_t* image_data, size_t image_size,
+bool avb_descriptor_foreach(const uint8_t* image_data,
+ size_t image_size,
AvbDescriptorForeachFunc foreach_func,
void* user_data);
@@ -118,9 +119,10 @@ bool avb_descriptor_foreach(const uint8_t* image_data, size_t image_size,
* avb_vbmeta_image_verify() and reject it unless it's signed by a known
* good public key. Additionally, |image_data| must be word-aligned.
*/
-const AvbDescriptor** avb_descriptor_get_all(
- const uint8_t* image_data, size_t image_size,
- size_t* out_num_descriptors) AVB_ATTR_WARN_UNUSED_RESULT;
+const AvbDescriptor** avb_descriptor_get_all(const uint8_t* image_data,
+ size_t image_size,
+ size_t* out_num_descriptors)
+ AVB_ATTR_WARN_UNUSED_RESULT;
#ifdef __cplusplus
}
diff --git a/lib/avb/libavb/avb_footer.c b/lib/avb/libavb/avb_footer.c
index 5f6ed71cf7..b8b8211501 100644
--- a/lib/avb/libavb/avb_footer.c
+++ b/lib/avb/libavb/avb_footer.c
@@ -45,7 +45,7 @@ bool avb_footer_validate_and_byteswap(const AvbFooter* src, AvbFooter* dest) {
/* Ensure we don't attempt to access any fields if the footer major
* version is not supported.
*/
- if (dest->version_major > AVB_FOOTER_MAJOR_VERSION) {
+ if (dest->version_major > AVB_FOOTER_VERSION_MAJOR) {
avb_error("No support for footer version.\n");
return false;
}
diff --git a/lib/avb/libavb/avb_footer.h b/lib/avb/libavb/avb_footer.h
index 6607c75eda..e84826fa8f 100644
--- a/lib/avb/libavb/avb_footer.h
+++ b/lib/avb/libavb/avb_footer.h
@@ -42,9 +42,9 @@ extern "C" {
/* Size of the footer. */
#define AVB_FOOTER_SIZE 64
-/* The current MAJOR and MINOR versions used - keep in sync with avbtool. */
-#define AVB_FOOTER_MAJOR_VERSION 1
-#define AVB_FOOTER_MINOR_VERSION 0
+/* The current footer version used - keep in sync with avbtool. */
+#define AVB_FOOTER_VERSION_MAJOR 1
+#define AVB_FOOTER_VERSION_MINOR 0
/* The struct used as a footer used on partitions, used to find the
* AvbVBMetaImageHeader struct. This struct is always stored at the
diff --git a/lib/avb/libavb/avb_kernel_cmdline_descriptor.c b/lib/avb/libavb/avb_kernel_cmdline_descriptor.c
index 24b2978ff9..67521f231a 100644
--- a/lib/avb/libavb/avb_kernel_cmdline_descriptor.c
+++ b/lib/avb/libavb/avb_kernel_cmdline_descriptor.c
@@ -40,6 +40,7 @@ bool avb_kernel_cmdline_descriptor_validate_and_byteswap(
return false;
}
+ dest->flags = avb_be32toh(dest->flags);
dest->kernel_cmdline_length = avb_be32toh(dest->kernel_cmdline_length);
/* Check that kernel_cmdline is fully contained. */
diff --git a/lib/avb/libavb/avb_kernel_cmdline_descriptor.h b/lib/avb/libavb/avb_kernel_cmdline_descriptor.h
index 0eece7d227..6908b3b19d 100644
--- a/lib/avb/libavb/avb_kernel_cmdline_descriptor.h
+++ b/lib/avb/libavb/avb_kernel_cmdline_descriptor.h
@@ -35,14 +35,33 @@
extern "C" {
#endif
+/* Flags for kernel command-line descriptors.
+ *
+ * AVB_KERNEL_CMDLINE_FLAGS_USE_ONLY_IF_HASHTREE_NOT_DISABLED: The
+ * cmdline will only be applied if hashtree verification is not
+ * disabled (cf. AVB_VBMETA_IMAGE_FLAGS_HASHTREE_DISABLED).
+ *
+ * AVB_KERNEL_CMDLINE_FLAGS_USE_ONLY_IF_HASHTREE_DISABLED: The cmdline
+ * will only be applied if hashtree verification is disabled
+ * (cf. AVB_VBMETA_IMAGE_FLAGS_HASHTREE_DISABLED).
+ */
+typedef enum {
+ AVB_KERNEL_CMDLINE_FLAGS_USE_ONLY_IF_HASHTREE_NOT_DISABLED = (1 << 0),
+ AVB_KERNEL_CMDLINE_FLAGS_USE_ONLY_IF_HASHTREE_DISABLED = (1 << 1)
+} AvbKernelCmdlineFlags;
+
/* A descriptor containing information to be appended to the kernel
* command-line.
*
+ * The |flags| field contains flags from the AvbKernelCmdlineFlags
+ * enumeration.
+ *
* Following this struct are |kernel_cmdline_len| bytes with the
* kernel command-line (UTF-8 encoded).
*/
typedef struct AvbKernelCmdlineDescriptor {
AvbDescriptor parent_descriptor;
+ uint32_t flags;
uint32_t kernel_cmdline_length;
} AVB_ATTR_PACKED AvbKernelCmdlineDescriptor;
diff --git a/lib/avb/libavb/avb_ops.h b/lib/avb/libavb/avb_ops.h
index 30309c520f..908c66c2ff 100644
--- a/lib/avb/libavb/avb_ops.h
+++ b/lib/avb/libavb/avb_ops.h
@@ -63,12 +63,32 @@ typedef enum {
struct AvbOps;
typedef struct AvbOps AvbOps;
-struct AvbABData;
+/* Forward-declaration of operations in libavb_ab. */
+struct AvbABOps;
+
+/* Forward-declaration of operations in libavb_atx. */
+struct AvbAtxOps;
/* High-level operations/functions/methods that are platform
* dependent.
*/
struct AvbOps {
+ /* This pointer can be used by the application/bootloader using
+ * libavb and is typically used in each operation to get a pointer
+ * to platform-specific resources. It cannot be used by libraries.
+ */
+ void* user_data;
+
+ /* If libavb_ab is used, this should point to the
+ * AvbABOps. Otherwise it must be set to NULL.
+ */
+ struct AvbABOps* ab_ops;
+
+ /* If libavb_atx is used, this should point to the
+ * AvbAtxOps. Otherwise it must be set to NULL.
+ */
+ struct AvbAtxOps* atx_ops;
+
/* Reads |num_bytes| from offset |offset| from partition with name
* |partition| (NUL-terminated UTF-8 string). If |offset| is
* negative, its absolute value should be interpreted as the number
@@ -86,9 +106,12 @@ struct AvbOps {
* of the partition. In this case the value returned in
* |out_num_read| may be smaller than |num_bytes|.
*/
- AvbIOResult (*read_from_partition)(AvbOps* ops, const char* partition,
- int64_t offset, size_t num_bytes,
- void* buffer, size_t* out_num_read);
+ AvbIOResult (*read_from_partition)(AvbOps* ops,
+ const char* partition,
+ int64_t offset,
+ size_t num_bytes,
+ void* buffer,
+ size_t* out_num_read);
/* Writes |num_bytes| from |bffer| at offset |offset| to partition
* with name |partition| (NUL-terminated UTF-8 string). If |offset|
@@ -106,8 +129,10 @@ struct AvbOps {
* This function never does any partial I/O, it either transfers all
* of the requested bytes or returns an error.
*/
- AvbIOResult (*write_to_partition)(AvbOps* ops, const char* partition,
- int64_t offset, size_t num_bytes,
+ AvbIOResult (*write_to_partition)(AvbOps* ops,
+ const char* partition,
+ int64_t offset,
+ size_t num_bytes,
const void* buffer);
/* Checks if the given public key used to sign the 'vbmeta'
@@ -115,36 +140,48 @@ struct AvbOps {
* embedded key material generated with 'avbtool
* extract_public_key'.
*
+ * The public key is in the array pointed to by |public_key_data|
+ * and is of |public_key_length| bytes.
+ *
+ * If there is no public key metadata (set with the avbtool option
+ * --public_key_metadata) then |public_key_metadata| will be set to
+ * NULL. Otherwise this field points to the data which is
+ * |public_key_metadata_length| bytes long.
+ *
* If AVB_IO_RESULT_OK is returned then |out_is_trusted| is set -
* true if trusted or false if untrusted.
*/
AvbIOResult (*validate_vbmeta_public_key)(AvbOps* ops,
const uint8_t* public_key_data,
size_t public_key_length,
+ const uint8_t* public_key_metadata,
+ size_t public_key_metadata_length,
bool* out_is_trusted);
- /* Gets the rollback index corresponding to the slot given by
- * |rollback_index_slot|. The value is returned in
+ /* Gets the rollback index corresponding to the location given by
+ * |rollback_index_location|. The value is returned in
* |out_rollback_index|. Returns AVB_IO_RESULT_OK if the rollback
* index was retrieved, otherwise an error code.
*
- * A device may have a limited amount of rollback index slots (say,
- * one or four) so may error out if |rollback_index_slot| exceeds
+ * A device may have a limited amount of rollback index locations (say,
+ * one or four) so may error out if |rollback_index_location| exceeds
* this number.
*/
- AvbIOResult (*read_rollback_index)(AvbOps* ops, size_t rollback_index_slot,
+ AvbIOResult (*read_rollback_index)(AvbOps* ops,
+ size_t rollback_index_location,
uint64_t* out_rollback_index);
- /* Sets the rollback index corresponding to the slot given by
- * |rollback_index_slot| to |rollback_index|. Returns
+ /* Sets the rollback index corresponding to the location given by
+ * |rollback_index_location| to |rollback_index|. Returns
* AVB_IO_RESULT_OK if the rollback index was set, otherwise an
* error code.
*
- * A device may have a limited amount of rollback index slots (say,
- * one or four) so may error out if |rollback_index_slot| exceeds
+ * A device may have a limited amount of rollback index locations (say,
+ * one or four) so may error out if |rollback_index_location| exceeds
* this number.
*/
- AvbIOResult (*write_rollback_index)(AvbOps* ops, size_t rollback_index_slot,
+ AvbIOResult (*write_rollback_index)(AvbOps* ops,
+ size_t rollback_index_location,
uint64_t rollback_index);
/* Gets whether the device is unlocked. The value is returned in
diff --git a/lib/avb/libavb/avb_property_descriptor.c b/lib/avb/libavb/avb_property_descriptor.c
index 03d831579a..7eba2c00b0 100644
--- a/lib/avb/libavb/avb_property_descriptor.c
+++ b/lib/avb/libavb/avb_property_descriptor.c
@@ -72,11 +72,14 @@ static bool property_lookup_desc_foreach(const AvbDescriptor* header,
const uint8_t* p;
bool ret = true;
- if (header->tag != AVB_DESCRIPTOR_TAG_PROPERTY) goto out;
+ if (header->tag != AVB_DESCRIPTOR_TAG_PROPERTY) {
+ goto out;
+ }
if (!avb_property_descriptor_validate_and_byteswap(
- (const AvbPropertyDescriptor*)header, &prop_desc))
+ (const AvbPropertyDescriptor*)header, &prop_desc)) {
goto out;
+ }
p = (const uint8_t*)header;
if (p[sizeof(AvbPropertyDescriptor) + prop_desc.key_num_bytes] != 0) {
@@ -85,7 +88,8 @@ static bool property_lookup_desc_foreach(const AvbDescriptor* header,
}
if (data->key_size == prop_desc.key_num_bytes) {
- if (avb_memcmp(p + sizeof(AvbPropertyDescriptor), data->key,
+ if (avb_memcmp(p + sizeof(AvbPropertyDescriptor),
+ data->key,
data->key_size) == 0) {
data->ret_value = (const char*)(p + sizeof(AvbPropertyDescriptor) +
prop_desc.key_num_bytes + 1);
@@ -100,28 +104,38 @@ out:
return ret;
}
-const char* avb_property_lookup(const uint8_t* image_data, size_t image_size,
- const char* key, size_t key_size,
+const char* avb_property_lookup(const uint8_t* image_data,
+ size_t image_size,
+ const char* key,
+ size_t key_size,
size_t* out_value_size) {
PropertyIteratorData data;
- if (key_size == 0) key_size = avb_strlen(key);
+ if (key_size == 0) {
+ key_size = avb_strlen(key);
+ }
data.key = key;
data.key_size = key_size;
- if (avb_descriptor_foreach(image_data, image_size,
- property_lookup_desc_foreach, &data) == 0) {
- if (out_value_size != NULL) *out_value_size = data.ret_value_size;
+ if (avb_descriptor_foreach(
+ image_data, image_size, property_lookup_desc_foreach, &data) == 0) {
+ if (out_value_size != NULL) {
+ *out_value_size = data.ret_value_size;
+ }
return data.ret_value;
}
- if (out_value_size != NULL) *out_value_size = 0;
+ if (out_value_size != NULL) {
+ *out_value_size = 0;
+ }
return NULL;
}
-bool avb_property_lookup_uint64(const uint8_t* image_data, size_t image_size,
- const char* key, size_t key_size,
+bool avb_property_lookup_uint64(const uint8_t* image_data,
+ size_t image_size,
+ const char* key,
+ size_t key_size,
uint64_t* out_value) {
const char* value;
bool ret = false;
@@ -130,7 +144,9 @@ bool avb_property_lookup_uint64(const uint8_t* image_data, size_t image_size,
int n;
value = avb_property_lookup(image_data, image_size, key, key_size, NULL);
- if (value == NULL) goto out;
+ if (value == NULL) {
+ goto out;
+ }
base = 10;
if (avb_memcmp(value, "0x", 2) == 0) {
@@ -160,7 +176,9 @@ bool avb_property_lookup_uint64(const uint8_t* image_data, size_t image_size,
}
ret = true;
- if (out_value != NULL) *out_value = parsed_val;
+ if (out_value != NULL) {
+ *out_value = parsed_val;
+ }
out:
return ret;
diff --git a/lib/avb/libavb/avb_property_descriptor.h b/lib/avb/libavb/avb_property_descriptor.h
index 2ad1c2e553..a2fef696a9 100644
--- a/lib/avb/libavb/avb_property_descriptor.h
+++ b/lib/avb/libavb/avb_property_descriptor.h
@@ -80,9 +80,12 @@ bool avb_property_descriptor_validate_and_byteswap(
* avb_vbmeta_image_verify() and reject it unless it's signed by a
* known good public key.
*/
-const char* avb_property_lookup(
- const uint8_t* image_data, size_t image_size, const char* key,
- size_t key_size, size_t* out_value_size) AVB_ATTR_WARN_UNUSED_RESULT;
+const char* avb_property_lookup(const uint8_t* image_data,
+ size_t image_size,
+ const char* key,
+ size_t key_size,
+ size_t* out_value_size)
+ AVB_ATTR_WARN_UNUSED_RESULT;
/* Like avb_property_lookup() but parses the intial portions of the
* value as an unsigned 64-bit integer. Both decimal and hexadecimal
@@ -90,9 +93,12 @@ const char* avb_property_lookup(
* failure and true on success. On success, the parsed value is
* returned in |out_value|.
*/
-bool avb_property_lookup_uint64(
- const uint8_t* image_data, size_t image_size, const char* key,
- size_t key_size, uint64_t* out_value) AVB_ATTR_WARN_UNUSED_RESULT;
+bool avb_property_lookup_uint64(const uint8_t* image_data,
+ size_t image_size,
+ const char* key,
+ size_t key_size,
+ uint64_t* out_value)
+ AVB_ATTR_WARN_UNUSED_RESULT;
#ifdef __cplusplus
}
diff --git a/lib/avb/libavb/avb_rsa.c b/lib/avb/libavb/avb_rsa.c
index 8a2b8b4803..dcecc16973 100644
--- a/lib/avb/libavb/avb_rsa.c
+++ b/lib/avb/libavb/avb_rsa.c
@@ -77,7 +77,9 @@ Key* parse_key_data(const uint8_t* data, size_t length) {
* allocation.
*/
key = (Key*)(avb_malloc(sizeof(Key) + 2 * h.key_num_bits / 8));
- if (key == NULL) goto fail;
+ if (key == NULL) {
+ goto fail;
+ }
key->len = h.key_num_bits / 32;
key->n0inv = h.n0inv;
@@ -95,11 +97,15 @@ Key* parse_key_data(const uint8_t* data, size_t length) {
return key;
fail:
- if (key != NULL) avb_free(key);
+ if (key != NULL) {
+ avb_free(key);
+ }
return NULL;
}
-void free_parsed_key(Key* key) { avb_free(key); }
+void free_parsed_key(Key* key) {
+ avb_free(key);
+}
/* a[] -= mod */
static void subM(const Key* key, uint32_t* a) {
@@ -117,14 +123,20 @@ static int geM(const Key* key, uint32_t* a) {
uint32_t i;
for (i = key->len; i;) {
--i;
- if (a[i] < key->n[i]) return 0;
- if (a[i] > key->n[i]) return 1;
+ if (a[i] < key->n[i]) {
+ return 0;
+ }
+ if (a[i] > key->n[i]) {
+ return 1;
+ }
}
return 1; /* equal */
}
/* montgomery c[] += a * b[] / R % mod */
-static void montMulAdd(const Key* key, uint32_t* c, const uint32_t a,
+static void montMulAdd(const Key* key,
+ uint32_t* c,
+ const uint32_t a,
const uint32_t* b) {
uint64_t A = (uint64_t)a * b[0] + c[0];
uint32_t d0 = (uint32_t)A * key->n0inv;
@@ -164,7 +176,9 @@ static void modpowF4(const Key* key, uint8_t* inout) {
uint32_t* a = (uint32_t*)avb_malloc(key->len * sizeof(uint32_t));
uint32_t* aR = (uint32_t*)avb_malloc(key->len * sizeof(uint32_t));
uint32_t* aaR = (uint32_t*)avb_malloc(key->len * sizeof(uint32_t));
- if (a == NULL || aR == NULL || aaR == NULL) goto out;
+ if (a == NULL || aR == NULL || aaR == NULL) {
+ goto out;
+ }
uint32_t* aaa = aaR; /* Re-use location. */
int i;
@@ -200,18 +214,28 @@ static void modpowF4(const Key* key, uint8_t* inout) {
}
out:
- if (a != NULL) avb_free(a);
- if (aR != NULL) avb_free(aR);
- if (aaR != NULL) avb_free(aaR);
+ if (a != NULL) {
+ avb_free(a);
+ }
+ if (aR != NULL) {
+ avb_free(aR);
+ }
+ if (aaR != NULL) {
+ avb_free(aaR);
+ }
}
/* Verify a RSA PKCS1.5 signature against an expected hash.
* Returns false on failure, true on success.
*/
-bool avb_rsa_verify(const uint8_t* key, size_t key_num_bytes,
- const uint8_t* sig, size_t sig_num_bytes,
- const uint8_t* hash, size_t hash_num_bytes,
- const uint8_t* padding, size_t padding_num_bytes) {
+bool avb_rsa_verify(const uint8_t* key,
+ size_t key_num_bytes,
+ const uint8_t* sig,
+ size_t sig_num_bytes,
+ const uint8_t* hash,
+ size_t hash_num_bytes,
+ const uint8_t* padding,
+ size_t padding_num_bytes) {
uint8_t* buf = NULL;
Key* parsed_key = NULL;
bool success = false;
@@ -265,7 +289,11 @@ bool avb_rsa_verify(const uint8_t* key, size_t key_num_bytes,
success = true;
out:
- if (parsed_key != NULL) free_parsed_key(parsed_key);
- if (buf != NULL) avb_free(buf);
+ if (parsed_key != NULL) {
+ free_parsed_key(parsed_key);
+ }
+ if (buf != NULL) {
+ avb_free(buf);
+ }
return success;
}
diff --git a/lib/avb/libavb/avb_rsa.h b/lib/avb/libavb/avb_rsa.h
index e82102b6ad..c2dcf4715c 100644
--- a/lib/avb/libavb/avb_rsa.h
+++ b/lib/avb/libavb/avb_rsa.h
@@ -42,17 +42,9 @@
extern "C" {
#endif
+#include "avb_crypto.h"
#include "avb_sysdeps.h"
-/* Size of a RSA-2048 signature. */
-#define AVB_RSA2048_NUM_BYTES 256
-
-/* Size of a RSA-4096 signature. */
-#define AVB_RSA4096_NUM_BYTES 512
-
-/* Size of a RSA-8192 signature. */
-#define AVB_RSA8192_NUM_BYTES 1024
-
/* Using the key given by |key|, verify a RSA signature |sig| of
* length |sig_num_bytes| against an expected |hash| of length
* |hash_num_bytes|. The padding to expect must be passed in using
@@ -65,9 +57,12 @@ extern "C" {
*
* Returns false if verification fails, true otherwise.
*/
-bool avb_rsa_verify(const uint8_t* key, size_t key_num_bytes,
- const uint8_t* sig, size_t sig_num_bytes,
- const uint8_t* hash, size_t hash_num_bytes,
+bool avb_rsa_verify(const uint8_t* key,
+ size_t key_num_bytes,
+ const uint8_t* sig,
+ size_t sig_num_bytes,
+ const uint8_t* hash,
+ size_t hash_num_bytes,
const uint8_t* padding,
size_t padding_num_bytes) AVB_ATTR_WARN_UNUSED_RESULT;
diff --git a/lib/avb/libavb/avb_sha.h b/lib/avb/libavb/avb_sha.h
index b925bd2c11..c5a6a4c706 100644
--- a/lib/avb/libavb/avb_sha.h
+++ b/lib/avb/libavb/avb_sha.h
@@ -37,16 +37,12 @@
extern "C" {
#endif
+#include "avb_crypto.h"
#include "avb_sysdeps.h"
-/* Size in bytes of a SHA-256 digest. */
-#define AVB_SHA256_DIGEST_SIZE 32
-
/* Block size in bytes of a SHA-256 digest. */
#define AVB_SHA256_BLOCK_SIZE 64
-/* Size in bytes of a SHA-512 digest. */
-#define AVB_SHA512_DIGEST_SIZE 64
/* Block size in bytes of a SHA-512 digest. */
#define AVB_SHA512_BLOCK_SIZE 128
diff --git a/lib/avb/libavb/avb_sha256.c b/lib/avb/libavb/avb_sha256.c
index b1748eb4a1..cdd143a93f 100644
--- a/lib/avb/libavb/avb_sha256.c
+++ b/lib/avb/libavb/avb_sha256.c
@@ -77,9 +77,14 @@
wv[h] = t1 + t2; \
}
-static const uint32_t sha256_h0[8] = {0x6a09e667, 0xbb67ae85, 0x3c6ef372,
- 0xa54ff53a, 0x510e527f, 0x9b05688c,
- 0x1f83d9ab, 0x5be0cd19};
+static const uint32_t sha256_h0[8] = {0x6a09e667,
+ 0xbb67ae85,
+ 0x3c6ef372,
+ 0xa54ff53a,
+ 0x510e527f,
+ 0x9b05688c,
+ 0x1f83d9ab,
+ 0x5be0cd19};
static const uint32_t sha256_k[64] = {
0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1,
@@ -116,7 +121,8 @@ void avb_sha256_init(AvbSHA256Ctx* ctx) {
ctx->tot_len = 0;
}
-static void SHA256_transform(AvbSHA256Ctx* ctx, const uint8_t* message,
+static void SHA256_transform(AvbSHA256Ctx* ctx,
+ const uint8_t* message,
unsigned int block_nb) {
uint32_t w[64];
uint32_t wv[8];
diff --git a/lib/avb/libavb/avb_sha512.c b/lib/avb/libavb/avb_sha512.c
index f2f0ec49fb..8df63193c9 100644
--- a/lib/avb/libavb/avb_sha512.c
+++ b/lib/avb/libavb/avb_sha512.c
@@ -91,10 +91,14 @@
wv[h] = t1 + t2; \
}
-static const uint64_t sha512_h0[8] = {
- 0x6a09e667f3bcc908ULL, 0xbb67ae8584caa73bULL, 0x3c6ef372fe94f82bULL,
- 0xa54ff53a5f1d36f1ULL, 0x510e527fade682d1ULL, 0x9b05688c2b3e6c1fULL,
- 0x1f83d9abfb41bd6bULL, 0x5be0cd19137e2179ULL};
+static const uint64_t sha512_h0[8] = {0x6a09e667f3bcc908ULL,
+ 0xbb67ae8584caa73bULL,
+ 0x3c6ef372fe94f82bULL,
+ 0xa54ff53a5f1d36f1ULL,
+ 0x510e527fade682d1ULL,
+ 0x9b05688c2b3e6c1fULL,
+ 0x1f83d9abfb41bd6bULL,
+ 0x5be0cd19137e2179ULL};
static const uint64_t sha512_k[80] = {
0x428a2f98d728ae22ULL, 0x7137449123ef65cdULL, 0xb5c0fbcfec4d3b2fULL,
@@ -140,14 +144,16 @@ void avb_sha512_init(AvbSHA512Ctx* ctx) {
#else
int i;
- for (i = 0; i < 8; i++) ctx->h[i] = sha512_h0[i];
+ for (i = 0; i < 8; i++)
+ ctx->h[i] = sha512_h0[i];
#endif /* UNROLL_LOOPS_SHA512 */
ctx->len = 0;
ctx->tot_len = 0;
}
-static void SHA512_transform(AvbSHA512Ctx* ctx, const uint8_t* message,
+static void SHA512_transform(AvbSHA512Ctx* ctx,
+ const uint8_t* message,
unsigned int block_nb) {
uint64_t w[80];
uint64_t wv[8];
@@ -306,7 +312,8 @@ static void SHA512_transform(AvbSHA512Ctx* ctx, const uint8_t* message,
wv[0] = t1 + t2;
}
- for (j = 0; j < 8; j++) ctx->h[j] += wv[j];
+ for (j = 0; j < 8; j++)
+ ctx->h[j] += wv[j];
#endif /* UNROLL_LOOPS_SHA512 */
}
}
@@ -373,7 +380,8 @@ uint8_t* avb_sha512_final(AvbSHA512Ctx* ctx) {
UNPACK64(ctx->h[6], &ctx->buf[48]);
UNPACK64(ctx->h[7], &ctx->buf[56]);
#else
- for (i = 0; i < 8; i++) UNPACK64(ctx->h[i], &ctx->buf[i << 3]);
+ for (i = 0; i < 8; i++)
+ UNPACK64(ctx->h[i], &ctx->buf[i << 3]);
#endif /* UNROLL_LOOPS_SHA512 */
return ctx->buf;
diff --git a/lib/avb/libavb/avb_slot_verify.c b/lib/avb/libavb/avb_slot_verify.c
index 57477d26f5..d00b9b9404 100644
--- a/lib/avb/libavb/avb_slot_verify.c
+++ b/lib/avb/libavb/avb_slot_verify.c
@@ -30,6 +30,8 @@
#include "avb_sha.h"
#include "avb_util.h"
#include "avb_vbmeta_image.h"
+#include "avb_version.h"
+#include <common.h>
/* Maximum allow length (in bytes) of a partition name, including
* ab_suffix.
@@ -39,14 +41,43 @@
/* Maximum number of partitions that can be loaded with avb_slot_verify(). */
#define MAX_NUMBER_OF_LOADED_PARTITIONS 32
+/* Maximum number of vbmeta images that can be loaded with avb_slot_verify(). */
+#define MAX_NUMBER_OF_VBMETA_IMAGES 32
+
/* Maximum size of a vbmeta image - 64 KiB. */
#define VBMETA_MAX_SIZE (64 * 1024)
+/* Helper function to see if we should continue with verification in
+ * allow_verification_error=true mode if something goes wrong. See the
+ * comments for the avb_slot_verify() function for more information.
+ */
+static inline bool result_should_continue(AvbSlotVerifyResult result) {
+ switch (result) {
+ case AVB_SLOT_VERIFY_RESULT_ERROR_OOM:
+ case AVB_SLOT_VERIFY_RESULT_ERROR_IO:
+ case AVB_SLOT_VERIFY_RESULT_ERROR_INVALID_METADATA:
+ case AVB_SLOT_VERIFY_RESULT_ERROR_UNSUPPORTED_VERSION:
+ return false;
+
+ case AVB_SLOT_VERIFY_RESULT_OK:
+ case AVB_SLOT_VERIFY_RESULT_ERROR_VERIFICATION:
+ case AVB_SLOT_VERIFY_RESULT_ERROR_ROLLBACK_INDEX:
+ case AVB_SLOT_VERIFY_RESULT_ERROR_PUBLIC_KEY_REJECTED:
+ return true;
+ }
+
+ return false;
+}
+
static AvbSlotVerifyResult load_and_verify_hash_partition(
- AvbOps* ops, const char* const* requested_partitions, const char* ab_suffix,
- const AvbDescriptor* descriptor, AvbSlotVerifyData* slot_data) {
+ AvbOps* ops,
+ const char* const* requested_partitions,
+ const char* ab_suffix,
+ bool allow_verification_error,
+ const AvbDescriptor* descriptor,
+ AvbSlotVerifyData* slot_data) {
AvbHashDescriptor hash_desc;
- const uint8_t* desc_partition_name;
+ const uint8_t* desc_partition_name = NULL;
const uint8_t* desc_salt;
const uint8_t* desc_digest;
char part_name[PART_NAME_MAX_SIZE];
@@ -75,9 +106,12 @@ static AvbSlotVerifyResult load_and_verify_hash_partition(
goto out;
}
- if (!avb_str_concat(
- part_name, sizeof part_name, (const char*)desc_partition_name,
- hash_desc.partition_name_len, ab_suffix, avb_strlen(ab_suffix))) {
+ if (!avb_str_concat(part_name,
+ sizeof part_name,
+ (const char*)desc_partition_name,
+ hash_desc.partition_name_len,
+ ab_suffix,
+ avb_strlen(ab_suffix))) {
avb_error("Partition name and suffix does not fit.\n");
ret = AVB_SLOT_VERIFY_RESULT_ERROR_INVALID_METADATA;
goto out;
@@ -89,9 +123,12 @@ static AvbSlotVerifyResult load_and_verify_hash_partition(
goto out;
}
- io_ret =
- ops->read_from_partition(ops, part_name, 0 /* offset */,
- hash_desc.image_size, image_buf, &part_num_read);
+ io_ret = ops->read_from_partition(ops,
+ part_name,
+ 0 /* offset */,
+ hash_desc.image_size,
+ image_buf,
+ &part_num_read);
if (io_ret == AVB_IO_RESULT_ERROR_OOM) {
ret = AVB_SLOT_VERIFY_RESULT_ERROR_OOM;
goto out;
@@ -127,41 +164,46 @@ static AvbSlotVerifyResult load_and_verify_hash_partition(
}
if (digest_len != hash_desc.digest_len) {
- avb_errorv(part_name, ": Digest in descriptor not of expected size.\n",
- NULL);
+ avb_errorv(
+ part_name, ": Digest in descriptor not of expected size.\n", NULL);
ret = AVB_SLOT_VERIFY_RESULT_ERROR_INVALID_METADATA;
goto out;
}
if (avb_safe_memcmp(digest, desc_digest, digest_len) != 0) {
avb_errorv(part_name,
- ": Hash of data does not match digest in descriptor.\n", NULL);
+ ": Hash of data does not match digest in descriptor.\n",
+ NULL);
ret = AVB_SLOT_VERIFY_RESULT_ERROR_VERIFICATION;
goto out;
}
ret = AVB_SLOT_VERIFY_RESULT_OK;
- /* If this is the requested partition, copy to slot_data. */
- found =
- avb_strv_find_str(requested_partitions, (const char*)desc_partition_name,
- hash_desc.partition_name_len);
- if (found != NULL) {
- AvbPartitionData* loaded_partition;
- if (slot_data->num_loaded_partitions == MAX_NUMBER_OF_LOADED_PARTITIONS) {
- avb_errorv(part_name, ": Too many loaded partitions.\n", NULL);
- ret = AVB_SLOT_VERIFY_RESULT_ERROR_OOM;
- goto out;
+out:
+
+ if (ret == AVB_SLOT_VERIFY_RESULT_OK || result_should_continue(ret)) {
+ /* If this is the requested partition, copy to slot_data. */
+ found = avb_strv_find_str(requested_partitions,
+ (const char*)desc_partition_name,
+ hash_desc.partition_name_len);
+ if (found != NULL) {
+ AvbPartitionData* loaded_partition;
+ if (slot_data->num_loaded_partitions == MAX_NUMBER_OF_LOADED_PARTITIONS) {
+ avb_errorv(part_name, ": Too many loaded partitions.\n", NULL);
+ ret = AVB_SLOT_VERIFY_RESULT_ERROR_OOM;
+ goto fail;
+ }
+ loaded_partition =
+ &slot_data->loaded_partitions[slot_data->num_loaded_partitions++];
+ loaded_partition->partition_name = avb_strdup(found);
+ loaded_partition->data_size = hash_desc.image_size;
+ loaded_partition->data = image_buf;
+ image_buf = NULL;
}
- loaded_partition =
- &slot_data->loaded_partitions[slot_data->num_loaded_partitions++];
- loaded_partition->partition_name = avb_strdup(found);
- loaded_partition->data_size = hash_desc.image_size;
- loaded_partition->data = image_buf;
- image_buf = NULL;
}
-out:
+fail:
if (image_buf != NULL) {
avb_free(image_buf);
}
@@ -169,10 +211,17 @@ out:
}
static AvbSlotVerifyResult load_and_verify_vbmeta(
- AvbOps* ops, const char* const* requested_partitions, const char* ab_suffix,
- int rollback_index_slot, const char* partition_name,
- size_t partition_name_len, const uint8_t* expected_public_key,
- size_t expected_public_key_length, AvbSlotVerifyData* slot_data,
+ AvbOps* ops,
+ const char* const* requested_partitions,
+ const char* ab_suffix,
+ bool allow_verification_error,
+ AvbVBMetaImageFlags toplevel_vbmeta_flags,
+ int rollback_index_location,
+ const char* partition_name,
+ size_t partition_name_len,
+ const uint8_t* expected_public_key,
+ size_t expected_public_key_length,
+ AvbSlotVerifyData* slot_data,
AvbAlgorithmType* out_algorithm_type) {
char full_partition_name[PART_NAME_MAX_SIZE];
AvbSlotVerifyResult ret;
@@ -189,11 +238,20 @@ static AvbSlotVerifyResult load_and_verify_vbmeta(
const AvbDescriptor** descriptors = NULL;
size_t num_descriptors;
size_t n;
- int is_main_vbmeta;
+ bool is_main_vbmeta;
+ bool is_vbmeta_partition;
+ AvbVBMetaData* vbmeta_image_data = NULL;
+
+ ret = AVB_SLOT_VERIFY_RESULT_OK;
avb_assert(slot_data != NULL);
- is_main_vbmeta = (avb_strcmp(partition_name, "vbmeta") == 0);
+ /* Since we allow top-level vbmeta in 'boot', use
+ * rollback_index_location to determine whether we're the main
+ * vbmeta struct.
+ */
+ is_main_vbmeta = (rollback_index_location == 0);
+ is_vbmeta_partition = (avb_strcmp(partition_name, "vbmeta") == 0);
if (!avb_validate_utf8((const uint8_t*)partition_name, partition_name_len)) {
avb_error("Partition name is not valid UTF-8.\n");
@@ -202,22 +260,27 @@ static AvbSlotVerifyResult load_and_verify_vbmeta(
}
/* Construct full partition name. */
- if (!avb_str_concat(full_partition_name, sizeof full_partition_name,
- partition_name, partition_name_len, ab_suffix,
+ if (!avb_str_concat(full_partition_name,
+ sizeof full_partition_name,
+ partition_name,
+ partition_name_len,
+ ab_suffix,
avb_strlen(ab_suffix))) {
avb_error("Partition name and suffix does not fit.\n");
ret = AVB_SLOT_VERIFY_RESULT_ERROR_INVALID_METADATA;
goto out;
}
- avb_debugv("Loading vbmeta struct from partition '", full_partition_name,
- "'.\n", NULL);
+ avb_debugv("Loading vbmeta struct from partition '",
+ full_partition_name,
+ "'.\n",
+ NULL);
/* If we're loading from the main vbmeta partition, the vbmeta
* struct is in the beginning. Otherwise we have to locate it via a
* footer.
*/
- if (is_main_vbmeta) {
+ if (is_vbmeta_partition) {
vbmeta_offset = 0;
vbmeta_size = VBMETA_MAX_SIZE;
} else {
@@ -225,9 +288,12 @@ static AvbSlotVerifyResult load_and_verify_vbmeta(
size_t footer_num_read;
AvbFooter footer;
- io_ret =
- ops->read_from_partition(ops, full_partition_name, -AVB_FOOTER_SIZE,
- AVB_FOOTER_SIZE, footer_buf, &footer_num_read);
+ io_ret = ops->read_from_partition(ops,
+ full_partition_name,
+ -AVB_FOOTER_SIZE,
+ AVB_FOOTER_SIZE,
+ footer_buf,
+ &footer_num_read);
if (io_ret == AVB_IO_RESULT_ERROR_OOM) {
ret = AVB_SLOT_VERIFY_RESULT_ERROR_OOM;
goto out;
@@ -247,8 +313,8 @@ static AvbSlotVerifyResult load_and_verify_vbmeta(
/* Basic footer sanity check since the data is untrusted. */
if (footer.vbmeta_size > VBMETA_MAX_SIZE) {
- avb_errorv(full_partition_name, ": Invalid vbmeta size in footer.\n",
- NULL);
+ avb_errorv(
+ full_partition_name, ": Invalid vbmeta size in footer.\n", NULL);
ret = AVB_SLOT_VERIFY_RESULT_ERROR_INVALID_METADATA;
goto out;
}
@@ -263,15 +329,42 @@ static AvbSlotVerifyResult load_and_verify_vbmeta(
goto out;
}
- io_ret = ops->read_from_partition(ops, full_partition_name, vbmeta_offset,
- vbmeta_size, vbmeta_buf, &vbmeta_num_read);
+ io_ret = ops->read_from_partition(ops,
+ full_partition_name,
+ vbmeta_offset,
+ vbmeta_size,
+ vbmeta_buf,
+ &vbmeta_num_read);
if (io_ret == AVB_IO_RESULT_ERROR_OOM) {
ret = AVB_SLOT_VERIFY_RESULT_ERROR_OOM;
goto out;
} else if (io_ret != AVB_IO_RESULT_OK) {
- avb_errorv(full_partition_name, ": Error loading vbmeta data.\n", NULL);
- ret = AVB_SLOT_VERIFY_RESULT_ERROR_IO;
- goto out;
+ /* If we're looking for 'vbmeta' but there is no such partition,
+ * go try to get it from the boot partition instead.
+ */
+ if (is_main_vbmeta && io_ret == AVB_IO_RESULT_ERROR_NO_SUCH_PARTITION &&
+ is_vbmeta_partition) {
+ avb_debugv(full_partition_name,
+ ": No such partition. Trying 'boot' instead.\n",
+ NULL);
+ ret = load_and_verify_vbmeta(ops,
+ requested_partitions,
+ ab_suffix,
+ allow_verification_error,
+ 0 /* toplevel_vbmeta_flags */,
+ 0 /* rollback_index_location */,
+ "boot",
+ avb_strlen("boot"),
+ NULL /* expected_public_key */,
+ 0 /* expected_public_key_length */,
+ slot_data,
+ out_algorithm_type);
+ goto out;
+ } else {
+ avb_errorv(full_partition_name, ": Error loading vbmeta data.\n", NULL);
+ ret = AVB_SLOT_VERIFY_RESULT_ERROR_IO;
+ goto out;
+ }
}
avb_assert(vbmeta_num_read <= vbmeta_size);
@@ -280,60 +373,121 @@ static AvbSlotVerifyResult load_and_verify_vbmeta(
*/
vbmeta_ret =
avb_vbmeta_image_verify(vbmeta_buf, vbmeta_num_read, &pk_data, &pk_len);
- if (vbmeta_ret != AVB_VBMETA_VERIFY_RESULT_OK) {
- avb_errorv(full_partition_name, ": Error verifying vbmeta image.\n", NULL);
- ret = AVB_SLOT_VERIFY_RESULT_ERROR_VERIFICATION;
- goto out;
- }
+ switch (vbmeta_ret) {
+ case AVB_VBMETA_VERIFY_RESULT_OK:
+ avb_assert(pk_data != NULL && pk_len > 0);
+ break;
- /* Check if key used to make signature matches what is expected. */
- if (expected_public_key != NULL) {
- avb_assert(!is_main_vbmeta);
- if (expected_public_key_length != pk_len ||
- avb_safe_memcmp(expected_public_key, pk_data, pk_len) != 0) {
+ case AVB_VBMETA_VERIFY_RESULT_OK_NOT_SIGNED:
+ case AVB_VBMETA_VERIFY_RESULT_HASH_MISMATCH:
+ case AVB_VBMETA_VERIFY_RESULT_SIGNATURE_MISMATCH:
+ ret = AVB_SLOT_VERIFY_RESULT_ERROR_VERIFICATION;
avb_errorv(full_partition_name,
- ": Public key used to sign data does not match key in chain "
- "partition descriptor.\n",
+ ": Error verifying vbmeta image: ",
+ avb_vbmeta_verify_result_to_string(vbmeta_ret),
+ "\n",
NULL);
- ret = AVB_SLOT_VERIFY_RESULT_ERROR_PUBLIC_KEY_REJECTED;
- goto out;
- }
- } else {
- bool key_is_trusted = false;
+ if (!allow_verification_error) {
+ goto out;
+ }
+ break;
- avb_assert(is_main_vbmeta);
- io_ret =
- ops->validate_vbmeta_public_key(ops, pk_data, pk_len, &key_is_trusted);
- if (io_ret == AVB_IO_RESULT_ERROR_OOM) {
- ret = AVB_SLOT_VERIFY_RESULT_ERROR_OOM;
- goto out;
- } else if (io_ret != AVB_IO_RESULT_OK) {
+ case AVB_VBMETA_VERIFY_RESULT_INVALID_VBMETA_HEADER:
+ /* No way to continue this case. */
+ ret = AVB_SLOT_VERIFY_RESULT_ERROR_INVALID_METADATA;
avb_errorv(full_partition_name,
- ": Error while checking public key used to sign data.\n",
+ ": Error verifying vbmeta image: invalid vbmeta header\n",
NULL);
- ret = AVB_SLOT_VERIFY_RESULT_ERROR_IO;
goto out;
- }
- if (!key_is_trusted) {
+
+ case AVB_VBMETA_VERIFY_RESULT_UNSUPPORTED_VERSION:
+ /* No way to continue this case. */
+ ret = AVB_SLOT_VERIFY_RESULT_ERROR_UNSUPPORTED_VERSION;
avb_errorv(full_partition_name,
- ": Public key used to sign data rejected.\n", NULL);
- ret = AVB_SLOT_VERIFY_RESULT_ERROR_PUBLIC_KEY_REJECTED;
+ ": Error verifying vbmeta image: unsupported AVB version\n",
+ NULL);
goto out;
- }
}
+ /* Byteswap the header. */
avb_vbmeta_image_header_to_host_byte_order((AvbVBMetaImageHeader*)vbmeta_buf,
&vbmeta_header);
+ /* If we're the toplevel, assign flags so they'll be passed down. */
+ if (is_main_vbmeta) {
+ toplevel_vbmeta_flags = (AvbVBMetaImageFlags)vbmeta_header.flags;
+ } else {
+ if (vbmeta_header.flags != 0) {
+ ret = AVB_SLOT_VERIFY_RESULT_ERROR_INVALID_METADATA;
+ avb_errorv(full_partition_name,
+ ": chained vbmeta image has non-zero flags\n",
+ NULL);
+ goto out;
+ }
+ }
+
+ /* Check if key used to make signature matches what is expected. */
+ if (pk_data != NULL) {
+ if (expected_public_key != NULL) {
+ avb_assert(!is_main_vbmeta);
+ if (expected_public_key_length != pk_len ||
+ avb_safe_memcmp(expected_public_key, pk_data, pk_len) != 0) {
+ avb_errorv(full_partition_name,
+ ": Public key used to sign data does not match key in chain "
+ "partition descriptor.\n",
+ NULL);
+ ret = AVB_SLOT_VERIFY_RESULT_ERROR_PUBLIC_KEY_REJECTED;
+ if (!allow_verification_error) {
+ goto out;
+ }
+ }
+ } else {
+ bool key_is_trusted = true;
+ const uint8_t* pk_metadata = NULL;
+ size_t pk_metadata_len = 0;
+
+ if (vbmeta_header.public_key_metadata_size > 0) {
+ pk_metadata = vbmeta_buf + sizeof(AvbVBMetaImageHeader) +
+ vbmeta_header.authentication_data_block_size +
+ vbmeta_header.public_key_metadata_offset;
+ pk_metadata_len = vbmeta_header.public_key_metadata_size;
+ }
+
+ avb_assert(is_main_vbmeta);
+ io_ret = ops->validate_vbmeta_public_key(
+ ops, pk_data, pk_len, pk_metadata, pk_metadata_len, &key_is_trusted);
+ if (io_ret == AVB_IO_RESULT_ERROR_OOM) {
+ ret = AVB_SLOT_VERIFY_RESULT_ERROR_OOM;
+ goto out;
+ } else if (io_ret != AVB_IO_RESULT_OK) {
+ avb_errorv(full_partition_name,
+ ": Error while checking public key used to sign data.\n",
+ NULL);
+ ret = AVB_SLOT_VERIFY_RESULT_ERROR_IO;
+ goto out;
+ }
+ if (!key_is_trusted) {
+ avb_errorv(full_partition_name,
+ ": Public key used to sign data rejected.\n",
+ NULL);
+ ret = AVB_SLOT_VERIFY_RESULT_ERROR_PUBLIC_KEY_REJECTED;
+ if (!allow_verification_error) {
+ goto out;
+ }
+ }
+ }
+ }
+
/* Check rollback index. */
- io_ret = ops->read_rollback_index(ops, rollback_index_slot,
- &stored_rollback_index);
+ io_ret = ops->read_rollback_index(
+ ops, rollback_index_location, &stored_rollback_index);
if (io_ret == AVB_IO_RESULT_ERROR_OOM) {
ret = AVB_SLOT_VERIFY_RESULT_ERROR_OOM;
goto out;
} else if (io_ret != AVB_IO_RESULT_OK) {
avb_errorv(full_partition_name,
- ": Error getting rollback index for slot.\n", NULL);
+ ": Error getting rollback index for location.\n",
+ NULL);
ret = AVB_SLOT_VERIFY_RESULT_ERROR_IO;
goto out;
}
@@ -343,8 +497,35 @@ static AvbSlotVerifyResult load_and_verify_vbmeta(
": Image rollback index is less than the stored rollback index.\n",
NULL);
ret = AVB_SLOT_VERIFY_RESULT_ERROR_ROLLBACK_INDEX;
+ if (!allow_verification_error) {
+ goto out;
+ }
+ }
+
+ /* Copy vbmeta to vbmeta_images before recursing. */
+ if (is_main_vbmeta) {
+ avb_assert(slot_data->num_vbmeta_images == 0);
+ } else {
+ avb_assert(slot_data->num_vbmeta_images > 0);
+ }
+ if (slot_data->num_vbmeta_images == MAX_NUMBER_OF_VBMETA_IMAGES) {
+ avb_errorv(full_partition_name, ": Too many vbmeta images.\n", NULL);
+ ret = AVB_SLOT_VERIFY_RESULT_ERROR_OOM;
goto out;
}
+ vbmeta_image_data = &slot_data->vbmeta_images[slot_data->num_vbmeta_images++];
+ vbmeta_image_data->partition_name = avb_strdup(partition_name);
+ vbmeta_image_data->vbmeta_data = vbmeta_buf;
+ /* Note that |vbmeta_buf| is actually |vbmeta_num_read| bytes long
+ * and this includes data past the end of the image. Pass the
+ * actual size of the vbmeta image. Also, no need to use
+ * avb_safe_add() since the header has already been verified.
+ */
+ vbmeta_image_data->vbmeta_size =
+ sizeof(AvbVBMetaImageHeader) +
+ vbmeta_header.authentication_data_block_size +
+ vbmeta_header.auxiliary_data_block_size;
+ vbmeta_image_data->verify_result = vbmeta_ret;
/* Now go through all descriptors and take the appropriate action:
*
@@ -372,11 +553,17 @@ static AvbSlotVerifyResult load_and_verify_vbmeta(
switch (desc.tag) {
case AVB_DESCRIPTOR_TAG_HASH: {
AvbSlotVerifyResult sub_ret;
- sub_ret = load_and_verify_hash_partition(
- ops, requested_partitions, ab_suffix, descriptors[n], slot_data);
+ sub_ret = load_and_verify_hash_partition(ops,
+ requested_partitions,
+ ab_suffix,
+ allow_verification_error,
+ descriptors[n],
+ slot_data);
if (sub_ret != AVB_SLOT_VERIFY_RESULT_OK) {
ret = sub_ret;
- goto out;
+ if (!allow_verification_error || !result_should_continue(ret)) {
+ goto out;
+ }
}
} break;
@@ -398,7 +585,17 @@ static AvbSlotVerifyResult load_and_verify_vbmeta(
if (!avb_chain_partition_descriptor_validate_and_byteswap(
(AvbChainPartitionDescriptor*)descriptors[n], &chain_desc)) {
avb_errorv(full_partition_name,
- ": Chain partition descriptor is invalid.\n", NULL);
+ ": Chain partition descriptor is invalid.\n",
+ NULL);
+ ret = AVB_SLOT_VERIFY_RESULT_ERROR_INVALID_METADATA;
+ goto out;
+ }
+
+ if (chain_desc.rollback_index_location == 0) {
+ avb_errorv(full_partition_name,
+ ": Chain partition has invalid "
+ "rollback_index_location field.\n",
+ NULL);
ret = AVB_SLOT_VERIFY_RESULT_ERROR_INVALID_METADATA;
goto out;
}
@@ -407,27 +604,37 @@ static AvbSlotVerifyResult load_and_verify_vbmeta(
sizeof(AvbChainPartitionDescriptor);
chain_public_key = chain_partition_name + chain_desc.partition_name_len;
- sub_ret = load_and_verify_vbmeta(
- ops, requested_partitions, ab_suffix,
- chain_desc.rollback_index_slot, (const char*)chain_partition_name,
- chain_desc.partition_name_len, chain_public_key,
- chain_desc.public_key_len, slot_data,
- NULL /* out_algorithm_type */);
+ sub_ret = load_and_verify_vbmeta(ops,
+ requested_partitions,
+ ab_suffix,
+ allow_verification_error,
+ toplevel_vbmeta_flags,
+ chain_desc.rollback_index_location,
+ (const char*)chain_partition_name,
+ chain_desc.partition_name_len,
+ chain_public_key,
+ chain_desc.public_key_len,
+ slot_data,
+ NULL /* out_algorithm_type */);
if (sub_ret != AVB_SLOT_VERIFY_RESULT_OK) {
ret = sub_ret;
- goto out;
+ if (!result_should_continue(ret)) {
+ goto out;
+ }
}
} break;
case AVB_DESCRIPTOR_TAG_KERNEL_CMDLINE: {
const uint8_t* kernel_cmdline;
AvbKernelCmdlineDescriptor kernel_cmdline_desc;
+ bool apply_cmdline;
if (!avb_kernel_cmdline_descriptor_validate_and_byteswap(
(AvbKernelCmdlineDescriptor*)descriptors[n],
&kernel_cmdline_desc)) {
avb_errorv(full_partition_name,
- ": Kernel cmdline descriptor is invalid.\n", NULL);
+ ": Kernel cmdline descriptor is invalid.\n",
+ NULL);
ret = AVB_SLOT_VERIFY_RESULT_ERROR_INVALID_METADATA;
goto out;
}
@@ -438,36 +645,59 @@ static AvbSlotVerifyResult load_and_verify_vbmeta(
if (!avb_validate_utf8(kernel_cmdline,
kernel_cmdline_desc.kernel_cmdline_length)) {
avb_errorv(full_partition_name,
- ": Kernel cmdline is not valid UTF-8.\n", NULL);
+ ": Kernel cmdline is not valid UTF-8.\n",
+ NULL);
ret = AVB_SLOT_VERIFY_RESULT_ERROR_INVALID_METADATA;
goto out;
}
- if (slot_data->cmdline == NULL) {
- slot_data->cmdline =
- avb_calloc(kernel_cmdline_desc.kernel_cmdline_length + 1);
- if (slot_data->cmdline == NULL) {
- ret = AVB_SLOT_VERIFY_RESULT_ERROR_OOM;
- goto out;
+ /* Compare the flags for top-level VBMeta struct with flags in
+ * the command-line descriptor so command-line snippets only
+ * intended for a certain mode (dm-verity enabled/disabled)
+ * are skipped if applicable.
+ */
+ apply_cmdline = true;
+ if (toplevel_vbmeta_flags & AVB_VBMETA_IMAGE_FLAGS_HASHTREE_DISABLED) {
+ if (kernel_cmdline_desc.flags &
+ AVB_KERNEL_CMDLINE_FLAGS_USE_ONLY_IF_HASHTREE_NOT_DISABLED) {
+ apply_cmdline = false;
}
- avb_memcpy(slot_data->cmdline, kernel_cmdline,
- kernel_cmdline_desc.kernel_cmdline_length);
} else {
- /* new cmdline is: <existing_cmdline> + ' ' + <newcmdline> + '\0' */
- size_t orig_size = avb_strlen(slot_data->cmdline);
- size_t new_size =
- orig_size + 1 + kernel_cmdline_desc.kernel_cmdline_length + 1;
- char* new_cmdline = avb_calloc(new_size);
- if (new_cmdline == NULL) {
- ret = AVB_SLOT_VERIFY_RESULT_ERROR_OOM;
- goto out;
+ if (kernel_cmdline_desc.flags &
+ AVB_KERNEL_CMDLINE_FLAGS_USE_ONLY_IF_HASHTREE_DISABLED) {
+ apply_cmdline = false;
+ }
+ }
+
+ if (apply_cmdline) {
+ if (slot_data->cmdline == NULL) {
+ slot_data->cmdline =
+ avb_calloc(kernel_cmdline_desc.kernel_cmdline_length + 1);
+ if (slot_data->cmdline == NULL) {
+ ret = AVB_SLOT_VERIFY_RESULT_ERROR_OOM;
+ goto out;
+ }
+ avb_memcpy(slot_data->cmdline,
+ kernel_cmdline,
+ kernel_cmdline_desc.kernel_cmdline_length);
+ } else {
+ /* new cmdline is: <existing_cmdline> + ' ' + <newcmdline> + '\0' */
+ size_t orig_size = avb_strlen(slot_data->cmdline);
+ size_t new_size =
+ orig_size + 1 + kernel_cmdline_desc.kernel_cmdline_length + 1;
+ char* new_cmdline = avb_calloc(new_size);
+ if (new_cmdline == NULL) {
+ ret = AVB_SLOT_VERIFY_RESULT_ERROR_OOM;
+ goto out;
+ }
+ avb_memcpy(new_cmdline, slot_data->cmdline, orig_size);
+ new_cmdline[orig_size] = ' ';
+ avb_memcpy(new_cmdline + orig_size + 1,
+ kernel_cmdline,
+ kernel_cmdline_desc.kernel_cmdline_length);
+ avb_free(slot_data->cmdline);
+ slot_data->cmdline = new_cmdline;
}
- avb_memcpy(new_cmdline, slot_data->cmdline, orig_size);
- new_cmdline[orig_size] = ' ';
- avb_memcpy(new_cmdline + orig_size + 1, kernel_cmdline,
- kernel_cmdline_desc.kernel_cmdline_length);
- avb_free(slot_data->cmdline);
- slot_data->cmdline = new_cmdline;
}
} break;
@@ -479,32 +709,14 @@ static AvbSlotVerifyResult load_and_verify_vbmeta(
}
}
- ret = AVB_SLOT_VERIFY_RESULT_OK;
-
- /* So far, so good. Copy needed data to user, if requested. */
- if (is_main_vbmeta) {
- if (slot_data->vbmeta_data != NULL) {
- avb_free(slot_data->vbmeta_data);
- }
- /* Note that |vbmeta_buf| is actually |vbmeta_num_read| bytes long
- * and this includes data past the end of the image. Pass the
- * actual size of the vbmeta image. Also, no need to use
- * avb_safe_add() since the header has already been verified.
- */
- slot_data->vbmeta_size = sizeof(AvbVBMetaImageHeader) +
- vbmeta_header.authentication_data_block_size +
- vbmeta_header.auxiliary_data_block_size;
- slot_data->vbmeta_data = vbmeta_buf;
- vbmeta_buf = NULL;
- }
-
- if (rollback_index_slot >= AVB_MAX_NUMBER_OF_ROLLBACK_INDEX_SLOTS) {
- avb_errorv(full_partition_name, ": Invalid rollback_index_slot.\n", NULL);
+ if (rollback_index_location >= AVB_MAX_NUMBER_OF_ROLLBACK_INDEX_LOCATIONS) {
+ avb_errorv(
+ full_partition_name, ": Invalid rollback_index_location.\n", NULL);
ret = AVB_SLOT_VERIFY_RESULT_ERROR_INVALID_METADATA;
goto out;
}
- slot_data->rollback_indexes[rollback_index_slot] =
+ slot_data->rollback_indexes[rollback_index_location] =
vbmeta_header.rollback_index;
if (out_algorithm_type != NULL) {
@@ -512,8 +724,13 @@ static AvbSlotVerifyResult load_and_verify_vbmeta(
}
out:
- if (vbmeta_buf != NULL) {
- avb_free(vbmeta_buf);
+ /* If |vbmeta_image_data| isn't NULL it means that it adopted
+ * |vbmeta_buf| so in that case don't free it here.
+ */
+ if (vbmeta_image_data == NULL) {
+ if (vbmeta_buf != NULL) {
+ avb_free(vbmeta_buf);
+ }
}
if (descriptors != NULL) {
avb_free(descriptors);
@@ -521,35 +738,47 @@ out:
return ret;
}
-#define NUM_GUIDS 2
+#define NUM_GUIDS 3
/* Substitutes all variables (e.g. $(ANDROID_SYSTEM_PARTUUID)) with
* values. Returns NULL on OOM, otherwise the cmdline with values
* replaced.
*/
-static char* sub_cmdline(AvbOps* ops, const char* cmdline,
- const char* ab_suffix) {
- const char* part_name_str[NUM_GUIDS] = {"system", "boot"};
+static char* sub_cmdline(AvbOps* ops,
+ const char* cmdline,
+ const char* ab_suffix,
+ bool using_boot_for_vbmeta) {
+ const char* part_name_str[NUM_GUIDS] = {"system", "boot", "vbmeta"};
const char* replace_str[NUM_GUIDS] = {"$(ANDROID_SYSTEM_PARTUUID)",
- "$(ANDROID_BOOT_PARTUUID)"};
+ "$(ANDROID_BOOT_PARTUUID)",
+ "$(ANDROID_VBMETA_PARTUUID)"};
char* ret = NULL;
AvbIOResult io_ret;
+ /* Special-case for when the top-level vbmeta struct is in the boot
+ * partition.
+ */
+ if (using_boot_for_vbmeta) {
+ part_name_str[2] = "boot";
+ }
+
/* Replace unique partition GUIDs */
for (size_t n = 0; n < NUM_GUIDS; n++) {
char part_name[PART_NAME_MAX_SIZE];
char guid_buf[37];
- char* new_ret;
- if (!avb_str_concat(part_name, sizeof part_name, part_name_str[n],
- avb_strlen(part_name_str[n]), ab_suffix,
+ if (!avb_str_concat(part_name,
+ sizeof part_name,
+ part_name_str[n],
+ avb_strlen(part_name_str[n]),
+ ab_suffix,
avb_strlen(ab_suffix))) {
avb_error("Partition name and suffix does not fit.\n");
goto fail;
}
- io_ret = ops->get_unique_guid_for_partition(ops, part_name, guid_buf,
- sizeof guid_buf);
+ io_ret = ops->get_unique_guid_for_partition(
+ ops, part_name, guid_buf, sizeof guid_buf);
if (io_ret == AVB_IO_RESULT_ERROR_OOM) {
return NULL;
} else if (io_ret != AVB_IO_RESULT_OK) {
@@ -558,14 +787,15 @@ static char* sub_cmdline(AvbOps* ops, const char* cmdline,
}
if (ret == NULL) {
- new_ret = avb_replace(cmdline, replace_str[n], guid_buf);
+ ret = avb_replace(cmdline, replace_str[n], guid_buf);
} else {
- new_ret = avb_replace(ret, replace_str[n], guid_buf);
+ char* new_ret = avb_replace(ret, replace_str[n], guid_buf);
+ avb_free(ret);
+ ret = new_ret;
}
- if (new_ret == NULL) {
+ if (ret == NULL) {
goto fail;
}
- ret = new_ret;
}
return ret;
@@ -577,7 +807,8 @@ fail:
return NULL;
}
-static int cmdline_append_option(AvbSlotVerifyData* slot_data, const char* key,
+static int cmdline_append_option(AvbSlotVerifyData* slot_data,
+ const char* key,
const char* value) {
size_t offset, key_len, value_len;
char* new_cmdline;
@@ -612,14 +843,17 @@ static int cmdline_append_option(AvbSlotVerifyData* slot_data, const char* key,
return 1;
}
-static int cmdline_append_uint64_base10(AvbSlotVerifyData* slot_data,
- const char* key, uint64_t value) {
- const int MAX_DIGITS = 32;
- char rev_digits[MAX_DIGITS];
- char digits[MAX_DIGITS];
+#define AVB_MAX_DIGITS_UINT64 32
+
+/* Writes |value| to |digits| in base 10 followed by a NUL byte.
+ * Returns number of characters written excluding the NUL byte.
+ */
+static size_t uint64_to_base10(uint64_t value,
+ char digits[AVB_MAX_DIGITS_UINT64]) {
+ char rev_digits[AVB_MAX_DIGITS_UINT64];
size_t n, num_digits;
- for (num_digits = 0; num_digits < MAX_DIGITS - 1;) {
+ for (num_digits = 0; num_digits < AVB_MAX_DIGITS_UINT64 - 1;) {
rev_digits[num_digits++] = (value % 10) + '0';
value /= 10;
if (value == 0) {
@@ -631,19 +865,49 @@ static int cmdline_append_uint64_base10(AvbSlotVerifyData* slot_data,
digits[n] = rev_digits[num_digits - 1 - n];
}
digits[n] = '\0';
+ return n;
+}
+
+static int cmdline_append_version(AvbSlotVerifyData* slot_data,
+ const char* key,
+ uint64_t major_version,
+ uint64_t minor_version) {
+ char major_digits[AVB_MAX_DIGITS_UINT64];
+ char minor_digits[AVB_MAX_DIGITS_UINT64];
+ char combined[AVB_MAX_DIGITS_UINT64 * 2 + 1];
+ size_t num_major_digits, num_minor_digits;
+
+ num_major_digits = uint64_to_base10(major_version, major_digits);
+ num_minor_digits = uint64_to_base10(minor_version, minor_digits);
+ avb_memcpy(combined, major_digits, num_major_digits);
+ combined[num_major_digits] = '.';
+ avb_memcpy(combined + num_major_digits + 1, minor_digits, num_minor_digits);
+ combined[num_major_digits + 1 + num_minor_digits] = '\0';
+
+ return cmdline_append_option(slot_data, key, combined);
+}
+static int cmdline_append_uint64_base10(AvbSlotVerifyData* slot_data,
+ const char* key,
+ uint64_t value) {
+ char digits[AVB_MAX_DIGITS_UINT64];
+ uint64_to_base10(value, digits);
return cmdline_append_option(slot_data, key, digits);
}
-static int cmdline_append_hex(AvbSlotVerifyData* slot_data, const char* key,
- const uint8_t* data, size_t data_len) {
+static int cmdline_append_hex(AvbSlotVerifyData* slot_data,
+ const char* key,
+ const uint8_t* data,
+ size_t data_len) {
char hex_digits[17] = "0123456789abcdef";
char* hex_data;
int ret;
size_t n;
hex_data = avb_malloc(data_len * 2 + 1);
- if (hex_data == NULL) return 0;
+ if (hex_data == NULL) {
+ return 0;
+ }
for (n = 0; n < data_len; n++) {
hex_data[n * 2] = hex_digits[data[n] >> 4];
@@ -659,11 +923,13 @@ static int cmdline_append_hex(AvbSlotVerifyData* slot_data, const char* key,
AvbSlotVerifyResult avb_slot_verify(AvbOps* ops,
const char* const* requested_partitions,
const char* ab_suffix,
+ bool allow_verification_error,
AvbSlotVerifyData** out_data) {
AvbSlotVerifyResult ret;
AvbSlotVerifyData* slot_data = NULL;
AvbAlgorithmType algorithm_type = AVB_ALGORITHM_TYPE_NONE;
AvbIOResult io_ret;
+ bool using_boot_for_vbmeta = false;
if (out_data != NULL) {
*out_data = NULL;
@@ -674,6 +940,12 @@ AvbSlotVerifyResult avb_slot_verify(AvbOps* ops,
ret = AVB_SLOT_VERIFY_RESULT_ERROR_OOM;
goto fail;
}
+ slot_data->vbmeta_images =
+ avb_calloc(sizeof(AvbVBMetaData) * MAX_NUMBER_OF_VBMETA_IMAGES);
+ if (slot_data->vbmeta_images == NULL) {
+ ret = AVB_SLOT_VERIFY_RESULT_ERROR_OOM;
+ goto fail;
+ }
slot_data->loaded_partitions =
avb_calloc(sizeof(AvbPartitionData) * MAX_NUMBER_OF_LOADED_PARTITIONS);
if (slot_data->loaded_partitions == NULL) {
@@ -681,13 +953,30 @@ AvbSlotVerifyResult avb_slot_verify(AvbOps* ops,
goto fail;
}
- ret = load_and_verify_vbmeta(
- ops, requested_partitions, ab_suffix, 0 /* rollback_index_slot */,
- "vbmeta", avb_strlen("vbmeta"), NULL /* expected_public_key */,
- 0 /* expected_public_key_length */, slot_data, &algorithm_type);
+ ret = load_and_verify_vbmeta(ops,
+ requested_partitions,
+ ab_suffix,
+ allow_verification_error,
+ 0 /* toplevel_vbmeta_flags */,
+ 0 /* rollback_index_location */,
+ "vbmeta",
+ avb_strlen("vbmeta"),
+ NULL /* expected_public_key */,
+ 0 /* expected_public_key_length */,
+ slot_data,
+ &algorithm_type);
+ if (!allow_verification_error && ret != AVB_SLOT_VERIFY_RESULT_OK) {
+ goto fail;
+ }
+
+ if (avb_strcmp(slot_data->vbmeta_images[0].partition_name, "vbmeta") != 0) {
+ avb_assert(avb_strcmp(slot_data->vbmeta_images[0].partition_name, "boot") ==
+ 0);
+ using_boot_for_vbmeta = true;
+ }
/* If things check out, mangle the kernel command-line as needed. */
- if (ret == AVB_SLOT_VERIFY_RESULT_OK) {
+ if (result_should_continue(ret)) {
/* Fill in |ab_suffix| field. */
slot_data->ab_suffix = avb_strdup(ab_suffix);
if (slot_data->ab_suffix == NULL) {
@@ -695,9 +984,28 @@ AvbSlotVerifyResult avb_slot_verify(AvbOps* ops,
goto fail;
}
+ /* Add androidboot.vbmeta.device option. */
+ if (!cmdline_append_option(slot_data,
+ "androidboot.vbmeta.device",
+ "PARTUUID=$(ANDROID_VBMETA_PARTUUID)")) {
+ ret = AVB_SLOT_VERIFY_RESULT_ERROR_OOM;
+ goto fail;
+ }
+
+ /* Add androidboot.vbmeta.avb_version option. */
+ if (!cmdline_append_version(slot_data,
+ "androidboot.vbmeta.avb_version",
+ AVB_VERSION_MAJOR,
+ AVB_VERSION_MINOR)) {
+ ret = AVB_SLOT_VERIFY_RESULT_ERROR_OOM;
+ goto fail;
+ }
+
/* Substitute $(ANDROID_SYSTEM_PARTUUID) and friends. */
if (slot_data->cmdline != NULL) {
- char* new_cmdline = sub_cmdline(ops, slot_data->cmdline, ab_suffix);
+ char* new_cmdline;
+ new_cmdline = sub_cmdline(
+ ops, slot_data->cmdline, ab_suffix, using_boot_for_vbmeta);
if (new_cmdline == NULL) {
ret = AVB_SLOT_VERIFY_RESULT_ERROR_OOM;
goto fail;
@@ -706,15 +1014,6 @@ AvbSlotVerifyResult avb_slot_verify(AvbOps* ops,
slot_data->cmdline = new_cmdline;
}
- /* Add androidboot.slot_suffix, if applicable. */
- if (avb_strlen(ab_suffix) > 0) {
- if (!cmdline_append_option(slot_data, "androidboot.slot_suffix",
- ab_suffix)) {
- ret = AVB_SLOT_VERIFY_RESULT_ERROR_OOM;
- goto fail;
- }
- }
-
/* Set androidboot.avb.device_state to "locked" or "unlocked". */
bool is_device_unlocked;
io_ret = ops->read_is_device_unlocked(ops, &is_device_unlocked);
@@ -726,7 +1025,8 @@ AvbSlotVerifyResult avb_slot_verify(AvbOps* ops,
ret = AVB_SLOT_VERIFY_RESULT_ERROR_IO;
goto fail;
}
- if (!cmdline_append_option(slot_data, "androidboot.vbmeta.device_state",
+ if (!cmdline_append_option(slot_data,
+ "androidboot.vbmeta.device_state",
is_device_unlocked ? "unlocked" : "locked")) {
ret = AVB_SLOT_VERIFY_RESULT_ERROR_OOM;
goto fail;
@@ -742,13 +1042,20 @@ AvbSlotVerifyResult avb_slot_verify(AvbOps* ops,
case AVB_ALGORITHM_TYPE_SHA256_RSA4096:
case AVB_ALGORITHM_TYPE_SHA256_RSA8192: {
AvbSHA256Ctx ctx;
+ size_t n, total_size = 0;
avb_sha256_init(&ctx);
- avb_sha256_update(&ctx, slot_data->vbmeta_data, slot_data->vbmeta_size);
- if (!cmdline_append_option(slot_data, "androidboot.vbmeta.hash_alg",
- "sha256") ||
- !cmdline_append_uint64_base10(slot_data, "androidboot.vbmeta.size",
- slot_data->vbmeta_size) ||
- !cmdline_append_hex(slot_data, "androidboot.vbmeta.digest",
+ for (n = 0; n < slot_data->num_vbmeta_images; n++) {
+ avb_sha256_update(&ctx,
+ slot_data->vbmeta_images[n].vbmeta_data,
+ slot_data->vbmeta_images[n].vbmeta_size);
+ total_size += slot_data->vbmeta_images[n].vbmeta_size;
+ }
+ if (!cmdline_append_option(
+ slot_data, "androidboot.vbmeta.hash_alg", "sha256") ||
+ !cmdline_append_uint64_base10(
+ slot_data, "androidboot.vbmeta.size", total_size) ||
+ !cmdline_append_hex(slot_data,
+ "androidboot.vbmeta.digest",
avb_sha256_final(&ctx),
AVB_SHA256_DIGEST_SIZE)) {
ret = AVB_SLOT_VERIFY_RESULT_ERROR_OOM;
@@ -760,13 +1067,20 @@ AvbSlotVerifyResult avb_slot_verify(AvbOps* ops,
case AVB_ALGORITHM_TYPE_SHA512_RSA4096:
case AVB_ALGORITHM_TYPE_SHA512_RSA8192: {
AvbSHA512Ctx ctx;
+ size_t n, total_size = 0;
avb_sha512_init(&ctx);
- avb_sha512_update(&ctx, slot_data->vbmeta_data, slot_data->vbmeta_size);
- if (!cmdline_append_option(slot_data, "androidboot.vbmeta.hash_alg",
- "sha512") ||
- !cmdline_append_uint64_base10(slot_data, "androidboot.vbmeta.size",
- slot_data->vbmeta_size) ||
- !cmdline_append_hex(slot_data, "androidboot.vbmeta.digest",
+ for (n = 0; n < slot_data->num_vbmeta_images; n++) {
+ avb_sha512_update(&ctx,
+ slot_data->vbmeta_images[n].vbmeta_data,
+ slot_data->vbmeta_images[n].vbmeta_size);
+ total_size += slot_data->vbmeta_images[n].vbmeta_size;
+ }
+ if (!cmdline_append_option(
+ slot_data, "androidboot.vbmeta.hash_alg", "sha512") ||
+ !cmdline_append_uint64_base10(
+ slot_data, "androidboot.vbmeta.size", total_size) ||
+ !cmdline_append_hex(slot_data,
+ "androidboot.vbmeta.digest",
avb_sha512_final(&ctx),
AVB_SHA512_DIGEST_SIZE)) {
ret = AVB_SLOT_VERIFY_RESULT_ERROR_OOM;
@@ -785,6 +1099,10 @@ AvbSlotVerifyResult avb_slot_verify(AvbOps* ops,
}
}
+ if (!allow_verification_error) {
+ avb_assert(ret == AVB_SLOT_VERIFY_RESULT_OK);
+ }
+
return ret;
fail:
@@ -798,12 +1116,22 @@ void avb_slot_verify_data_free(AvbSlotVerifyData* data) {
if (data->ab_suffix != NULL) {
avb_free(data->ab_suffix);
}
- if (data->vbmeta_data != NULL) {
- avb_free(data->vbmeta_data);
- }
if (data->cmdline != NULL) {
avb_free(data->cmdline);
}
+ if (data->vbmeta_images != NULL) {
+ size_t n;
+ for (n = 0; n < data->num_vbmeta_images; n++) {
+ AvbVBMetaData* vbmeta_image = &data->vbmeta_images[n];
+ if (vbmeta_image->partition_name != NULL) {
+ avb_free(vbmeta_image->partition_name);
+ }
+ if (vbmeta_image->vbmeta_data != NULL) {
+ avb_free(vbmeta_image->vbmeta_data);
+ }
+ }
+ avb_free(data->vbmeta_images);
+ }
if (data->loaded_partitions != NULL) {
size_t n;
for (n = 0; n < data->num_loaded_partitions; n++) {
@@ -845,6 +1173,9 @@ const char* avb_slot_verify_result_to_string(AvbSlotVerifyResult result) {
case AVB_SLOT_VERIFY_RESULT_ERROR_INVALID_METADATA:
ret = "ERROR_INVALID_METADATA";
break;
+ case AVB_SLOT_VERIFY_RESULT_ERROR_UNSUPPORTED_VERSION:
+ ret = "ERROR_UNSUPPORTED_VERSION";
+ break;
/* Do not add a 'default:' case here because of -Wswitch. */
}
diff --git a/lib/avb/libavb/avb_slot_verify.h b/lib/avb/libavb/avb_slot_verify.h
index d644a4461c..08b11fcf1a 100644
--- a/lib/avb/libavb/avb_slot_verify.h
+++ b/lib/avb/libavb/avb_slot_verify.h
@@ -49,19 +49,20 @@ typedef enum {
AVB_SLOT_VERIFY_RESULT_ERROR_VERIFICATION,
AVB_SLOT_VERIFY_RESULT_ERROR_ROLLBACK_INDEX,
AVB_SLOT_VERIFY_RESULT_ERROR_PUBLIC_KEY_REJECTED,
- AVB_SLOT_VERIFY_RESULT_ERROR_INVALID_METADATA
+ AVB_SLOT_VERIFY_RESULT_ERROR_INVALID_METADATA,
+ AVB_SLOT_VERIFY_RESULT_ERROR_UNSUPPORTED_VERSION
} AvbSlotVerifyResult;
/* Get a textual representation of |result|. */
const char* avb_slot_verify_result_to_string(AvbSlotVerifyResult result);
/* Maximum number of rollback index locations supported. */
-#define AVB_MAX_NUMBER_OF_ROLLBACK_INDEX_SLOTS 4
+#define AVB_MAX_NUMBER_OF_ROLLBACK_INDEX_LOCATIONS 32
/* AvbPartitionData contains data loaded from partitions when using
* avb_slot_verify(). The |partition_name| field contains the name of
- * the partition, |data| points to the loaded data which is
- * |data_size| bytes long.
+ * the partition (without A/B suffix), |data| points to the loaded
+ * data which is |data_size| bytes long.
*
* Note that this is strictly less than the partition size - it's only
* the image stored there, not the entire partition nor any of the
@@ -73,6 +74,26 @@ typedef struct {
size_t data_size;
} AvbPartitionData;
+/* AvbVBMetaData contains a vbmeta struct loaded from a partition when
+ * using avb_slot_verify(). The |partition_name| field contains the
+ * name of the partition (without A/B suffix), |vbmeta_data| points to
+ * the loaded data which is |vbmeta_size| bytes long.
+ *
+ * The |verify_result| field contains the result of
+ * avb_vbmeta_image_verify() on the data. This is guaranteed to be
+ * AVB_VBMETA_VERIFY_RESULT_OK for all vbmeta images if
+ * avb_slot_verify() returns AVB_SLOT_VERIFY_RESULT_OK.
+ *
+ * You can use avb_descriptor_get_all(), avb_descriptor_foreach(), and
+ * avb_vbmeta_image_header_to_host_byte_order() with this data.
+ */
+typedef struct {
+ char* partition_name;
+ uint8_t* vbmeta_data;
+ size_t vbmeta_size;
+ AvbVBMetaVerifyResult verify_result;
+} AvbVBMetaData;
+
/* AvbSlotVerifyData contains data needed to boot a particular slot
* and is returned by avb_slot_verify() if partitions in a slot are
* successfully verified.
@@ -84,17 +105,20 @@ typedef struct {
* The |ab_suffix| field is the copy of the of |ab_suffix| field
* passed to avb_slot_verify(). It is the A/B suffix of the slot.
*
+ * The VBMeta images that were checked are available in the
+ * |vbmeta_images| field. The field |num_vbmeta_images| contains the
+ * number of elements in this array. The first element -
+ * vbmeta_images[0] - is guaranteed to be from the partition with the
+ * top-level vbmeta struct. This is usually the "vbmeta" partition in
+ * the requested slot but if there is no "vbmeta" partition it can
+ * also be the "boot" partition.
+ *
* The partitions loaded and verified from from the slot are
* accessible in the |loaded_partitions| array. The field
* |num_loaded_partitions| contains the number of elements in this
* array. The order of partitions in this array may not necessarily be
* the same order as in the passed-in |requested_partitions| array.
*
- * The verified vbmeta image in the 'vbmeta' partition of the slot is
- * accessible from the |vbmeta_data| field and is of length
- * |vbmeta_size| bytes. You can use this data with
- * e.g. avb_descriptor_get_all().
- *
* Rollback indexes for the verified slot are stored in the
* |rollback_indexes| field. Note that avb_slot_verify() will NEVER
* modify stored_rollback_index[n] locations e.g. it will never use
@@ -106,34 +130,48 @@ typedef struct {
* The |cmdline| field is a NUL-terminated string in UTF-8 resulting
* from concatenating all |AvbKernelCmdlineDescriptor| and then
* performing proper substitution of the variables
- * $(ANDROID_SYSTEM_PARTUUID) and $(ANDROID_BOOT_PARTUUID) using the
+ * $(ANDROID_SYSTEM_PARTUUID), $(ANDROID_BOOT_PARTUUID), and
+ * $(ANDROID_VBMETA_PARTUUID) using the
* get_unique_guid_for_partition() operation in |AvbOps|.
*
* Additionally, the |cmdline| field will have the following kernel
* command-line options set:
*
- * androidboot.avb.device_state: set to "locked" or "unlocked"
+ * androidboot.vbmeta.device_state: set to "locked" or "unlocked"
* depending on the result of the result of AvbOps's
* read_is_unlocked() function.
*
- * androidboot.slot_suffix: If |ab_suffix| as passed into
- * avb_slot_verify() is non-empty, this variable will be set to its
- * value.
- *
* androidboot.vbmeta.{hash_alg, size, digest}: Will be set to
- * the digest of the vbmeta image.
+ * the digest of all images in |vbmeta_images|.
+ *
+ * androidboot.vbmeta.device: This is set to the value
+ * PARTUUID=$(ANDROID_VBMETA_PARTUUID) before substitution so it
+ * will end up pointing to the vbmeta partition for the verified
+ * slot. If there is no vbmeta partition it will point to the boot
+ * partition of the verified slot.
+ *
+ * androidboot.vbmeta.avb_version: This is set to the decimal value
+ * of AVB_VERSION_MAJOR followed by a dot followed by the decimal
+ * value of AVB_VERSION_MINOR, for example "1.0" or "1.4". This
+ * version number represents the vbmeta file format version
+ * supported by libavb copy used in the boot loader. This is not
+ * necessarily the same version number of the on-disk metadata for
+ * the slot that was verified.
+ *
+ * Note that androidboot.slot_suffix is not set in |cmdline| - you
+ * will have to pass this command-line option yourself.
*
* This struct may grow in the future without it being considered an
* ABI break.
*/
typedef struct {
char* ab_suffix;
- uint8_t* vbmeta_data;
- size_t vbmeta_size;
+ AvbVBMetaData* vbmeta_images;
+ size_t num_vbmeta_images;
AvbPartitionData* loaded_partitions;
size_t num_loaded_partitions;
char* cmdline;
- uint64_t rollback_indexes[AVB_MAX_NUMBER_OF_ROLLBACK_INDEX_SLOTS];
+ uint64_t rollback_indexes[AVB_MAX_NUMBER_OF_ROLLBACK_INDEX_LOCATIONS];
} AvbSlotVerifyData;
/* Frees a |AvbSlotVerifyData| including all data it points to. */
@@ -157,7 +195,26 @@ void avb_slot_verify_data_free(AvbSlotVerifyData* data);
* If |out_data| is not NULL, it will be set to a newly allocated
* |AvbSlotVerifyData| struct containing all the data needed to
* actually boot the slot. This data structure should be freed with
- * avb_slot_verify_data_free() when you are done with it.
+ * avb_slot_verify_data_free() when you are done with it. See below
+ * for when this is returned.
+ *
+ * If |allow_verification_error| is false this function will bail out
+ * as soon as an error is encountered and |out_data| is set only if
+ * AVB_SLOT_VERIFY_RESULT_OK is returned.
+ *
+ * Otherwise if |allow_verification_error| is true the function will
+ * continue verification efforts and |out_data| is also set if
+ * AVB_SLOT_VERIFY_RESULT_ERROR_PUBLIC_KEY_REJECTED,
+ * AVB_SLOT_VERIFY_RESULT_ERROR_VERIFICATION, or
+ * AVB_SLOT_VERIFY_RESULT_ERROR_ROLLBACK_INDEX is returned. It is
+ * undefined which error is returned if more than one distinct error
+ * is encountered. It is guaranteed that AVB_SLOT_VERIFY_RESULT_OK is
+ * returned if, and only if, there are no errors. This mode is needed
+ * to boot valid but unverified slots when the device is unlocked.
+ *
+ * Also note that |out_data| is never set if
+ * AVB_SLOT_VERIFY_RESULT_ERROR_OOM, AVB_SLOT_VERIFY_RESULT_ERROR_IO,
+ * or AVB_SLOT_VERIFY_RESULT_ERROR_INVALID_METADATA is returned.
*
* AVB_SLOT_VERIFY_RESULT_OK is returned if everything is verified
* correctly and all public keys are accepted.
@@ -182,10 +239,15 @@ void avb_slot_verify_data_free(AvbSlotVerifyData* data);
*
* AVB_SLOT_VERIFY_RESULT_ERROR_INVALID_METADATA is returned if some
* of the metadata is invalid or inconsistent.
+ *
+ * AVB_SLOT_VERIFY_RESULT_ERROR_UNSUPPORTED_VERSION is returned if
+ * some of the metadata requires a newer version of libavb than what
+ * is in use.
*/
AvbSlotVerifyResult avb_slot_verify(AvbOps* ops,
const char* const* requested_partitions,
const char* ab_suffix,
+ bool allow_verification_error,
AvbSlotVerifyData** out_data);
#ifdef __cplusplus
diff --git a/lib/avb/libavb/avb_sysdeps.h b/lib/avb/libavb/avb_sysdeps.h
index 7fe9d066a3..dfad04f808 100644
--- a/lib/avb/libavb/avb_sysdeps.h
+++ b/lib/avb/libavb/avb_sysdeps.h
@@ -38,28 +38,32 @@ extern "C" {
* like uint8_t, uint64_t, and bool (with |false|, |true| keywords)
* must be present.
*/
-#include <compiler.h>
-#include <inttypes.h>
+
+//#define bool int
+#include <common.h>
+
/* If you don't have gcc or clang, these attribute macros may need to
* be adjusted.
*/
#define AVB_ATTR_WARN_UNUSED_RESULT __attribute__((warn_unused_result))
#define AVB_ATTR_PACKED __attribute__((packed))
#define AVB_ATTR_NO_RETURN __attribute__((noreturn))
-#define AVB_ATTR_SENTINEL __attribute__((__sentinel__));
+#define AVB_ATTR_SENTINEL __attribute__((__sentinel__))
-/* Size in bytes used for word-alignment.
- *
- * Change this to match your architecture - must be a power of two.
- */
-#define AVB_WORD_ALIGNMENT_SIZE 8
+/* Size in bytes used for alignment. */
+#ifdef __LP64__
+#define AVB_ALIGNMENT_SIZE 8
+#else
+#define AVB_ALIGNMENT_SIZE 4
+#endif
/* Compare |n| bytes in |src1| and |src2|.
*
* Returns an integer less than, equal to, or greater than zero if the
* first |n| bytes of |src1| is found, respectively, to be less than,
* to match, or be greater than the first |n| bytes of |src2|. */
-int avb_memcmp(const void* src1, const void* src2,
+int avb_memcmp(const void* src1,
+ const void* src2,
size_t n) AVB_ATTR_WARN_UNUSED_RESULT;
/* Compare two strings.
diff --git a/lib/avb/libavb/avb_sysdeps_posix.c b/lib/avb/libavb/avb_sysdeps_posix.c
new file mode 100644
index 0000000000..ea40d08d06
--- /dev/null
+++ b/lib/avb/libavb/avb_sysdeps_posix.c
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Permission is hereby granted, free of charge, to any person
+ * obtaining a copy of this software and associated documentation
+ * files (the "Software"), to deal in the Software without
+ * restriction, including without limitation the rights to use, copy,
+ * modify, merge, publish, distribute, sublicense, and/or sell copies
+ * of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#include <endian.h>
+#include <stdarg.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include "avb_sysdeps.h"
+
+int avb_memcmp(const void* src1, const void* src2, size_t n) {
+ return memcmp(src1, src2, n);
+}
+
+void* avb_memcpy(void* dest, const void* src, size_t n) {
+ return memcpy(dest, src, n);
+}
+
+void* avb_memset(void* dest, const int c, size_t n) {
+ return memset(dest, c, n);
+}
+
+int avb_strcmp(const char* s1, const char* s2) {
+ return strcmp(s1, s2);
+}
+
+size_t avb_strlen(const char* str) {
+ return strlen(str);
+}
+
+void avb_abort(void) {
+ abort();
+}
+
+void avb_print(const char* message) {
+ fprintf(stderr, "%s", message);
+}
+
+void avb_printv(const char* message, ...) {
+ va_list ap;
+ const char* m;
+
+ va_start(ap, message);
+ for (m = message; m != NULL; m = va_arg(ap, const char*)) {
+ fprintf(stderr, "%s", m);
+ }
+ va_end(ap);
+}
+
+void* avb_malloc_(size_t size) {
+ return malloc(size);
+}
+
+void avb_free(void* ptr) {
+ free(ptr);
+}
diff --git a/lib/avb/libavb/avb_util.c b/lib/avb/libavb/avb_util.c
index 435e556d7c..43662b4cb8 100644
--- a/lib/avb/libavb/avb_util.c
+++ b/lib/avb/libavb/avb_util.c
@@ -24,6 +24,8 @@
#include "avb_util.h"
+#include <stdarg.h>
+
uint32_t avb_be32toh(uint32_t in) {
uint8_t* d = (uint8_t*)&in;
uint32_t ret;
@@ -83,13 +85,17 @@ int avb_safe_memcmp(const void* s1, const void* s2, size_t n) {
const unsigned char* us2 = s2;
int result = 0;
- if (0 == n) return 0;
+ if (0 == n) {
+ return 0;
+ }
/*
* Code snippet without data-dependent branch due to Nate Lawson
* (nate@root.org) of Root Labs.
*/
- while (n--) result |= *us1++ ^ *us2++;
+ while (n--) {
+ result |= *us1++ ^ *us2++;
+ }
return result != 0;
}
@@ -112,7 +118,9 @@ bool avb_safe_add_to(uint64_t* value, uint64_t value_to_add) {
bool avb_safe_add(uint64_t* out_result, uint64_t a, uint64_t b) {
uint64_t dummy;
- if (out_result == NULL) out_result = &dummy;
+ if (out_result == NULL) {
+ out_result = &dummy;
+ }
*out_result = a;
return avb_safe_add_to(out_result, b);
}
@@ -160,8 +168,12 @@ fail:
return false;
}
-bool avb_str_concat(char* buf, size_t buf_size, const char* str1,
- size_t str1_len, const char* str2, size_t str2_len) {
+bool avb_str_concat(char* buf,
+ size_t buf_size,
+ const char* str1,
+ size_t str1_len,
+ const char* str2,
+ size_t str2_len) {
uint64_t combined_len;
if (!avb_safe_add(&combined_len, str1_len, str2_len)) {
@@ -220,21 +232,26 @@ const char* avb_strstr(const char* haystack, const char* needle) {
* |needle| matches. If so, check the rest of |needle|.
*/
for (n = 0; haystack[n] != '\0'; n++) {
- if (haystack[n] != needle[0]) continue;
+ if (haystack[n] != needle[0]) {
+ continue;
+ }
for (m = 1;; m++) {
if (needle[m] == '\0') {
return haystack + n;
}
- if (haystack[n + m] != needle[m]) break;
+ if (haystack[n + m] != needle[m]) {
+ break;
+ }
}
}
return NULL;
}
-const char* avb_strv_find_str(const char* const* strings, const char* str,
+const char* avb_strv_find_str(const char* const* strings,
+ const char* str,
size_t str_size) {
size_t n;
for (n = 0; strings[n] != NULL; n++) {
@@ -262,7 +279,9 @@ char* avb_replace(const char* str, const char* search, const char* replace) {
size_t num_new;
s = avb_strstr(str, search);
- if (s == NULL) break;
+ if (s == NULL) {
+ break;
+ }
num_before = s - str;
@@ -305,7 +324,9 @@ char* avb_replace(const char* str, const char* search, const char* replace) {
size_t num_remaining = avb_strlen(str_after_last_replace);
size_t num_new = ret_len + num_remaining + 1;
char* new_str = avb_malloc(num_new);
- if (ret == NULL) goto out;
+ if (ret == NULL) {
+ goto out;
+ }
avb_memcpy(new_str, ret, ret_len);
avb_memcpy(new_str + ret_len, str_after_last_replace, num_remaining);
new_str[num_new - 1] = '\0';
@@ -317,3 +338,66 @@ char* avb_replace(const char* str, const char* search, const char* replace) {
out:
return ret;
}
+
+/* We only support a limited amount of strings in avb_strdupv(). */
+#define AVB_STRDUPV_MAX_NUM_STRINGS 32
+
+char* avb_strdupv(const char* str, ...) {
+ va_list ap;
+ const char* strings[AVB_STRDUPV_MAX_NUM_STRINGS];
+ size_t lengths[AVB_STRDUPV_MAX_NUM_STRINGS];
+ size_t num_strings, n;
+ uint64_t total_length;
+ char *ret = NULL, *dest;
+
+ num_strings = 0;
+ total_length = 0;
+ va_start(ap, str);
+ do {
+ size_t str_len = avb_strlen(str);
+ strings[num_strings] = str;
+ lengths[num_strings] = str_len;
+ if (!avb_safe_add_to(&total_length, str_len)) {
+ avb_fatal("Overflow while determining total length.\n");
+ break;
+ }
+ num_strings++;
+ if (num_strings == AVB_STRDUPV_MAX_NUM_STRINGS) {
+ avb_fatal("Too many strings passed.\n");
+ break;
+ }
+ str = va_arg(ap, const char*);
+ } while (str != NULL);
+ va_end(ap);
+
+ ret = avb_malloc(total_length + 1);
+ if (ret == NULL) {
+ goto out;
+ }
+
+ dest = ret;
+ for (n = 0; n < num_strings; n++) {
+ avb_memcpy(dest, strings[n], lengths[n]);
+ dest += lengths[n];
+ }
+ *dest = '\0';
+ avb_assert(dest == ret + total_length);
+
+out:
+ return ret;
+}
+
+const char* avb_basename(const char* str) {
+ int64_t n;
+ size_t len;
+
+ len = avb_strlen(str);
+ if (len >= 2) {
+ for (n = len - 2; n >= 0; n--) {
+ if (str[n] == '/') {
+ return str + n + 1;
+ }
+ }
+ }
+ return str;
+}
diff --git a/lib/avb/libavb/avb_util.h b/lib/avb/libavb/avb_util.h
index d53be97626..07c3258768 100644
--- a/lib/avb/libavb/avb_util.h
+++ b/lib/avb/libavb/avb_util.h
@@ -70,23 +70,31 @@ extern "C" {
*
* This has no effect unless AVB_ENABLE_DEBUG is defined.
*/
-#define avb_assert_word_aligned(addr) \
- avb_assert((((uintptr_t)addr) & (AVB_WORD_ALIGNMENT_SIZE - 1)) == 0)
+#define avb_assert_aligned(addr) \
+ avb_assert((((uintptr_t)addr) & (AVB_ALIGNMENT_SIZE - 1)) == 0)
#ifdef AVB_ENABLE_DEBUG
/* Print functions, used for diagnostics.
*
* These have no effect unless AVB_ENABLE_DEBUG is defined.
*/
-#define avb_debug(message) \
- do { \
- avb_print(__FILE__ ":" AVB_TO_STRING(__LINE__) ": DEBUG: "); \
- avb_print(message); \
+#define avb_debug(message) \
+ do { \
+ avb_printv(avb_basename(__FILE__), \
+ ":", \
+ AVB_TO_STRING(__LINE__), \
+ ": DEBUG: ", \
+ message, \
+ NULL); \
} while (0)
-#define avb_debugv(message, ...) \
- do { \
- avb_print(__FILE__ ":" AVB_TO_STRING(__LINE__) ": DEBUG: "); \
- avb_printv(message, ##__VA_ARGS__); \
+#define avb_debugv(message, ...) \
+ do { \
+ avb_printv(avb_basename(__FILE__), \
+ ":", \
+ AVB_TO_STRING(__LINE__), \
+ ": DEBUG: ", \
+ message, \
+ ##__VA_ARGS__); \
} while (0)
#else
#define avb_debug(message)
@@ -96,30 +104,46 @@ extern "C" {
/* Prints out a message. This is typically used if a runtime-error
* occurs.
*/
-#define avb_error(message) \
- do { \
- avb_print(__FILE__ ":" AVB_TO_STRING(__LINE__) ": ERROR: "); \
- avb_print(message); \
+#define avb_error(message) \
+ do { \
+ avb_printv(avb_basename(__FILE__), \
+ ":", \
+ AVB_TO_STRING(__LINE__), \
+ ": ERROR: ", \
+ message, \
+ NULL); \
} while (0)
-#define avb_errorv(message, ...) \
- do { \
- avb_print(__FILE__ ":" AVB_TO_STRING(__LINE__) ": ERROR: "); \
- avb_printv(message, ##__VA_ARGS__); \
+#define avb_errorv(message, ...) \
+ do { \
+ avb_printv(avb_basename(__FILE__), \
+ ":", \
+ AVB_TO_STRING(__LINE__), \
+ ": ERROR: ", \
+ message, \
+ ##__VA_ARGS__); \
} while (0)
/* Prints out a message and calls avb_abort().
*/
-#define avb_fatal(message) \
- do { \
- avb_print(__FILE__ ":" AVB_TO_STRING(__LINE__) ": FATAL: "); \
- avb_print(message); \
- avb_abort(); \
+#define avb_fatal(message) \
+ do { \
+ avb_printv(avb_basename(__FILE__), \
+ ":", \
+ AVB_TO_STRING(__LINE__), \
+ ": FATAL: ", \
+ message, \
+ NULL); \
+ avb_abort(); \
} while (0)
-#define avb_fatalv(message, ...) \
- do { \
- avb_print(__FILE__ ":" AVB_TO_STRING(__LINE__) ": FATAL: "); \
- avb_printv(message, ##__VA_ARGS__); \
- avb_abort(); \
+#define avb_fatalv(message, ...) \
+ do { \
+ avb_printv(avb_basename(__FILE__), \
+ ":", \
+ AVB_TO_STRING(__LINE__), \
+ ": FATAL: ", \
+ message, \
+ ##__VA_ARGS__); \
+ avb_abort(); \
} while (0)
/* Converts a 32-bit unsigned integer from big-endian to host byte order. */
@@ -144,7 +168,8 @@ uint64_t avb_htobe64(uint64_t in) AVB_ATTR_WARN_UNUSED_RESULT;
* Note that unlike avb_memcmp(), this only indicates inequality, not
* whether |s1| is less than or greater than |s2|.
*/
-int avb_safe_memcmp(const void* s1, const void* s2,
+int avb_safe_memcmp(const void* s1,
+ const void* s2,
size_t n) AVB_ATTR_WARN_UNUSED_RESULT;
/* Adds |value_to_add| to |value| with overflow protection.
@@ -163,7 +188,8 @@ bool avb_safe_add_to(uint64_t* value,
*
* Returns false if the addition overflows, true otherwise.
*/
-bool avb_safe_add(uint64_t* out_result, uint64_t a,
+bool avb_safe_add(uint64_t* out_result,
+ uint64_t a,
uint64_t b) AVB_ATTR_WARN_UNUSED_RESULT;
/* Checks if |num_bytes| data at |data| is a valid UTF-8
@@ -180,8 +206,12 @@ bool avb_validate_utf8(const uint8_t* data,
*
* Returns true if the operation succeeds, false otherwise.
*/
-bool avb_str_concat(char* buf, size_t buf_size, const char* str1,
- size_t str1_len, const char* str2, size_t str2_len);
+bool avb_str_concat(char* buf,
+ size_t buf_size,
+ const char* str1,
+ size_t str1_len,
+ const char* str2,
+ size_t str2_len);
/* Like avb_malloc_() but prints a error using avb_error() if memory
* allocation fails.
@@ -194,6 +224,13 @@ void* avb_calloc(size_t size) AVB_ATTR_WARN_UNUSED_RESULT;
/* Duplicates a NUL-terminated string. Returns NULL on OOM. */
char* avb_strdup(const char* str) AVB_ATTR_WARN_UNUSED_RESULT;
+/* Duplicates a NULL-terminated array of NUL-terminated strings by
+ * concatenating them. The returned string will be
+ * NUL-terminated. Returns NULL on OOM.
+ */
+char* avb_strdupv(const char* str,
+ ...) AVB_ATTR_WARN_UNUSED_RESULT AVB_ATTR_SENTINEL;
+
/* Finds the first occurrence of |needle| in the string |haystack|
* where both strings are NUL-terminated strings. The terminating NUL
* bytes are not compared.
@@ -212,19 +249,27 @@ const char* avb_strstr(const char* haystack,
* Returns NULL if not found, otherwise points into |strings| for the
* first occurrence of |str|.
*/
-const char* avb_strv_find_str(const char* const* strings, const char* str,
+const char* avb_strv_find_str(const char* const* strings,
+ const char* str,
size_t str_size);
/* Replaces all occurrences of |search| with |replace| in |str|.
*
* Returns a newly allocated string or NULL if out of memory.
*/
-char* avb_replace(const char* str, const char* search,
+char* avb_replace(const char* str,
+ const char* search,
const char* replace) AVB_ATTR_WARN_UNUSED_RESULT;
/* Calculates the CRC-32 for data in |buf| of size |buf_size|. */
uint32_t avb_crc32(const uint8_t* buf, size_t buf_size);
+/* Returns the basename of |str|. This is defined as the last path
+ * component, assuming the normal POSIX separator '/'. If there are no
+ * separators, returns |str|.
+ */
+const char* avb_basename(const char* str);
+
#ifdef __cplusplus
}
#endif
diff --git a/lib/avb/libavb/avb_vbmeta_image.c b/lib/avb/libavb/avb_vbmeta_image.c
index 23607ed3df..21bbf9295d 100644
--- a/lib/avb/libavb/avb_vbmeta_image.c
+++ b/lib/avb/libavb/avb_vbmeta_image.c
@@ -23,350 +23,21 @@
*/
#include "avb_vbmeta_image.h"
+#include "avb_crypto.h"
#include "avb_rsa.h"
#include "avb_sha.h"
#include "avb_util.h"
-
-/* NOTE: The PKC1-v1.5 padding is a blob of binary DER of ASN.1 and is
- * obtained from section 5.2.2 of RFC 4880.
- */
-
-static const uint8_t
- padding_RSA2048_SHA256[AVB_RSA2048_NUM_BYTES - AVB_SHA256_DIGEST_SIZE] = {
- 0x00, 0x01, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0x00, 0x30, 0x31, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65,
- 0x03, 0x04, 0x02, 0x01, 0x05, 0x00, 0x04, 0x20};
-
-static const uint8_t
- padding_RSA4096_SHA256[AVB_RSA4096_NUM_BYTES - AVB_SHA256_DIGEST_SIZE] = {
- 0x00, 0x01, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0x00, 0x30, 0x31, 0x30, 0x0d, 0x06, 0x09, 0x60,
- 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, 0x05, 0x00, 0x04, 0x20};
-
-static const uint8_t
- padding_RSA8192_SHA256[AVB_RSA8192_NUM_BYTES - AVB_SHA256_DIGEST_SIZE] = {
- 0x00, 0x01, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0x00, 0x30, 0x31, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65,
- 0x03, 0x04, 0x02, 0x01, 0x05, 0x00, 0x04, 0x20};
-
-static const uint8_t
- padding_RSA2048_SHA512[AVB_RSA2048_NUM_BYTES - AVB_SHA512_DIGEST_SIZE] = {
- 0x00, 0x01, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0x00, 0x30, 0x51, 0x30, 0x0d, 0x06, 0x09, 0x60,
- 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03, 0x05, 0x00, 0x04, 0x40};
-
-static const uint8_t
- padding_RSA4096_SHA512[AVB_RSA4096_NUM_BYTES - AVB_SHA512_DIGEST_SIZE] = {
- 0x00, 0x01, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00, 0x30, 0x51, 0x30,
- 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03,
- 0x05, 0x00, 0x04, 0x40};
-
-static const uint8_t
- padding_RSA8192_SHA512[AVB_RSA8192_NUM_BYTES - AVB_SHA512_DIGEST_SIZE] = {
- 0x00, 0x01, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
- 0xff, 0xff, 0xff, 0xff, 0x00, 0x30, 0x51, 0x30, 0x0d, 0x06, 0x09, 0x60,
- 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03, 0x05, 0x00, 0x04, 0x40};
-
-typedef struct {
- const uint8_t* padding;
- size_t padding_len;
- size_t hash_len;
-} AvbAlgorithmData;
-
-static AvbAlgorithmData algorithm_data[_AVB_ALGORITHM_NUM_TYPES] = {
- /* AVB_ALGORITHM_TYPE_NONE */
- {.padding = NULL, .padding_len = 0, .hash_len = 0},
- /* AVB_ALGORITHM_TYPE_SHA256_RSA2048 */
- {.padding = padding_RSA2048_SHA256,
- .padding_len = sizeof(padding_RSA2048_SHA256),
- .hash_len = AVB_SHA256_DIGEST_SIZE},
- /* AVB_ALGORITHM_TYPE_SHA256_RSA4096 */
- {.padding = padding_RSA4096_SHA256,
- .padding_len = sizeof(padding_RSA4096_SHA256),
- .hash_len = AVB_SHA256_DIGEST_SIZE},
- /* AVB_ALGORITHM_TYPE_SHA256_RSA8192 */
- {.padding = padding_RSA8192_SHA256,
- .padding_len = sizeof(padding_RSA8192_SHA256),
- .hash_len = AVB_SHA256_DIGEST_SIZE},
- /* AVB_ALGORITHM_TYPE_SHA512_RSA2048 */
- {.padding = padding_RSA2048_SHA512,
- .padding_len = sizeof(padding_RSA2048_SHA512),
- .hash_len = AVB_SHA512_DIGEST_SIZE},
- /* AVB_ALGORITHM_TYPE_SHA512_RSA4096 */
- {.padding = padding_RSA4096_SHA512,
- .padding_len = sizeof(padding_RSA4096_SHA512),
- .hash_len = AVB_SHA512_DIGEST_SIZE},
- /* AVB_ALGORITHM_TYPE_SHA512_RSA8192 */
- {.padding = padding_RSA8192_SHA512,
- .padding_len = sizeof(padding_RSA8192_SHA512),
- .hash_len = AVB_SHA512_DIGEST_SIZE},
-};
+#include "avb_version.h"
AvbVBMetaVerifyResult avb_vbmeta_image_verify(
- const uint8_t* data, size_t length, const uint8_t** out_public_key_data,
+ const uint8_t* data,
+ size_t length,
+ const uint8_t** out_public_key_data,
size_t* out_public_key_length) {
AvbVBMetaVerifyResult ret;
AvbVBMetaImageHeader h;
uint8_t* computed_hash;
- AvbAlgorithmData* algorithm;
+ const AvbAlgorithmData* algorithm;
AvbSHA256Ctx sha256_ctx;
AvbSHA512Ctx sha512_ctx;
const uint8_t* header_block;
@@ -376,8 +47,12 @@ AvbVBMetaVerifyResult avb_vbmeta_image_verify(
ret = AVB_VBMETA_VERIFY_RESULT_INVALID_VBMETA_HEADER;
- if (out_public_key_data != NULL) *out_public_key_data = NULL;
- if (out_public_key_length != NULL) *out_public_key_length = 0;
+ if (out_public_key_data != NULL) {
+ *out_public_key_data = NULL;
+ }
+ if (out_public_key_length != NULL) {
+ *out_public_key_length = 0;
+ }
/* Ensure magic is correct. */
if (avb_safe_memcmp(data, AVB_MAGIC, AVB_MAGIC_LEN) != 0) {
@@ -393,11 +68,19 @@ AvbVBMetaVerifyResult avb_vbmeta_image_verify(
avb_vbmeta_image_header_to_host_byte_order((const AvbVBMetaImageHeader*)data,
&h);
- /* Ensure we don't attempt to access any fields if the major version
- * is not supported.
+ /* Ensure we don't attempt to access any fields if we do not meet
+ * the specified minimum version of libavb.
*/
- if (h.header_version_major > AVB_MAJOR_VERSION) {
- avb_error("No support for given major version.\n");
+ if ((h.required_libavb_version_major != AVB_VERSION_MAJOR) ||
+ (h.required_libavb_version_minor > AVB_VERSION_MINOR)) {
+ avb_error("Mismatch between image version and libavb version.\n");
+ ret = AVB_VBMETA_VERIFY_RESULT_UNSUPPORTED_VERSION;
+ goto out;
+ }
+
+ /* Ensure |release_string| ends with a NUL byte. */
+ if (h.release_string[AVB_RELEASE_STRING_SIZE - 1] != '\0') {
+ avb_error("Release string does not end with a NUL byte.\n");
goto out;
}
@@ -449,12 +132,18 @@ AvbVBMetaVerifyResult avb_vbmeta_image_verify(
goto out;
}
- /* Ensure algorithm field is supported. */
- if (h.algorithm_type >= _AVB_ALGORITHM_NUM_TYPES) {
- avb_error("Invalid or unknown algorithm.\n");
- goto out;
+ /* Ensure public key metadata (if set) is entirely in the Auxiliary
+ * data block. */
+ if (h.public_key_metadata_size > 0) {
+ uint64_t pubkey_md_end;
+ if (!avb_safe_add(&pubkey_md_end,
+ h.public_key_metadata_offset,
+ h.public_key_metadata_size) ||
+ pubkey_md_end > h.auxiliary_data_block_size) {
+ avb_error("Public key metadata is not entirely in its block.\n");
+ goto out;
+ }
}
- algorithm = &algorithm_data[h.algorithm_type];
/* Bail early if there's no hash or signature. */
if (h.algorithm_type == AVB_ALGORITHM_TYPE_NONE) {
@@ -462,6 +151,13 @@ AvbVBMetaVerifyResult avb_vbmeta_image_verify(
goto out;
}
+ /* Ensure algorithm field is supported. */
+ algorithm = avb_get_algorithm_data(h.algorithm_type);
+ if (!algorithm) {
+ avb_error("Invalid or unknown algorithm.\n");
+ goto out;
+ }
+
/* Bail if the embedded hash size doesn't match the chosen algorithm. */
if (h.hash_size != algorithm->hash_len) {
avb_error("Embedded hash has wrong size.\n");
@@ -482,10 +178,10 @@ AvbVBMetaVerifyResult avb_vbmeta_image_verify(
case AVB_ALGORITHM_TYPE_SHA256_RSA4096:
case AVB_ALGORITHM_TYPE_SHA256_RSA8192:
avb_sha256_init(&sha256_ctx);
- avb_sha256_update(&sha256_ctx, header_block,
- sizeof(AvbVBMetaImageHeader));
- avb_sha256_update(&sha256_ctx, auxiliary_block,
- h.auxiliary_data_block_size);
+ avb_sha256_update(
+ &sha256_ctx, header_block, sizeof(AvbVBMetaImageHeader));
+ avb_sha256_update(
+ &sha256_ctx, auxiliary_block, h.auxiliary_data_block_size);
computed_hash = avb_sha256_final(&sha256_ctx);
break;
/* Explicit fall-through: */
@@ -493,10 +189,10 @@ AvbVBMetaVerifyResult avb_vbmeta_image_verify(
case AVB_ALGORITHM_TYPE_SHA512_RSA4096:
case AVB_ALGORITHM_TYPE_SHA512_RSA8192:
avb_sha512_init(&sha512_ctx);
- avb_sha512_update(&sha512_ctx, header_block,
- sizeof(AvbVBMetaImageHeader));
- avb_sha512_update(&sha512_ctx, auxiliary_block,
- h.auxiliary_data_block_size);
+ avb_sha512_update(
+ &sha512_ctx, header_block, sizeof(AvbVBMetaImageHeader));
+ avb_sha512_update(
+ &sha512_ctx, auxiliary_block, h.auxiliary_data_block_size);
computed_hash = avb_sha512_final(&sha512_ctx);
break;
default:
@@ -504,7 +200,8 @@ AvbVBMetaVerifyResult avb_vbmeta_image_verify(
goto out;
}
- if (avb_safe_memcmp(authentication_block + h.hash_offset, computed_hash,
+ if (avb_safe_memcmp(authentication_block + h.hash_offset,
+ computed_hash,
h.hash_size) != 0) {
avb_error("Hash does not match!\n");
ret = AVB_VBMETA_VERIFY_RESULT_HASH_MISMATCH;
@@ -512,19 +209,28 @@ AvbVBMetaVerifyResult avb_vbmeta_image_verify(
}
verification_result =
- avb_rsa_verify(auxiliary_block + h.public_key_offset, h.public_key_size,
+ avb_rsa_verify(auxiliary_block + h.public_key_offset,
+ h.public_key_size,
authentication_block + h.signature_offset,
- h.signature_size, authentication_block + h.hash_offset,
- h.hash_size, algorithm->padding, algorithm->padding_len);
+ h.signature_size,
+ authentication_block + h.hash_offset,
+ h.hash_size,
+ algorithm->padding,
+ algorithm->padding_len);
if (verification_result == 0) {
ret = AVB_VBMETA_VERIFY_RESULT_SIGNATURE_MISMATCH;
goto out;
}
- if (out_public_key_data != NULL)
- *out_public_key_data = auxiliary_block + h.public_key_offset;
- if (out_public_key_length != NULL) *out_public_key_length = h.public_key_size;
+ if (h.public_key_size > 0) {
+ if (out_public_key_data != NULL) {
+ *out_public_key_data = auxiliary_block + h.public_key_offset;
+ }
+ if (out_public_key_length != NULL) {
+ *out_public_key_length = h.public_key_size;
+ }
+ }
ret = AVB_VBMETA_VERIFY_RESULT_OK;
@@ -536,8 +242,10 @@ void avb_vbmeta_image_header_to_host_byte_order(const AvbVBMetaImageHeader* src,
AvbVBMetaImageHeader* dest) {
avb_memcpy(dest, src, sizeof(AvbVBMetaImageHeader));
- dest->header_version_major = avb_be32toh(dest->header_version_major);
- dest->header_version_minor = avb_be32toh(dest->header_version_minor);
+ dest->required_libavb_version_major =
+ avb_be32toh(dest->required_libavb_version_major);
+ dest->required_libavb_version_minor =
+ avb_be32toh(dest->required_libavb_version_minor);
dest->authentication_data_block_size =
avb_be64toh(dest->authentication_data_block_size);
@@ -555,8 +263,46 @@ void avb_vbmeta_image_header_to_host_byte_order(const AvbVBMetaImageHeader* src,
dest->public_key_offset = avb_be64toh(dest->public_key_offset);
dest->public_key_size = avb_be64toh(dest->public_key_size);
+ dest->public_key_metadata_offset =
+ avb_be64toh(dest->public_key_metadata_offset);
+ dest->public_key_metadata_size = avb_be64toh(dest->public_key_metadata_size);
+
dest->descriptors_offset = avb_be64toh(dest->descriptors_offset);
dest->descriptors_size = avb_be64toh(dest->descriptors_size);
dest->rollback_index = avb_be64toh(dest->rollback_index);
+ dest->flags = avb_be32toh(dest->flags);
+}
+
+const char* avb_vbmeta_verify_result_to_string(AvbVBMetaVerifyResult result) {
+ const char* ret = NULL;
+
+ switch (result) {
+ case AVB_VBMETA_VERIFY_RESULT_OK:
+ ret = "OK";
+ break;
+ case AVB_VBMETA_VERIFY_RESULT_OK_NOT_SIGNED:
+ ret = "OK_NOT_SIGNED";
+ break;
+ case AVB_VBMETA_VERIFY_RESULT_INVALID_VBMETA_HEADER:
+ ret = "INVALID_VBMETA_HEADER";
+ break;
+ case AVB_VBMETA_VERIFY_RESULT_UNSUPPORTED_VERSION:
+ ret = "UNSUPPORTED_VERSION";
+ break;
+ case AVB_VBMETA_VERIFY_RESULT_HASH_MISMATCH:
+ ret = "HASH_MISMATCH";
+ break;
+ case AVB_VBMETA_VERIFY_RESULT_SIGNATURE_MISMATCH:
+ ret = "SIGNATURE_MISMATCH";
+ break;
+ /* Do not add a 'default:' case here because of -Wswitch. */
+ }
+
+ if (ret == NULL) {
+ avb_error("Unknown AvbVBMetaVerifyResult value.\n");
+ ret = "(unknown)";
+ }
+
+ return ret;
}
diff --git a/lib/avb/libavb/avb_vbmeta_image.h b/lib/avb/libavb/avb_vbmeta_image.h
index 25d3689577..0df7126390 100644
--- a/lib/avb/libavb/avb_vbmeta_image.h
+++ b/lib/avb/libavb/avb_vbmeta_image.h
@@ -45,9 +45,17 @@ extern "C" {
#define AVB_MAGIC "AVB0"
#define AVB_MAGIC_LEN 4
-/* The current MAJOR and MINOR versions used - keep in sync with avbtool. */
-#define AVB_MAJOR_VERSION 1
-#define AVB_MINOR_VERSION 0
+/* Maximum size of the release string including the terminating NUL byte. */
+#define AVB_RELEASE_STRING_SIZE 48
+
+/* Flags for the vbmeta image.
+ *
+ * AVB_VBMETA_IMAGE_FLAGS_HASHTREE_DISABLED: If this flag is set,
+ * hashtree image verification will be disabled.
+ */
+typedef enum {
+ AVB_VBMETA_IMAGE_FLAGS_HASHTREE_DISABLED = (1 << 0)
+} AvbVBMetaImageFlags;
/* Binary format for header of the vbmeta image.
*
@@ -94,9 +102,13 @@ extern "C" {
* descriptors. See avb_descriptor_foreach() for a convenience
* function to iterate over descriptors.
*
- * This struct is versioned, see the |header_version_major| and
- * |header_version_minor| fields. Compatibility is guaranteed only
- * within the same major version.
+ * This struct is versioned, see the |required_libavb_version_major|
+ * and |required_libavb_version_minor| fields. This represents the
+ * minimum version of libavb required to verify the header and depends
+ * on the features (e.g. algorithms, descriptors) used. Note that this
+ * may be 1.0 even if generated by an avbtool from 1.4 but where no
+ * features introduced after 1.0 has been used. See the VERSIONING AND
+ * COMPATIBILITY section in the README file for more details.
*
* All fields are stored in network byte order when serialized. To
* generate a copy with fields swapped to native byte order, use the
@@ -109,10 +121,11 @@ extern "C" {
typedef struct AvbVBMetaImageHeader {
/* 0: Four bytes equal to "AVB0" (AVB_MAGIC). */
uint8_t magic[AVB_MAGIC_LEN];
- /* 4: The major version of the vbmeta image header. */
- uint32_t header_version_major;
- /* 8: The minor version of the vbmeta image header. */
- uint32_t header_version_minor;
+
+ /* 4: The major version of libavb required for this header. */
+ uint32_t required_libavb_version_major;
+ /* 8: The minor version of libavb required for this header. */
+ uint32_t required_libavb_version_minor;
/* 12: The size of the signature block. */
uint64_t authentication_data_block_size;
@@ -137,20 +150,44 @@ typedef struct AvbVBMetaImageHeader {
/* 72: Length of the public key data. */
uint64_t public_key_size;
- /* 80: Offset into the "Auxiliary data" block of descriptor data. */
+ /* 80: Offset into the "Auxiliary data" block of public key metadata. */
+ uint64_t public_key_metadata_offset;
+ /* 88: Length of the public key metadata. Must be set to zero if there
+ * is no public key metadata.
+ */
+ uint64_t public_key_metadata_size;
+
+ /* 96: Offset into the "Auxiliary data" block of descriptor data. */
uint64_t descriptors_offset;
- /* 88: Length of descriptor data. */
+ /* 104: Length of descriptor data. */
uint64_t descriptors_size;
- /* 96: The rollback index which can be used to prevent rollback to
+ /* 112: The rollback index which can be used to prevent rollback to
* older versions.
*/
uint64_t rollback_index;
- /* 104: Padding to ensure struct is size AVB_VBMETA_IMAGE_HEADER_SIZE
+ /* 120: Flags from the AvbVBMetaImageFlags enumeration. This must be
+ * set to zero if the vbmeta image is not a top-level image.
+ */
+ uint32_t flags;
+
+ /* 124: Reserved to ensure |release_string| start on a 16-byte
+ * boundary. Must be set to zeroes.
+ */
+ uint8_t reserved0[4];
+
+ /* 128: The release string from avbtool, e.g. "avbtool 1.0.0" or
+ * "avbtool 1.0.0 xyz_board Git-234abde89". Is guaranteed to be NUL
+ * terminated. Applications must not make assumptions about how this
+ * string is formatted.
+ */
+ uint8_t release_string[AVB_RELEASE_STRING_SIZE];
+
+ /* 176: Padding to ensure struct is size AVB_VBMETA_IMAGE_HEADER_SIZE
* bytes. This must be set to zeroes.
*/
- uint8_t reserved[152];
+ uint8_t reserved[80];
} AVB_ATTR_PACKED AvbVBMetaImageHeader;
/* Copies |src| to |dest|, byte-swapping fields in the process.
@@ -171,25 +208,35 @@ void avb_vbmeta_image_header_to_host_byte_order(const AvbVBMetaImageHeader* src,
* AVB_VBMETA_VERIFY_RESULT_OK_NOT_SIGNED is returned if the vbmeta
* image header is valid but there is no signature or hash.
*
- * AVB_VERIFY_INVALID_VBMETA_HEADER is returned if the header of
- * the vbmeta image is invalid, for example, invalid magic or
- * inconsistent data.
+ * AVB_VBMETA_VERIFY_RESULT_INVALID_VBMETA_HEADER is returned if the
+ * header of the vbmeta image is invalid, for example, invalid magic
+ * or inconsistent data.
+ *
+ * AVB_VBMETA_VERIFY_RESULT_UNSUPPORTED_VERSION is returned if a) the
+ * vbmeta image requires a minimum version of libavb which exceeds the
+ * version of libavb used; or b) the vbmeta image major version
+ * differs from the major version of libavb in use.
*
- * AVB_VERIFY_HASH_MISMATCH is returned if the hash stored in the
- * "Authentication data" block does not match the calculated hash.
+ * AVB_VBMETA_VERIFY_RESULT_HASH_MISMATCH is returned if the hash
+ * stored in the "Authentication data" block does not match the
+ * calculated hash.
*
- * AVB_VERIFY_SIGNATURE_MISMATCH is returned if the signature stored
- * in the "Authentication data" block is invalid or doesn't match the
- * public key stored in the vbmeta image.
+ * AVB_VBMETA_VERIFY_RESULT_SIGNATURE_MISMATCH is returned if the
+ * signature stored in the "Authentication data" block is invalid or
+ * doesn't match the public key stored in the vbmeta image.
*/
typedef enum {
AVB_VBMETA_VERIFY_RESULT_OK,
AVB_VBMETA_VERIFY_RESULT_OK_NOT_SIGNED,
AVB_VBMETA_VERIFY_RESULT_INVALID_VBMETA_HEADER,
+ AVB_VBMETA_VERIFY_RESULT_UNSUPPORTED_VERSION,
AVB_VBMETA_VERIFY_RESULT_HASH_MISMATCH,
AVB_VBMETA_VERIFY_RESULT_SIGNATURE_MISMATCH,
} AvbVBMetaVerifyResult;
+/* Get a textual representation of |result|. */
+const char* avb_vbmeta_verify_result_to_string(AvbVBMetaVerifyResult result);
+
/* Checks that vbmeta image at |data| of size |length| is a valid
* vbmeta image. The complete contents of the vbmeta image must be
* passed in. It's fine if |length| is bigger than the actual image,
@@ -205,7 +252,8 @@ typedef enum {
* |out_public_key_data| is non-NULL, it will be set to point inside
* |data| for where the serialized public key data is stored and
* |out_public_key_length|, if non-NULL, will be set to the length of
- * the public key data.
+ * the public key data. If there is no public key in the metadata then
+ * |out_public_key_data| is set to NULL.
*
* See the |AvbVBMetaVerifyResult| enum for possible return values.
*
@@ -230,7 +278,9 @@ typedef enum {
* integrity data for a whole set of partitions.
*/
AvbVBMetaVerifyResult avb_vbmeta_image_verify(
- const uint8_t* data, size_t length, const uint8_t** out_public_key_data,
+ const uint8_t* data,
+ size_t length,
+ const uint8_t** out_public_key_data,
size_t* out_public_key_length) AVB_ATTR_WARN_UNUSED_RESULT;
#ifdef __cplusplus
diff --git a/lib/avb/libavb/avb_version.c b/lib/avb/libavb/avb_version.c
new file mode 100644
index 0000000000..31f5fa6bf1
--- /dev/null
+++ b/lib/avb/libavb/avb_version.c
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Permission is hereby granted, free of charge, to any person
+ * obtaining a copy of this software and associated documentation
+ * files (the "Software"), to deal in the Software without
+ * restriction, including without limitation the rights to use, copy,
+ * modify, merge, publish, distribute, sublicense, and/or sell copies
+ * of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#include "avb_version.h"
+
+#define AVB_QUOTE(str) #str
+#define AVB_EXPAND_AND_QUOTE(str) AVB_QUOTE(str)
+
+/* Keep in sync with get_release_string() in avbtool. */
+const char* avb_version_string(void) {
+ return AVB_EXPAND_AND_QUOTE(AVB_VERSION_MAJOR) "." AVB_EXPAND_AND_QUOTE(
+ AVB_VERSION_MINOR) "." AVB_EXPAND_AND_QUOTE(AVB_VERSION_SUB);
+}
diff --git a/lib/avb/libavb/avb_version.h b/lib/avb/libavb/avb_version.h
new file mode 100644
index 0000000000..7757d090d3
--- /dev/null
+++ b/lib/avb/libavb/avb_version.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Permission is hereby granted, free of charge, to any person
+ * obtaining a copy of this software and associated documentation
+ * files (the "Software"), to deal in the Software without
+ * restriction, including without limitation the rights to use, copy,
+ * modify, merge, publish, distribute, sublicense, and/or sell copies
+ * of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#if !defined(AVB_INSIDE_LIBAVB_H) && !defined(AVB_COMPILATION)
+#error "Never include this file directly, include libavb.h instead."
+#endif
+
+#ifndef AVB_VERSION_H_
+#define AVB_VERSION_H_
+
+#include "avb_sysdeps.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* The version number of AVB - keep in sync with avbtool. */
+#define AVB_VERSION_MAJOR 1
+#define AVB_VERSION_MINOR 0
+#define AVB_VERSION_SUB 0
+
+/* Returns a NUL-terminated string for the libavb version in use. The
+ * returned string usually looks like "%d.%d.%d". Applications must
+ * not make assumptions about the content of this string.
+ *
+ * Boot loaders should display this string in debug/diagnostics output
+ * to aid with debugging.
+ *
+ * This is similar to the string put in the |release_string| string
+ * field in the VBMeta struct by avbtool.
+ */
+const char* avb_version_string(void);
+
+/* TODO: remove when there are no more users of AVB_{MAJOR,MINOR}_VERSION. */
+#define AVB_MAJOR_VERSION AVB_VERSION_MAJOR
+#define AVB_MINOR_VERSION AVB_VERSION_MINOR
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* AVB_VERSION_H_ */
diff --git a/lib/avb/libavb/libavb.h b/lib/avb/libavb/libavb.h
index b74307c73f..d511584653 100644
--- a/lib/avb/libavb/libavb.h
+++ b/lib/avb/libavb/libavb.h
@@ -44,6 +44,7 @@
#include "avb_sysdeps.h"
#include "avb_util.h"
#include "avb_vbmeta_image.h"
+#include "avb_version.h"
#undef AVB_INSIDE_LIBAVB_H
#endif /* LIBAVB_H_ */
diff --git a/lib/avb/libavb_ab/avb_ab_flow.c b/lib/avb/libavb_ab/avb_ab_flow.c
index c6a37a906a..3adb927acb 100644
--- a/lib/avb/libavb_ab/avb_ab_flow.c
+++ b/lib/avb/libavb_ab/avb_ab_flow.c
@@ -81,14 +81,17 @@ void avb_ab_data_init(AvbABData* data) {
#define AB_METADATA_MISC_PARTITION_OFFSET 2048
AvbIOResult avb_ab_data_read(AvbABOps* ab_ops, AvbABData* data) {
- AvbOps* ops = &(ab_ops->ops);
+ AvbOps* ops = ab_ops->ops;
AvbABData serialized;
AvbIOResult io_ret;
size_t num_bytes_read;
- io_ret =
- ops->read_from_partition(ops, "misc", AB_METADATA_MISC_PARTITION_OFFSET,
- sizeof(AvbABData), &serialized, &num_bytes_read);
+ io_ret = ops->read_from_partition(ops,
+ "misc",
+ AB_METADATA_MISC_PARTITION_OFFSET,
+ sizeof(AvbABData),
+ &serialized,
+ &num_bytes_read);
if (io_ret == AVB_IO_RESULT_ERROR_OOM) {
return AVB_IO_RESULT_ERROR_OOM;
} else if (io_ret != AVB_IO_RESULT_OK ||
@@ -109,14 +112,16 @@ AvbIOResult avb_ab_data_read(AvbABOps* ab_ops, AvbABData* data) {
}
AvbIOResult avb_ab_data_write(AvbABOps* ab_ops, const AvbABData* data) {
- AvbOps* ops = &(ab_ops->ops);
+ AvbOps* ops = ab_ops->ops;
AvbABData serialized;
AvbIOResult io_ret;
avb_ab_data_update_crc_and_byteswap(data, &serialized);
- io_ret =
- ops->write_to_partition(ops, "misc", AB_METADATA_MISC_PARTITION_OFFSET,
- sizeof(AvbABData), &serialized);
+ io_ret = ops->write_to_partition(ops,
+ "misc",
+ AB_METADATA_MISC_PARTITION_OFFSET,
+ sizeof(AvbABData),
+ &serialized);
if (io_ret == AVB_IO_RESULT_ERROR_OOM) {
return AVB_IO_RESULT_ERROR_OOM;
} else if (io_ret != AVB_IO_RESULT_OK) {
@@ -163,7 +168,8 @@ static const char* slot_suffixes[2] = {"_a", "_b"};
/* Helper function to load metadata - returns AVB_IO_RESULT_OK on
* success, error code otherwise.
*/
-static AvbIOResult load_metadata(AvbABOps* ab_ops, AvbABData* ab_data,
+static AvbIOResult load_metadata(AvbABOps* ab_ops,
+ AvbABData* ab_data,
AvbABData* ab_data_orig) {
AvbIOResult io_ret;
@@ -198,15 +204,16 @@ static AvbIOResult save_metadata_if_changed(AvbABOps* ab_ops,
AvbABFlowResult avb_ab_flow(AvbABOps* ab_ops,
const char* const* requested_partitions,
+ bool allow_verification_error,
AvbSlotVerifyData** out_data) {
- AvbOps* ops = &(ab_ops->ops);
+ AvbOps* ops = ab_ops->ops;
AvbSlotVerifyData* slot_data[2] = {NULL, NULL};
AvbSlotVerifyData* data = NULL;
AvbABFlowResult ret;
AvbABData ab_data, ab_data_orig;
size_t slot_index_to_boot, n;
- bool is_device_unlocked;
AvbIOResult io_ret;
+ bool saw_and_allowed_verification_error = false;
io_ret = load_metadata(ab_ops, &ab_data, &ab_data_orig);
if (io_ret == AVB_IO_RESULT_ERROR_OOM) {
@@ -221,20 +228,58 @@ AvbABFlowResult avb_ab_flow(AvbABOps* ab_ops,
for (n = 0; n < 2; n++) {
if (slot_is_bootable(&ab_data.slots[n])) {
AvbSlotVerifyResult verify_result;
- verify_result = avb_slot_verify(ops, requested_partitions,
- slot_suffixes[n], &slot_data[n]);
- if (verify_result != AVB_SLOT_VERIFY_RESULT_OK) {
- if (verify_result == AVB_SLOT_VERIFY_RESULT_ERROR_OOM) {
+ bool set_slot_unbootable = false;
+
+ verify_result = avb_slot_verify(ops,
+ requested_partitions,
+ slot_suffixes[n],
+ allow_verification_error,
+ &slot_data[n]);
+ switch (verify_result) {
+ case AVB_SLOT_VERIFY_RESULT_ERROR_OOM:
ret = AVB_AB_FLOW_RESULT_ERROR_OOM;
goto out;
- }
- if (verify_result == AVB_SLOT_VERIFY_RESULT_ERROR_IO) {
+
+ case AVB_SLOT_VERIFY_RESULT_ERROR_IO:
ret = AVB_AB_FLOW_RESULT_ERROR_IO;
goto out;
- }
- avb_errorv("Error verifying slot ", slot_suffixes[n], " with result ",
+
+ case AVB_SLOT_VERIFY_RESULT_OK:
+ break;
+
+ case AVB_SLOT_VERIFY_RESULT_ERROR_INVALID_METADATA:
+ case AVB_SLOT_VERIFY_RESULT_ERROR_UNSUPPORTED_VERSION:
+ /* Even with |allow_verification_error| these mean game over. */
+ set_slot_unbootable = true;
+ break;
+
+ /* explicit fallthrough. */
+ case AVB_SLOT_VERIFY_RESULT_ERROR_VERIFICATION:
+ case AVB_SLOT_VERIFY_RESULT_ERROR_ROLLBACK_INDEX:
+ case AVB_SLOT_VERIFY_RESULT_ERROR_PUBLIC_KEY_REJECTED:
+ if (allow_verification_error) {
+ /* Do nothing since we allow this. */
+ avb_debugv("Allowing slot ",
+ slot_suffixes[n],
+ " which verified "
+ "with result ",
+ avb_slot_verify_result_to_string(verify_result),
+ " because |allow_verification_error| is true.\n",
+ NULL);
+ saw_and_allowed_verification_error = true;
+ } else {
+ set_slot_unbootable = true;
+ }
+ break;
+ }
+
+ if (set_slot_unbootable) {
+ avb_errorv("Error verifying slot ",
+ slot_suffixes[n],
+ " with result ",
avb_slot_verify_result_to_string(verify_result),
- " - setting unbootable.\n", NULL);
+ " - setting unbootable.\n",
+ NULL);
slot_set_unbootable(&ab_data.slots[n]);
}
}
@@ -260,9 +305,9 @@ AvbABFlowResult avb_ab_flow(AvbABOps* ab_ops,
/* Update stored rollback index such that the stored rollback index
* is the largest value supporting all currently bootable slots. Do
- * this for every rollback index slot.
+ * this for every rollback index location.
*/
- for (n = 0; n < AVB_MAX_NUMBER_OF_ROLLBACK_INDEX_SLOTS; n++) {
+ for (n = 0; n < AVB_MAX_NUMBER_OF_ROLLBACK_INDEX_LOCATIONS; n++) {
uint64_t rollback_index_value = 0;
if (slot_data[0] != NULL && slot_data[1] != NULL) {
@@ -306,7 +351,12 @@ AvbABFlowResult avb_ab_flow(AvbABOps* ab_ops,
avb_assert(slot_data[slot_index_to_boot] != NULL);
data = slot_data[slot_index_to_boot];
slot_data[slot_index_to_boot] = NULL;
- ret = AVB_AB_FLOW_RESULT_OK;
+ if (saw_and_allowed_verification_error) {
+ avb_assert(allow_verification_error);
+ ret = AVB_AB_FLOW_RESULT_OK_WITH_VERIFICATION_ERROR;
+ } else {
+ ret = AVB_AB_FLOW_RESULT_OK;
+ }
/* ... and decrement tries remaining, if applicable. */
if (!ab_data.slots[slot_index_to_boot].successful_boot &&
@@ -315,20 +365,6 @@ AvbABFlowResult avb_ab_flow(AvbABOps* ab_ops,
}
out:
- /* do not touch metadata in UNLOCK state */
- io_ret = ops->read_is_device_unlocked(ops, &is_device_unlocked);
- if (io_ret == AVB_IO_RESULT_ERROR_OOM) {
- ret = AVB_AB_FLOW_RESULT_ERROR_OOM;
- goto fail;
- } else if (io_ret != AVB_IO_RESULT_OK) {
- ret = AVB_SLOT_VERIFY_RESULT_ERROR_IO;
- avb_error("Error getting device state.\n");
- goto fail;
- }
- if (is_device_unlocked)
- goto ret;
-
-fail:
io_ret = save_metadata_if_changed(ab_ops, &ab_data, &ab_data_orig);
if (io_ret != AVB_IO_RESULT_OK) {
if (io_ret == AVB_IO_RESULT_ERROR_OOM) {
@@ -342,7 +378,6 @@ fail:
}
}
-ret:
for (n = 0; n < 2; n++) {
if (slot_data[n] != NULL) {
avb_slot_verify_data_free(slot_data[n]);
@@ -445,3 +480,37 @@ out:
}
return ret;
}
+
+const char* avb_ab_flow_result_to_string(AvbABFlowResult result) {
+ const char* ret = NULL;
+
+ switch (result) {
+ case AVB_AB_FLOW_RESULT_OK:
+ ret = "OK";
+ break;
+
+ case AVB_AB_FLOW_RESULT_OK_WITH_VERIFICATION_ERROR:
+ ret = "OK_WITH_VERIFICATION_ERROR";
+ break;
+
+ case AVB_AB_FLOW_RESULT_ERROR_OOM:
+ ret = "ERROR_OOM";
+ break;
+
+ case AVB_AB_FLOW_RESULT_ERROR_IO:
+ ret = "ERROR_IO";
+ break;
+
+ case AVB_AB_FLOW_RESULT_ERROR_NO_BOOTABLE_SLOTS:
+ ret = "ERROR_NO_BOOTABLE_SLOTS";
+ break;
+ /* Do not add a 'default:' case here because of -Wswitch. */
+ }
+
+ if (ret == NULL) {
+ avb_error("Unknown AvbABFlowResult value.\n");
+ ret = "(unknown)";
+ }
+
+ return ret;
+}
diff --git a/lib/avb/libavb_ab/avb_ab_flow.h b/lib/avb/libavb_ab/avb_ab_flow.h
index 21f680a934..b2584d81c4 100644
--- a/lib/avb/libavb_ab/avb_ab_flow.h
+++ b/lib/avb/libavb_ab/avb_ab_flow.h
@@ -23,7 +23,8 @@
*/
#if !defined(AVB_INSIDE_LIBAVB_AB_H) && !defined(AVB_COMPILATION)
-#error "Never include this file directly, include libavb/libavb_ab.h instead."
+#error \
+ "Never include this file directly, include libavb_ab/libavb_ab.h instead."
#endif
#ifndef AVB_AB_FLOW_H_
@@ -136,11 +137,15 @@ AvbIOResult avb_ab_data_write(AvbABOps* ab_ops, const AvbABData* data);
*/
typedef enum {
AVB_AB_FLOW_RESULT_OK,
+ AVB_AB_FLOW_RESULT_OK_WITH_VERIFICATION_ERROR,
AVB_AB_FLOW_RESULT_ERROR_OOM,
AVB_AB_FLOW_RESULT_ERROR_IO,
AVB_AB_FLOW_RESULT_ERROR_NO_BOOTABLE_SLOTS
} AvbABFlowResult;
+/* Get a textual representation of |result|. */
+const char* avb_ab_flow_result_to_string(AvbABFlowResult result);
+
/* High-level function to select a slot to boot. The following
* algorithm is used:
*
@@ -150,17 +155,18 @@ typedef enum {
* avb_ab_data_init() and this reset metadata is returned.
*
* 2. All bootable slots listed in the A/B metadata are verified using
- * avb_slot_verify(). If a slot fails verification, it will be marked
- * as unbootable in the A/B metadata and the metadata will be saved to
- * disk before returning.
+ * avb_slot_verify(). If a slot is invalid or if it fails verification
+ * (and |allow_verification_error| is false, see below), it will be
+ * marked as unbootable in the A/B metadata and the metadata will be
+ * saved to disk before returning.
*
* 3. If there are no bootable slots, the value
* AVB_AB_FLOW_RESULT_ERROR_NO_BOOTABLE_SLOTS is returned.
*
* 4. For each bootable slot, the Stored Rollback Indexes are updated
- * such that for each rollback index slot, the Stored Rollback Index
- * is the largest number smaller than or equal to the Rollback Index
- * of each slot.
+ * such that for each rollback index location, the Stored Rollback
+ * Index is the largest number smaller than or equal to the Rollback
+ * Index of each slot.
*
* 5. The bootable slot with the highest priority is selected and
* returned in |out_data|. If this slot is already marked as
@@ -174,6 +180,26 @@ typedef enum {
* |requested_partitions| array only contains a single item for the
* boot partition, 'boot'.
*
+ * If the device is unlocked (and _only_ if it's unlocked), true
+ * should be passed in the |allow_verification_error| parameter. This
+ * will allow considering slots as verified even when
+ * avb_slot_verify() returns
+ * AVB_SLOT_VERIFY_RESULT_ERROR_PUBLIC_KEY_REJECTED,
+ * AVB_SLOT_VERIFY_RESULT_ERROR_VERIFICATION, or
+ * AVB_SLOT_VERIFY_RESULT_ERROR_ROLLBACK_INDEX for the slot in
+ * question.
+ *
+ * Note that androidboot.slot_suffix is not set in the |cmdline| field
+ * in |AvbSlotVerifyData| - you will have to pass this command-line
+ * option yourself.
+ *
+ * If a slot was selected and it verified then AVB_AB_FLOW_RESULT_OK
+ * is returned.
+ *
+ * If a slot was selected but it didn't verify then
+ * AVB_AB_FLOW_RESULT_OK_WITH_VERIFICATION_ERROR is returned. This can
+ * only happen when |allow_verification_error| is true.
+ *
* If an I/O operation - such as loading/saving metadata or checking
* rollback indexes - fail, the value AVB_AB_FLOW_RESULT_ERROR_IO is
* returned.
@@ -182,10 +208,11 @@ typedef enum {
* returned.
*
* Reasonable behavior for handling AVB_AB_FLOW_RESULT_ERROR_NO_BOOTABLE_SLOTS
- * is to initiate device recovery (which is device-dependent).
+ * is to initiate device repair (which is device-dependent).
*/
AvbABFlowResult avb_ab_flow(AvbABOps* ab_ops,
const char* const* requested_partitions,
+ bool allow_verification_error,
AvbSlotVerifyData** out_data);
/* Marks the slot with the given slot number as active. Returns
diff --git a/lib/avb/libavb_ab/avb_ab_ops.h b/lib/avb/libavb_ab/avb_ab_ops.h
index d3f6c0181e..725c51fdff 100644
--- a/lib/avb/libavb_ab/avb_ab_ops.h
+++ b/lib/avb/libavb_ab/avb_ab_ops.h
@@ -23,7 +23,8 @@
*/
#if !defined(AVB_INSIDE_LIBAVB_AB_H) && !defined(AVB_COMPILATION)
-#error "Never include this file directly, include libavb/libavb_ab.h instead."
+#error \
+ "Never include this file directly, include libavb_ab/libavb_ab.h instead."
#endif
#ifndef AVB_AB_OPS_H_
@@ -41,11 +42,11 @@ typedef struct AvbABOps AvbABOps;
struct AvbABData;
/* High-level operations/functions/methods for A/B that are platform
- * dependent. This struct extends the AvbOps struct from libavb.
+ * dependent.
*/
struct AvbABOps {
/* Operations from libavb. */
- AvbOps ops;
+ AvbOps* ops;
/* Reads A/B metadata from persistent storage. Returned data is
* properly byteswapped. Returns AVB_IO_RESULT_OK on success, error
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-06 01:38:24 +0000