Evolution-x/hardware_interfaces
1
0
Fork 0
mirror of https://github.com/Evolution-X/hardware_interfaces synced 2026-02-01 11:36:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

Expect SHA-256 digest for attested VBMeta digest on VSR-V+.

Browse Source 
Bug: 309963984
Bug: 376832222
Test: atest VtsAidlKeyMintTargetTest
Change-Id: I99684cf16d84a08f607aceeb8f51d78d89e93511
This commit is contained in:
Catherine Vlasov
2024-10-30 14:26:06 +00:00
parent 107a7a9277
commit c4f2acc76d
1 changed files with 22 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
security/keymint/aidl/vts/functional/BootloaderStateTest.cpp
View File

@@ -109,7 +109,7 @@ static inline bool avb_slot_data_loaded(AvbSlotVerifyResult result) {
}
}
// Check that attested vbmeta digest is correct.
// Check that the attested VBMeta digest is correct.
TEST_P(BootloaderStateTest, VbmetaDigest) {
AvbSlotVerifyData* avbSlotData;
auto suffix = fs_mgr_get_slot_suffix();
@@ -125,21 +125,29 @@ TEST_P(BootloaderStateTest, VbmetaDigest) {
AVB_HASHTREE_ERROR_MODE_EIO, &avbSlotData);
ASSERT_TRUE(avb_slot_data_loaded(result)) << "Failed to load avb slot data";
// Unfortunately, bootloader is not required to report the algorithm used
// to calculate the digest. There are only two supported options though,
// SHA256 and SHA512. Attested VBMeta digest must match one of these.
vector<uint8_t> digest256(AVB_SHA256_DIGEST_SIZE);
vector<uint8_t> digest512(AVB_SHA512_DIGEST_SIZE);
vector<uint8_t> sha256Digest(AVB_SHA256_DIGEST_SIZE);
avb_slot_verify_data_calculate_vbmeta_digest(avbSlotData, AVB_DIGEST_TYPE_SHA256,
digest256.data());
avb_slot_verify_data_calculate_vbmeta_digest(avbSlotData, AVB_DIGEST_TYPE_SHA512,
digest512.data());
sha256Digest.data());
ASSERT_TRUE((attestedVbmetaDigest_ == digest256) || (attestedVbmetaDigest_ == digest512))
<< "Attested vbmeta digest (" << bin2hex(attestedVbmetaDigest_)
<< ") does not match computed digest (sha256: " << bin2hex(digest256)
<< ", sha512: " << bin2hex(digest512) << ").";
if (get_vsr_api_level() >= __ANDROID_API_V__) {
ASSERT_TRUE(attestedVbmetaDigest_ == sha256Digest)
<< "Attested VBMeta digest (" << bin2hex(attestedVbmetaDigest_)
<< ") does not match the expected SHA-256 digest (" << bin2hex(sha256Digest)
<< ").";
} else {
// Prior to VSR-V, there was no MUST requirement for the algorithm used by the bootloader
// to calculate the VBMeta digest. However, the only two supported options are SHA-256 and
// SHA-512, so we expect the attested VBMeta digest to match one of these.
vector<uint8_t> sha512Digest(AVB_SHA512_DIGEST_SIZE);
avb_slot_verify_data_calculate_vbmeta_digest(avbSlotData, AVB_DIGEST_TYPE_SHA512,
sha512Digest.data());
ASSERT_TRUE((attestedVbmetaDigest_ == sha256Digest) ||
(attestedVbmetaDigest_ == sha512Digest))
<< "Attested VBMeta digest (" << bin2hex(attestedVbmetaDigest_)
<< ") does not match the expected digest (SHA-256: " << bin2hex(sha256Digest)
<< " or SHA-512: " << bin2hex(sha512Digest) << ").";
}
}
INSTANTIATE_KEYMINT_AIDL_TEST(BootloaderStateTest);