tests/vboot_firmware_tests.c - mirrors/cros/chromiumos/platform/vboot_reference - Git at Google

 /* Copyright (c) 2012 The Chromium OS Authors. All rights reserved.
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  *
  * Tests for vboot_firmware library.
  */

 #include <stdint.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>

 #include "gbb_header.h"
 #include "host_common.h"
 #include "load_firmware_fw.h"
 #include "test_common.h"
 #include "vboot_common.h"
 #include "vboot_nvstorage.h"
 #include "vboot_struct.h"

 /* Mock data */
 static VbCommonParams cparams;
 static VbSelectFirmwareParams fparams;
 static VbKeyBlockHeader vblock[2];
 static VbFirmwarePreambleHeader mpreamble[2];
 static VbNvContext vnc;
 static uint8_t shared_data[VB_SHARED_DATA_MIN_SIZE];
 static VbSharedDataHeader* shared = (VbSharedDataHeader*)shared_data;
 static uint8_t gbb_data[sizeof(GoogleBinaryBlockHeader) + 2048];
 static GoogleBinaryBlockHeader* gbb = (GoogleBinaryBlockHeader*)gbb_data;
 static RSAPublicKey data_key;
 static uint32_t digest_size;
 static uint8_t* digest_returned;
 static uint8_t* digest_expect_ptr;
 static int hash_fw_index;

 #define TEST_KEY_DATA	\
 	"Test contents for the root key this should be 64 chars long."

 /* Reset mock data (for use before each test) */
 static void ResetMocks(void) {
   VbPublicKey *root_key;
   uint8_t *root_key_data;
   int i;

   Memset(&cparams, 0, sizeof(cparams));
   cparams.shared_data_blob = shared_data;
   cparams.gbb_data = gbb_data;
   cparams.gbb_size = sizeof(gbb_data);
   cparams.gbb = gbb;

   Memset(&fparams, 0, sizeof(fparams));
   fparams.verification_block_A = vblock;
   fparams.verification_size_A = sizeof(VbKeyBlockHeader);
   fparams.verification_block_B = vblock + 1;
   fparams.verification_size_B = sizeof(VbKeyBlockHeader);

   Memset(vblock, 0, sizeof(vblock));
   Memset(mpreamble, 0, sizeof(mpreamble));
   for (i = 0; i < 2; i++) {
     /* Default verification blocks to working in all modes */
     vblock[i].key_block_flags = 0x0F;
     vblock[i].data_key.key_version = 2;
     /* Fix up offsets to preambles */
     vblock[i].key_block_size =
         (uint8_t*)(mpreamble + i) - (uint8_t*)(vblock + i);

     mpreamble[i].header_version_minor = 1;  /* Supports preamble flags */
     mpreamble[i].firmware_version = 4;
     /* Point kernel subkey to some data following the key header */
     PublicKeyInit(&mpreamble[i].kernel_subkey,
                   (uint8_t*)&mpreamble[i].body_signature, 20);
     mpreamble[i].kernel_subkey.algorithm = 7 + i;
     mpreamble[i].body_signature.data_size = 20000 + 1000 * i;
   }

   Memset(&vnc, 0, sizeof(vnc));
   VbNvSetup(&vnc);

   Memset(&shared_data, 0, sizeof(shared_data));
   VbSharedDataInit(shared, sizeof(shared_data));
   shared->fw_version_tpm = 0x00020004;

   Memset(&gbb_data, 0, sizeof(gbb_data));
   gbb->rootkey_offset = sizeof(GoogleBinaryBlockHeader);
   root_key = (VbPublicKey *)(gbb_data + gbb->rootkey_offset);
   root_key_data = (uint8_t *)(root_key + 1);
   strcpy((char *)root_key_data, TEST_KEY_DATA);
   PublicKeyInit(root_key, (uint8_t *)root_key_data, sizeof(TEST_KEY_DATA));

   gbb->major_version = GBB_MAJOR_VER;
   gbb->minor_version = GBB_MINOR_VER;
   gbb->flags = 0;

   Memset(&data_key, 0, sizeof(data_key));

   digest_size = 1234;
   digest_returned = NULL;
   digest_expect_ptr = NULL;
   hash_fw_index = -1;
 }

 /****************************************************************************/
 /* Mocked verification functions */

 int KeyBlockVerify(const VbKeyBlockHeader* block, uint64_t size,
                    const VbPublicKey *key, int hash_only) {

   TEST_EQ(hash_only, 0, "  Don't verify firmware with hash");

   /*
    * We cannot check the address of key, since it will be allocated. We
    * check the contents instead.
    */
   TEST_STR_EQ((char *)GetPublicKeyDataC(key), TEST_KEY_DATA,
               "  Verify with root key");
   TEST_NEQ(block==vblock || block==vblock+1, 0, "  Verify a valid key block");

   /* Mock uses header_version_major to hold return value */
   return block->header_version_major;
 }

 int VerifyFirmwarePreamble(const VbFirmwarePreambleHeader* preamble,
                            uint64_t size, const RSAPublicKey* key) {
   TEST_PTR_EQ(key, &data_key, "  Verify preamble data key");
   TEST_NEQ(preamble==mpreamble || preamble==mpreamble+1, 0,
            "  Verify a valid preamble");

   /* Mock uses header_version_major to hold return value */
   return preamble->header_version_major;
 }

 RSAPublicKey* PublicKeyToRSA(const VbPublicKey* key) {
   /* Mock uses algorithm!0 to mean invalid key */
   if (key->algorithm)
     return NULL;
   /* Mock uses data key len to hold number of alloc'd keys */
   data_key.len++;
   return &data_key;
 }

 void RSAPublicKeyFree(RSAPublicKey* key) {
   TEST_PTR_EQ(key, &data_key, "  RSA data key");
   data_key.len--;
 }

 void DigestInit(DigestContext* ctx, int sig_algorithm) {
   digest_size = 0;
 }

 void DigestUpdate(DigestContext* ctx, const uint8_t* data, uint32_t len) {
   TEST_PTR_EQ(data, digest_expect_ptr, "  Digesting expected data");
   digest_size += len;
 }

 uint8_t* DigestFinal(DigestContext* ctx) {
   digest_returned = (uint8_t*)VbExMalloc(4);
   return digest_returned;
 }

 VbError_t VbExHashFirmwareBody(VbCommonParams* cparams,
                                uint32_t firmware_index) {
   if (VB_SELECT_FIRMWARE_A == firmware_index)
     hash_fw_index = 0;
   else if (VB_SELECT_FIRMWARE_B == firmware_index)
     hash_fw_index = 1;
   else
     return VBERROR_INVALID_PARAMETER;

   digest_expect_ptr = (uint8_t*)(vblock + hash_fw_index) + 5;
   VbUpdateFirmwareBodyHash(
       cparams, digest_expect_ptr,
       mpreamble[hash_fw_index].body_signature.data_size - 1024);
   VbUpdateFirmwareBodyHash(cparams, digest_expect_ptr, 1024);

   /* If signature offset is 42, hash the wrong amount and return success */
   if (42 == mpreamble[hash_fw_index].body_signature.sig_offset) {
     VbUpdateFirmwareBodyHash(cparams, digest_expect_ptr, 4);
     return VBERROR_SUCCESS;
   }

   /* Otherwise, mocked function uses body signature offset as returned value */
   return mpreamble[hash_fw_index].body_signature.sig_offset;
 }

 int VerifyDigest(const uint8_t* digest, const VbSignature *sig,
                  const RSAPublicKey* key) {
   TEST_PTR_EQ(digest, digest_returned, "Verifying expected digest");
   TEST_PTR_EQ(key, &data_key, "Verifying using data key");
   TEST_PTR_EQ(sig, &mpreamble[hash_fw_index].body_signature, "Verifying sig");
   /* Mocked function uses sig size as return value for verifying digest */
   return sig->sig_size;
 }

 /****************************************************************************/
 /* Test LoadFirmware() and check expected return value and recovery reason */
 static void TestLoadFirmware(VbError_t expected_retval,
                              uint8_t expected_recovery, const char* desc) {
   uint32_t rr = 256;

   TEST_EQ(LoadFirmware(&cparams, &fparams, &vnc), expected_retval, desc);
   VbNvGet(&vnc, VBNV_RECOVERY_REQUEST, &rr);
   TEST_EQ(rr, expected_recovery, "  recovery request");
   TEST_EQ(data_key.len, 0, "  Data key free must be paired with alloc");
 }

 /****************************************************************************/

 static void LoadFirmwareTest(void) {
   uint32_t u;

   /* Require GBB */
   ResetMocks();
   cparams.gbb_data = NULL;
   TestLoadFirmware(VBERROR_INVALID_GBB, VBNV_RECOVERY_RO_UNSPECIFIED,
                    "No GBB");

   /* Key block flags must match */
   /* Normal boot */
   ResetMocks();
   vblock[0].key_block_flags = KEY_BLOCK_FLAG_DEVELOPER_1;
   vblock[1].key_block_flags =
       KEY_BLOCK_FLAG_DEVELOPER_0 | KEY_BLOCK_FLAG_RECOVERY_1;
   TestLoadFirmware(VBERROR_LOAD_FIRMWARE,
                    (VBNV_RECOVERY_RO_INVALID_RW_CHECK_MIN +
                     VBSD_LF_CHECK_REC_MISMATCH),
                    "Flags mismatch dev=0");
   TEST_EQ(shared->flags & VBSD_LF_DEV_SWITCH_ON, 0,
           "Dev flag in shared.flags dev=0");
   TEST_EQ(shared->check_fw_a_result, VBSD_LF_CHECK_DEV_MISMATCH,
           "Key block flag mismatch for dev=0");
   TEST_EQ(shared->check_fw_b_result, VBSD_LF_CHECK_REC_MISMATCH,
           "Key block flag mismatch for rec=0");
   /* Developer boot */
   ResetMocks();
   shared->flags |= VBSD_BOOT_DEV_SWITCH_ON;
   vblock[0].key_block_flags = KEY_BLOCK_FLAG_DEVELOPER_0;
   vblock[1].key_block_flags =
       KEY_BLOCK_FLAG_DEVELOPER_1 | KEY_BLOCK_FLAG_RECOVERY_1;
   TestLoadFirmware(VBERROR_LOAD_FIRMWARE,
                    (VBNV_RECOVERY_RO_INVALID_RW_CHECK_MIN +
                     VBSD_LF_CHECK_REC_MISMATCH),
                    "Flags mismatch dev=1");
   TEST_NEQ(shared->flags & VBSD_LF_DEV_SWITCH_ON, 0,
           "Dev flag in shared.flags dev=1");
   TEST_EQ(shared->check_fw_a_result, VBSD_LF_CHECK_DEV_MISMATCH,
           "Key block flag mismatch for dev=1");
   TEST_EQ(shared->check_fw_b_result, VBSD_LF_CHECK_REC_MISMATCH,
           "Key block flag mismatch for rec=1");

   /* Test key block verification with A and key version rollback with B */
   ResetMocks();
   vblock[0].header_version_major = 1;  /* Simulate failure */
   vblock[1].data_key.key_version = 1;  /* Simulate rollback */
   TestLoadFirmware(VBERROR_LOAD_FIRMWARE,
                    (VBNV_RECOVERY_RO_INVALID_RW_CHECK_MIN +
                     VBSD_LF_CHECK_KEY_ROLLBACK),
                    "Key block invalid / key version rollback");
   TEST_EQ(shared->check_fw_a_result, VBSD_LF_CHECK_VERIFY_KEYBLOCK,
           "Key block invalid");
   TEST_EQ(shared->check_fw_b_result, VBSD_LF_CHECK_KEY_ROLLBACK,
           "Key version rollback ");
   TEST_EQ(shared->fw_version_lowest, 0, "Lowest valid version");
   TEST_EQ(shared->fw_version_tpm, 0x20004, "TPM version");

   /* Test invalid key version with A and bad data key with B */
   ResetMocks();
   vblock[0].data_key.key_version = 0x10003;  /* Version > 0xFFFF is invalid */
   vblock[1].data_key.algorithm = 1;  /* Simulate invalid data key */
   TestLoadFirmware(VBERROR_LOAD_FIRMWARE,
                    (VBNV_RECOVERY_RO_INVALID_RW_CHECK_MIN +
                     VBSD_LF_CHECK_DATA_KEY_PARSE),
                    "Key version overflow / invalid data key");
   TEST_EQ(shared->check_fw_a_result, VBSD_LF_CHECK_KEY_ROLLBACK,
           "Key version overflow");
   TEST_EQ(shared->check_fw_b_result, VBSD_LF_CHECK_DATA_KEY_PARSE,
           "Data key invalid");

   /* Test invalid key version with GBB bypass-rollback flag */
   ResetMocks();
   vblock[0].data_key.key_version = 1;  /* Simulate rollback */
   gbb->flags = GBB_FLAG_DISABLE_FW_ROLLBACK_CHECK;
   TestLoadFirmware(VBERROR_SUCCESS, 0, "Key version check + GBB override");
   TEST_EQ(shared->check_fw_a_result, VBSD_LF_CHECK_VALID,
           "Key version rollback + GBB override");

   /* Test invalid preamble with A */
   ResetMocks();
   mpreamble[0].header_version_major = 1;  /* Simulate failure */
   vblock[1].key_block_flags = 0;  /* Invalid */
   TestLoadFirmware(VBERROR_LOAD_FIRMWARE,
                    (VBNV_RECOVERY_RO_INVALID_RW_CHECK_MIN +
                     VBSD_LF_CHECK_VERIFY_PREAMBLE),
                    "Preamble invalid");
   TEST_EQ(shared->check_fw_a_result, VBSD_LF_CHECK_VERIFY_PREAMBLE,
           "Preamble invalid A");

   /* Test invalid firmware versions */
   ResetMocks();
   mpreamble[0].firmware_version = 3;  /* Simulate rollback */
   mpreamble[1].firmware_version = 0x10001;  /* Check overflow */
   TestLoadFirmware(VBERROR_LOAD_FIRMWARE,
                    (VBNV_RECOVERY_RO_INVALID_RW_CHECK_MIN +
                     VBSD_LF_CHECK_FW_ROLLBACK),
                    "Firmware version check");
   TEST_EQ(shared->check_fw_a_result, VBSD_LF_CHECK_FW_ROLLBACK,
           "Firmware version rollback");
   TEST_EQ(shared->check_fw_b_result, VBSD_LF_CHECK_FW_ROLLBACK,
           "Firmware version overflow");

   /* Test invalid firmware versions with GBB bypass-rollback flag */
   ResetMocks();
   mpreamble[0].firmware_version = 3;  /* Simulate rollback */
   mpreamble[1].firmware_version = 0x10001;  /* Check overflow */
   gbb->flags = GBB_FLAG_DISABLE_FW_ROLLBACK_CHECK;
   TestLoadFirmware(VBERROR_SUCCESS, 0, "Firmware version check + GBB bypass");
   TEST_EQ(shared->check_fw_a_result, VBSD_LF_CHECK_VALID,
           "Firmware version rollback + GBB override");
   TEST_EQ(shared->check_fw_b_result, VBSD_LF_CHECK_HEADER_VALID,
           "Firmware version overflow + GBB override");

   /* Test RO normal with A */
   ResetMocks();
   mpreamble[0].flags = VB_FIRMWARE_PREAMBLE_USE_RO_NORMAL;
   vblock[1].key_block_flags = 0;  /* Invalid */
   TestLoadFirmware(VBERROR_LOAD_FIRMWARE,
                    (VBNV_RECOVERY_RO_INVALID_RW_CHECK_MIN +
                     VBSD_LF_CHECK_NO_RO_NORMAL),
                    "Preamble asked for RO normal but fw doesn't support it");
   TEST_EQ(shared->check_fw_a_result, VBSD_LF_CHECK_NO_RO_NORMAL,
           "No RO normal A");

   /* If RO normal is supported, don't need to verify the firmware body */
   ResetMocks();
   mpreamble[0].flags = VB_FIRMWARE_PREAMBLE_USE_RO_NORMAL;
   /* Mock bad sig, to ensure we didn't use it */
   mpreamble[0].body_signature.sig_size = 1;
   shared->flags |= VBSD_BOOT_RO_NORMAL_SUPPORT;
   vblock[1].key_block_flags = 0;  /* Invalid */
   TestLoadFirmware(VBERROR_SUCCESS, 0, "RO normal A");
   TEST_EQ(shared->check_fw_a_result, VBSD_LF_CHECK_VALID, "RO normal A valid");
   TEST_EQ(shared->firmware_index, 0, "Boot A shared index");
   TEST_EQ(shared->fw_keyblock_flags, vblock[0].key_block_flags,
           "Copy key block flags");
   TEST_EQ(shared->kernel_subkey.algorithm, 7, "Copy kernel subkey");

   /* If both A and B are valid and same version as TPM, A is selected
    * and B isn't attempted. */
   ResetMocks();
   mpreamble[0].flags = VB_FIRMWARE_PREAMBLE_USE_RO_NORMAL;
   mpreamble[1].flags = VB_FIRMWARE_PREAMBLE_USE_RO_NORMAL;
   shared->flags |= VBSD_BOOT_RO_NORMAL_SUPPORT;
   TestLoadFirmware(VBERROR_SUCCESS, 0, "Check A then B");
   TEST_EQ(shared->check_fw_a_result, VBSD_LF_CHECK_VALID, "RO normal A valid");
   TEST_EQ(shared->check_fw_b_result, 0, "RO normal B not checked ");
   TEST_EQ(shared->firmware_index, 0, "Boot A");
   TEST_EQ(shared->flags & VBSD_FWB_TRIED, 0, "Didn't try firmware B");
   TEST_EQ(shared->kernel_subkey.algorithm, 7, "Copy kernel subkey");
   /* But if try B flag is set, B is selected and A not attempted */
   ResetMocks();
   mpreamble[0].flags = VB_FIRMWARE_PREAMBLE_USE_RO_NORMAL;
   mpreamble[1].flags = VB_FIRMWARE_PREAMBLE_USE_RO_NORMAL;
   shared->flags |= VBSD_BOOT_RO_NORMAL_SUPPORT;
   VbNvSet(&vnc, VBNV_TRY_B_COUNT, 5);
   TestLoadFirmware(VBERROR_SUCCESS, 0, "Check B then A");
   TEST_EQ(shared->check_fw_a_result, 0, "RO normal A not checked ");
   TEST_EQ(shared->check_fw_b_result, VBSD_LF_CHECK_VALID, "RO normal B valid");
   TEST_EQ(shared->firmware_index, 1, "Boot B");
   TEST_NEQ(shared->flags & VBSD_FWB_TRIED, 0, "Tried firmware B");
   TEST_EQ(shared->kernel_subkey.algorithm, 8, "Copy kernel subkey");
   VbNvGet(&vnc, VBNV_TRY_B_COUNT, &u);
   TEST_EQ(u, 4, "Used up a try");

   /* If both A and B are valid and grater version than TPM, A is
    * selected and B preamble (but not body) is verified. */
   ResetMocks();
   mpreamble[0].flags = VB_FIRMWARE_PREAMBLE_USE_RO_NORMAL;
   mpreamble[1].flags = 0;
   mpreamble[0].firmware_version = 5;
   mpreamble[1].firmware_version = 6;
   shared->flags |= VBSD_BOOT_RO_NORMAL_SUPPORT;
   TestLoadFirmware(VBERROR_SUCCESS, 0, "Check A then B advancing version");
   TEST_EQ(shared->check_fw_a_result, VBSD_LF_CHECK_VALID, "RO normal A valid");
   TEST_EQ(shared->check_fw_b_result, VBSD_LF_CHECK_HEADER_VALID,
           "RO normal B header valid");
   TEST_EQ(shared->firmware_index, 0, "Boot A");
   TEST_EQ(shared->fw_keyblock_flags, vblock[0].key_block_flags, "Key block A");
   TEST_EQ(shared->kernel_subkey.algorithm, 7, "Copy kernel subkey");
   TEST_EQ(shared->fw_version_lowest, 0x20005, "Lowest valid version");
   TEST_EQ(shared->fw_version_tpm, 0x20005, "TPM version advanced");

   /* Verify firmware data */
   ResetMocks();
   vblock[1].key_block_flags = 0;  /* Invalid */
   TestLoadFirmware(VBERROR_SUCCESS, 0, "Verify firmware body");
   TEST_EQ(shared->check_fw_a_result, VBSD_LF_CHECK_VALID,
           "Firmware body A valid");
   TEST_EQ(shared->firmware_index, 0, "Boot A shared index");
   TEST_EQ(hash_fw_index, 0, "Hash firmware data A");
   TEST_EQ(digest_size, mpreamble[0].body_signature.data_size,
           "Verified all data expected");

   /* Test error getting firmware body */
   ResetMocks();
   mpreamble[0].body_signature.sig_offset = VBERROR_UNKNOWN;
   vblock[1].key_block_flags = 0;  /* Invalid */
   TestLoadFirmware(VBERROR_LOAD_FIRMWARE,
                    (VBNV_RECOVERY_RO_INVALID_RW_CHECK_MIN +
                     VBSD_LF_CHECK_GET_FW_BODY),
                    "Error getting firmware body");
   TEST_EQ(shared->check_fw_a_result, VBSD_LF_CHECK_GET_FW_BODY,
           "Firmware body A");

   /* Test digesting the wrong amount */
   ResetMocks();
   mpreamble[0].body_signature.sig_offset = 42;  /* Mock hashing wrong amount */
   vblock[1].key_block_flags = 0;  /* Invalid */
   TestLoadFirmware(VBERROR_LOAD_FIRMWARE,
                    (VBNV_RECOVERY_RO_INVALID_RW_CHECK_MIN +
                     VBSD_LF_CHECK_HASH_WRONG_SIZE),
                    "Hash wrong size");
   TEST_EQ(shared->check_fw_a_result, VBSD_LF_CHECK_HASH_WRONG_SIZE,
           "Firmware hash wrong size A");

   /* Test bad signature */
   ResetMocks();
   mpreamble[0].body_signature.sig_size = 1;  /* Mock bad sig */
   vblock[1].key_block_flags = 0;  /* Invalid */
   TestLoadFirmware(VBERROR_LOAD_FIRMWARE,
                    (VBNV_RECOVERY_RO_INVALID_RW_CHECK_MIN +
                     VBSD_LF_CHECK_VERIFY_BODY),
                    "Bad signature");
   TEST_EQ(shared->check_fw_a_result, VBSD_LF_CHECK_VERIFY_BODY,
           "Bad signature A");

   /* Test unable to store kernel data key */
   ResetMocks();
   mpreamble[0].kernel_subkey.key_size = VB_SHARED_DATA_MIN_SIZE + 1;
   vblock[1].key_block_flags = 0;  /* Invalid */
   TestLoadFirmware(VBERROR_LOAD_FIRMWARE,
                    (VBNV_RECOVERY_RO_INVALID_RW_CHECK_MIN +
                     VBSD_LF_CHECK_VALID),
                    "Kernel key too big");
   TEST_EQ(shared->check_fw_a_result, VBSD_LF_CHECK_VALID,
           "Kernel key too big");
 }


 int main(int argc, char* argv[]) {
   int error_code = 0;

   LoadFirmwareTest();

   if (vboot_api_stub_check_memory())
     error_code = 255;
   if (!gTestSuccess)
     error_code = 255;

   return error_code;
 }
	/* Copyright (c) 2012 The Chromium OS Authors. All rights reserved.
	* Use of this source code is governed by a BSD-style license that can be
	* found in the LICENSE file.
	*
	* Tests for vboot_firmware library.
	*/

	#include <stdint.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>

	#include "gbb_header.h"
	#include "host_common.h"
	#include "load_firmware_fw.h"
	#include "test_common.h"
	#include "vboot_common.h"
	#include "vboot_nvstorage.h"
	#include "vboot_struct.h"

	/* Mock data */
	static VbCommonParams cparams;
	static VbSelectFirmwareParams fparams;
	static VbKeyBlockHeader vblock[2];
	static VbFirmwarePreambleHeader mpreamble[2];
	static VbNvContext vnc;
	static uint8_t shared_data[VB_SHARED_DATA_MIN_SIZE];
	static VbSharedDataHeader* shared = (VbSharedDataHeader*)shared_data;
	static uint8_t gbb_data[sizeof(GoogleBinaryBlockHeader) + 2048];
	static GoogleBinaryBlockHeader* gbb = (GoogleBinaryBlockHeader*)gbb_data;
	static RSAPublicKey data_key;
	static uint32_t digest_size;
	static uint8_t* digest_returned;
	static uint8_t* digest_expect_ptr;
	static int hash_fw_index;

	#define TEST_KEY_DATA \
	"Test contents for the root key this should be 64 chars long."

	/* Reset mock data (for use before each test) */
	static void ResetMocks(void) {
	VbPublicKey *root_key;
	uint8_t *root_key_data;
	int i;

	Memset(&cparams, 0, sizeof(cparams));
	cparams.shared_data_blob = shared_data;
	cparams.gbb_data = gbb_data;
	cparams.gbb_size = sizeof(gbb_data);
	cparams.gbb = gbb;

	Memset(&fparams, 0, sizeof(fparams));
	fparams.verification_block_A = vblock;
	fparams.verification_size_A = sizeof(VbKeyBlockHeader);
	fparams.verification_block_B = vblock + 1;
	fparams.verification_size_B = sizeof(VbKeyBlockHeader);

	Memset(vblock, 0, sizeof(vblock));
	Memset(mpreamble, 0, sizeof(mpreamble));
	for (i = 0; i < 2; i++) {
	/* Default verification blocks to working in all modes */
	vblock[i].key_block_flags = 0x0F;
	vblock[i].data_key.key_version = 2;
	/* Fix up offsets to preambles */
	vblock[i].key_block_size =
	(uint8_t)(mpreamble + i) - (uint8_t)(vblock + i);

	mpreamble[i].header_version_minor = 1; /* Supports preamble flags */
	mpreamble[i].firmware_version = 4;
	/* Point kernel subkey to some data following the key header */
	PublicKeyInit(&mpreamble[i].kernel_subkey,
	(uint8_t*)&mpreamble[i].body_signature, 20);
	mpreamble[i].kernel_subkey.algorithm = 7 + i;
	mpreamble[i].body_signature.data_size = 20000 + 1000 * i;
	}

	Memset(&vnc, 0, sizeof(vnc));
	VbNvSetup(&vnc);

	Memset(&shared_data, 0, sizeof(shared_data));
	VbSharedDataInit(shared, sizeof(shared_data));
	shared->fw_version_tpm = 0x00020004;

	Memset(&gbb_data, 0, sizeof(gbb_data));
	gbb->rootkey_offset = sizeof(GoogleBinaryBlockHeader);
	root_key = (VbPublicKey *)(gbb_data + gbb->rootkey_offset);
	root_key_data = (uint8_t *)(root_key + 1);
	strcpy((char *)root_key_data, TEST_KEY_DATA);
	PublicKeyInit(root_key, (uint8_t *)root_key_data, sizeof(TEST_KEY_DATA));

	gbb->major_version = GBB_MAJOR_VER;
	gbb->minor_version = GBB_MINOR_VER;
	gbb->flags = 0;

	Memset(&data_key, 0, sizeof(data_key));

	digest_size = 1234;
	digest_returned = NULL;
	digest_expect_ptr = NULL;
	hash_fw_index = -1;
	}

	/****************************************************************************/
	/* Mocked verification functions */

	int KeyBlockVerify(const VbKeyBlockHeader* block, uint64_t size,
	const VbPublicKey *key, int hash_only) {

	TEST_EQ(hash_only, 0, " Don't verify firmware with hash");

	/*
	* We cannot check the address of key, since it will be allocated. We
	* check the contents instead.
	*/
	TEST_STR_EQ((char *)GetPublicKeyDataC(key), TEST_KEY_DATA,
	" Verify with root key");
	TEST_NEQ(block==vblock \|\| block==vblock+1, 0, " Verify a valid key block");

	/* Mock uses header_version_major to hold return value */
	return block->header_version_major;
	}

	int VerifyFirmwarePreamble(const VbFirmwarePreambleHeader* preamble,
	uint64_t size, const RSAPublicKey* key) {
	TEST_PTR_EQ(key, &data_key, " Verify preamble data key");
	TEST_NEQ(preamble==mpreamble \|\| preamble==mpreamble+1, 0,
	" Verify a valid preamble");

	/* Mock uses header_version_major to hold return value */
	return preamble->header_version_major;
	}

	RSAPublicKey* PublicKeyToRSA(const VbPublicKey* key) {
	/* Mock uses algorithm!0 to mean invalid key */
	if (key->algorithm)
	return NULL;
	/* Mock uses data key len to hold number of alloc'd keys */
	data_key.len++;
	return &data_key;
	}

	void RSAPublicKeyFree(RSAPublicKey* key) {
	TEST_PTR_EQ(key, &data_key, " RSA data key");
	data_key.len--;
	}

	void DigestInit(DigestContext* ctx, int sig_algorithm) {
	digest_size = 0;
	}

	void DigestUpdate(DigestContext* ctx, const uint8_t* data, uint32_t len) {
	TEST_PTR_EQ(data, digest_expect_ptr, " Digesting expected data");
	digest_size += len;
	}

	uint8_t* DigestFinal(DigestContext* ctx) {
	digest_returned = (uint8_t*)VbExMalloc(4);
	return digest_returned;
	}

	VbError_t VbExHashFirmwareBody(VbCommonParams* cparams,
	uint32_t firmware_index) {
	if (VB_SELECT_FIRMWARE_A == firmware_index)
	hash_fw_index = 0;
	else if (VB_SELECT_FIRMWARE_B == firmware_index)
	hash_fw_index = 1;
	else
	return VBERROR_INVALID_PARAMETER;

	digest_expect_ptr = (uint8_t*)(vblock + hash_fw_index) + 5;
	VbUpdateFirmwareBodyHash(
	cparams, digest_expect_ptr,
	mpreamble[hash_fw_index].body_signature.data_size - 1024);
	VbUpdateFirmwareBodyHash(cparams, digest_expect_ptr, 1024);

	/* If signature offset is 42, hash the wrong amount and return success */
	if (42 == mpreamble[hash_fw_index].body_signature.sig_offset) {
	VbUpdateFirmwareBodyHash(cparams, digest_expect_ptr, 4);
	return VBERROR_SUCCESS;
	}

	/* Otherwise, mocked function uses body signature offset as returned value */
	return mpreamble[hash_fw_index].body_signature.sig_offset;
	}

	int VerifyDigest(const uint8_t* digest, const VbSignature *sig,
	const RSAPublicKey* key) {
	TEST_PTR_EQ(digest, digest_returned, "Verifying expected digest");
	TEST_PTR_EQ(key, &data_key, "Verifying using data key");
	TEST_PTR_EQ(sig, &mpreamble[hash_fw_index].body_signature, "Verifying sig");
	/* Mocked function uses sig size as return value for verifying digest */
	return sig->sig_size;
	}

	/****************************************************************************/
	/* Test LoadFirmware() and check expected return value and recovery reason */
	static void TestLoadFirmware(VbError_t expected_retval,
	uint8_t expected_recovery, const char* desc) {
	uint32_t rr = 256;

	TEST_EQ(LoadFirmware(&cparams, &fparams, &vnc), expected_retval, desc);
	VbNvGet(&vnc, VBNV_RECOVERY_REQUEST, &rr);
	TEST_EQ(rr, expected_recovery, " recovery request");
	TEST_EQ(data_key.len, 0, " Data key free must be paired with alloc");
	}

	/****************************************************************************/

	static void LoadFirmwareTest(void) {
	uint32_t u;

	/* Require GBB */
	ResetMocks();
	cparams.gbb_data = NULL;
	TestLoadFirmware(VBERROR_INVALID_GBB, VBNV_RECOVERY_RO_UNSPECIFIED,
	"No GBB");

	/* Key block flags must match */
	/* Normal boot */
	ResetMocks();
	vblock[0].key_block_flags = KEY_BLOCK_FLAG_DEVELOPER_1;
	vblock[1].key_block_flags =
	KEY_BLOCK_FLAG_DEVELOPER_0 \| KEY_BLOCK_FLAG_RECOVERY_1;
	TestLoadFirmware(VBERROR_LOAD_FIRMWARE,
	(VBNV_RECOVERY_RO_INVALID_RW_CHECK_MIN +
	VBSD_LF_CHECK_REC_MISMATCH),
	"Flags mismatch dev=0");
	TEST_EQ(shared->flags & VBSD_LF_DEV_SWITCH_ON, 0,
	"Dev flag in shared.flags dev=0");
	TEST_EQ(shared->check_fw_a_result, VBSD_LF_CHECK_DEV_MISMATCH,
	"Key block flag mismatch for dev=0");
	TEST_EQ(shared->check_fw_b_result, VBSD_LF_CHECK_REC_MISMATCH,
	"Key block flag mismatch for rec=0");
	/* Developer boot */
	ResetMocks();
	shared->flags \|= VBSD_BOOT_DEV_SWITCH_ON;
	vblock[0].key_block_flags = KEY_BLOCK_FLAG_DEVELOPER_0;
	vblock[1].key_block_flags =
	KEY_BLOCK_FLAG_DEVELOPER_1 \| KEY_BLOCK_FLAG_RECOVERY_1;
	TestLoadFirmware(VBERROR_LOAD_FIRMWARE,
	(VBNV_RECOVERY_RO_INVALID_RW_CHECK_MIN +
	VBSD_LF_CHECK_REC_MISMATCH),
	"Flags mismatch dev=1");
	TEST_NEQ(shared->flags & VBSD_LF_DEV_SWITCH_ON, 0,
	"Dev flag in shared.flags dev=1");
	TEST_EQ(shared->check_fw_a_result, VBSD_LF_CHECK_DEV_MISMATCH,
	"Key block flag mismatch for dev=1");
	TEST_EQ(shared->check_fw_b_result, VBSD_LF_CHECK_REC_MISMATCH,
	"Key block flag mismatch for rec=1");

	/* Test key block verification with A and key version rollback with B */
	ResetMocks();
	vblock[0].header_version_major = 1; /* Simulate failure */
	vblock[1].data_key.key_version = 1; /* Simulate rollback */
	TestLoadFirmware(VBERROR_LOAD_FIRMWARE,
	(VBNV_RECOVERY_RO_INVALID_RW_CHECK_MIN +
	VBSD_LF_CHECK_KEY_ROLLBACK),
	"Key block invalid / key version rollback");
	TEST_EQ(shared->check_fw_a_result, VBSD_LF_CHECK_VERIFY_KEYBLOCK,
	"Key block invalid");
	TEST_EQ(shared->check_fw_b_result, VBSD_LF_CHECK_KEY_ROLLBACK,
	"Key version rollback ");
	TEST_EQ(shared->fw_version_lowest, 0, "Lowest valid version");
	TEST_EQ(shared->fw_version_tpm, 0x20004, "TPM version");

	/* Test invalid key version with A and bad data key with B */
	ResetMocks();
	vblock[0].data_key.key_version = 0x10003; /* Version > 0xFFFF is invalid */
	vblock[1].data_key.algorithm = 1; /* Simulate invalid data key */
	TestLoadFirmware(VBERROR_LOAD_FIRMWARE,
	(VBNV_RECOVERY_RO_INVALID_RW_CHECK_MIN +
	VBSD_LF_CHECK_DATA_KEY_PARSE),
	"Key version overflow / invalid data key");
	TEST_EQ(shared->check_fw_a_result, VBSD_LF_CHECK_KEY_ROLLBACK,
	"Key version overflow");
	TEST_EQ(shared->check_fw_b_result, VBSD_LF_CHECK_DATA_KEY_PARSE,
	"Data key invalid");

	/* Test invalid key version with GBB bypass-rollback flag */
	ResetMocks();
	vblock[0].data_key.key_version = 1; /* Simulate rollback */
	gbb->flags = GBB_FLAG_DISABLE_FW_ROLLBACK_CHECK;
	TestLoadFirmware(VBERROR_SUCCESS, 0, "Key version check + GBB override");
	TEST_EQ(shared->check_fw_a_result, VBSD_LF_CHECK_VALID,
	"Key version rollback + GBB override");

	/* Test invalid preamble with A */
	ResetMocks();
	mpreamble[0].header_version_major = 1; /* Simulate failure */
	vblock[1].key_block_flags = 0; /* Invalid */
	TestLoadFirmware(VBERROR_LOAD_FIRMWARE,
	(VBNV_RECOVERY_RO_INVALID_RW_CHECK_MIN +
	VBSD_LF_CHECK_VERIFY_PREAMBLE),
	"Preamble invalid");
	TEST_EQ(shared->check_fw_a_result, VBSD_LF_CHECK_VERIFY_PREAMBLE,
	"Preamble invalid A");

	/* Test invalid firmware versions */
	ResetMocks();
	mpreamble[0].firmware_version = 3; /* Simulate rollback */
	mpreamble[1].firmware_version = 0x10001; /* Check overflow */
	TestLoadFirmware(VBERROR_LOAD_FIRMWARE,
	(VBNV_RECOVERY_RO_INVALID_RW_CHECK_MIN +
	VBSD_LF_CHECK_FW_ROLLBACK),
	"Firmware version check");
	TEST_EQ(shared->check_fw_a_result, VBSD_LF_CHECK_FW_ROLLBACK,
	"Firmware version rollback");
	TEST_EQ(shared->check_fw_b_result, VBSD_LF_CHECK_FW_ROLLBACK,
	"Firmware version overflow");

	/* Test invalid firmware versions with GBB bypass-rollback flag */
	ResetMocks();
	mpreamble[0].firmware_version = 3; /* Simulate rollback */
	mpreamble[1].firmware_version = 0x10001; /* Check overflow */
	gbb->flags = GBB_FLAG_DISABLE_FW_ROLLBACK_CHECK;
	TestLoadFirmware(VBERROR_SUCCESS, 0, "Firmware version check + GBB bypass");
	TEST_EQ(shared->check_fw_a_result, VBSD_LF_CHECK_VALID,
	"Firmware version rollback + GBB override");
	TEST_EQ(shared->check_fw_b_result, VBSD_LF_CHECK_HEADER_VALID,
	"Firmware version overflow + GBB override");

	/* Test RO normal with A */
	ResetMocks();
	mpreamble[0].flags = VB_FIRMWARE_PREAMBLE_USE_RO_NORMAL;
	vblock[1].key_block_flags = 0; /* Invalid */
	TestLoadFirmware(VBERROR_LOAD_FIRMWARE,
	(VBNV_RECOVERY_RO_INVALID_RW_CHECK_MIN +
	VBSD_LF_CHECK_NO_RO_NORMAL),
	"Preamble asked for RO normal but fw doesn't support it");
	TEST_EQ(shared->check_fw_a_result, VBSD_LF_CHECK_NO_RO_NORMAL,
	"No RO normal A");

	/* If RO normal is supported, don't need to verify the firmware body */
	ResetMocks();
	mpreamble[0].flags = VB_FIRMWARE_PREAMBLE_USE_RO_NORMAL;
	/* Mock bad sig, to ensure we didn't use it */
	mpreamble[0].body_signature.sig_size = 1;
	shared->flags \|= VBSD_BOOT_RO_NORMAL_SUPPORT;
	vblock[1].key_block_flags = 0; /* Invalid */
	TestLoadFirmware(VBERROR_SUCCESS, 0, "RO normal A");
	TEST_EQ(shared->check_fw_a_result, VBSD_LF_CHECK_VALID, "RO normal A valid");
	TEST_EQ(shared->firmware_index, 0, "Boot A shared index");
	TEST_EQ(shared->fw_keyblock_flags, vblock[0].key_block_flags,
	"Copy key block flags");
	TEST_EQ(shared->kernel_subkey.algorithm, 7, "Copy kernel subkey");

	/* If both A and B are valid and same version as TPM, A is selected
	* and B isn't attempted. */
	ResetMocks();
	mpreamble[0].flags = VB_FIRMWARE_PREAMBLE_USE_RO_NORMAL;
	mpreamble[1].flags = VB_FIRMWARE_PREAMBLE_USE_RO_NORMAL;
	shared->flags \|= VBSD_BOOT_RO_NORMAL_SUPPORT;
	TestLoadFirmware(VBERROR_SUCCESS, 0, "Check A then B");
	TEST_EQ(shared->check_fw_a_result, VBSD_LF_CHECK_VALID, "RO normal A valid");
	TEST_EQ(shared->check_fw_b_result, 0, "RO normal B not checked ");
	TEST_EQ(shared->firmware_index, 0, "Boot A");
	TEST_EQ(shared->flags & VBSD_FWB_TRIED, 0, "Didn't try firmware B");
	TEST_EQ(shared->kernel_subkey.algorithm, 7, "Copy kernel subkey");
	/* But if try B flag is set, B is selected and A not attempted */
	ResetMocks();
	mpreamble[0].flags = VB_FIRMWARE_PREAMBLE_USE_RO_NORMAL;
	mpreamble[1].flags = VB_FIRMWARE_PREAMBLE_USE_RO_NORMAL;
	shared->flags \|= VBSD_BOOT_RO_NORMAL_SUPPORT;
	VbNvSet(&vnc, VBNV_TRY_B_COUNT, 5);
	TestLoadFirmware(VBERROR_SUCCESS, 0, "Check B then A");
	TEST_EQ(shared->check_fw_a_result, 0, "RO normal A not checked ");
	TEST_EQ(shared->check_fw_b_result, VBSD_LF_CHECK_VALID, "RO normal B valid");
	TEST_EQ(shared->firmware_index, 1, "Boot B");
	TEST_NEQ(shared->flags & VBSD_FWB_TRIED, 0, "Tried firmware B");
	TEST_EQ(shared->kernel_subkey.algorithm, 8, "Copy kernel subkey");
	VbNvGet(&vnc, VBNV_TRY_B_COUNT, &u);
	TEST_EQ(u, 4, "Used up a try");

	/* If both A and B are valid and grater version than TPM, A is
	* selected and B preamble (but not body) is verified. */
	ResetMocks();
	mpreamble[0].flags = VB_FIRMWARE_PREAMBLE_USE_RO_NORMAL;
	mpreamble[1].flags = 0;
	mpreamble[0].firmware_version = 5;
	mpreamble[1].firmware_version = 6;
	shared->flags \|= VBSD_BOOT_RO_NORMAL_SUPPORT;
	TestLoadFirmware(VBERROR_SUCCESS, 0, "Check A then B advancing version");
	TEST_EQ(shared->check_fw_a_result, VBSD_LF_CHECK_VALID, "RO normal A valid");
	TEST_EQ(shared->check_fw_b_result, VBSD_LF_CHECK_HEADER_VALID,
	"RO normal B header valid");
	TEST_EQ(shared->firmware_index, 0, "Boot A");
	TEST_EQ(shared->fw_keyblock_flags, vblock[0].key_block_flags, "Key block A");
	TEST_EQ(shared->kernel_subkey.algorithm, 7, "Copy kernel subkey");
	TEST_EQ(shared->fw_version_lowest, 0x20005, "Lowest valid version");
	TEST_EQ(shared->fw_version_tpm, 0x20005, "TPM version advanced");

	/* Verify firmware data */
	ResetMocks();
	vblock[1].key_block_flags = 0; /* Invalid */
	TestLoadFirmware(VBERROR_SUCCESS, 0, "Verify firmware body");
	TEST_EQ(shared->check_fw_a_result, VBSD_LF_CHECK_VALID,
	"Firmware body A valid");
	TEST_EQ(shared->firmware_index, 0, "Boot A shared index");
	TEST_EQ(hash_fw_index, 0, "Hash firmware data A");
	TEST_EQ(digest_size, mpreamble[0].body_signature.data_size,
	"Verified all data expected");

	/* Test error getting firmware body */
	ResetMocks();
	mpreamble[0].body_signature.sig_offset = VBERROR_UNKNOWN;
	vblock[1].key_block_flags = 0; /* Invalid */
	TestLoadFirmware(VBERROR_LOAD_FIRMWARE,
	(VBNV_RECOVERY_RO_INVALID_RW_CHECK_MIN +
	VBSD_LF_CHECK_GET_FW_BODY),
	"Error getting firmware body");
	TEST_EQ(shared->check_fw_a_result, VBSD_LF_CHECK_GET_FW_BODY,
	"Firmware body A");

	/* Test digesting the wrong amount */
	ResetMocks();
	mpreamble[0].body_signature.sig_offset = 42; /* Mock hashing wrong amount */
	vblock[1].key_block_flags = 0; /* Invalid */
	TestLoadFirmware(VBERROR_LOAD_FIRMWARE,
	(VBNV_RECOVERY_RO_INVALID_RW_CHECK_MIN +
	VBSD_LF_CHECK_HASH_WRONG_SIZE),
	"Hash wrong size");
	TEST_EQ(shared->check_fw_a_result, VBSD_LF_CHECK_HASH_WRONG_SIZE,
	"Firmware hash wrong size A");

	/* Test bad signature */
	ResetMocks();
	mpreamble[0].body_signature.sig_size = 1; /* Mock bad sig */
	vblock[1].key_block_flags = 0; /* Invalid */
	TestLoadFirmware(VBERROR_LOAD_FIRMWARE,
	(VBNV_RECOVERY_RO_INVALID_RW_CHECK_MIN +
	VBSD_LF_CHECK_VERIFY_BODY),
	"Bad signature");
	TEST_EQ(shared->check_fw_a_result, VBSD_LF_CHECK_VERIFY_BODY,
	"Bad signature A");

	/* Test unable to store kernel data key */
	ResetMocks();
	mpreamble[0].kernel_subkey.key_size = VB_SHARED_DATA_MIN_SIZE + 1;
	vblock[1].key_block_flags = 0; /* Invalid */
	TestLoadFirmware(VBERROR_LOAD_FIRMWARE,
	(VBNV_RECOVERY_RO_INVALID_RW_CHECK_MIN +
	VBSD_LF_CHECK_VALID),
	"Kernel key too big");
	TEST_EQ(shared->check_fw_a_result, VBSD_LF_CHECK_VALID,
	"Kernel key too big");
	}


	int main(int argc, char* argv[]) {
	int error_code = 0;

	LoadFirmwareTest();

	if (vboot_api_stub_check_memory())
	error_code = 255;
	if (!gTestSuccess)
	error_code = 255;

	return error_code;
	}