Merge "Expect SHA-256 digest for attested VBMeta digest on VSR-V+." into main am: a742007dfa am: 62c4684eb7
Original change: https://android-review.googlesource.com/c/platform/hardware/interfaces/+/3326633
Change-Id: Ied4bbd0ea30820ac20586706df7512dc59202824
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
diff --git a/security/keymint/aidl/vts/functional/BootloaderStateTest.cpp b/security/keymint/aidl/vts/functional/BootloaderStateTest.cpp
index c1f6aee..083a9aa 100644
--- a/security/keymint/aidl/vts/functional/BootloaderStateTest.cpp
+++ b/security/keymint/aidl/vts/functional/BootloaderStateTest.cpp
@@ -109,7 +109,7 @@
}
}
-// Check that attested vbmeta digest is correct.
+// Check that the attested VBMeta digest is correct.
TEST_P(BootloaderStateTest, VbmetaDigest) {
AvbSlotVerifyData* avbSlotData;
auto suffix = fs_mgr_get_slot_suffix();
@@ -125,21 +125,29 @@
AVB_HASHTREE_ERROR_MODE_EIO, &avbSlotData);
ASSERT_TRUE(avb_slot_data_loaded(result)) << "Failed to load avb slot data";
- // Unfortunately, bootloader is not required to report the algorithm used
- // to calculate the digest. There are only two supported options though,
- // SHA256 and SHA512. Attested VBMeta digest must match one of these.
- vector<uint8_t> digest256(AVB_SHA256_DIGEST_SIZE);
- vector<uint8_t> digest512(AVB_SHA512_DIGEST_SIZE);
-
+ vector<uint8_t> sha256Digest(AVB_SHA256_DIGEST_SIZE);
avb_slot_verify_data_calculate_vbmeta_digest(avbSlotData, AVB_DIGEST_TYPE_SHA256,
- digest256.data());
- avb_slot_verify_data_calculate_vbmeta_digest(avbSlotData, AVB_DIGEST_TYPE_SHA512,
- digest512.data());
+ sha256Digest.data());
- ASSERT_TRUE((attestedVbmetaDigest_ == digest256) || (attestedVbmetaDigest_ == digest512))
- << "Attested vbmeta digest (" << bin2hex(attestedVbmetaDigest_)
- << ") does not match computed digest (sha256: " << bin2hex(digest256)
- << ", sha512: " << bin2hex(digest512) << ").";
+ if (get_vsr_api_level() >= __ANDROID_API_V__) {
+ ASSERT_TRUE(attestedVbmetaDigest_ == sha256Digest)
+ << "Attested VBMeta digest (" << bin2hex(attestedVbmetaDigest_)
+ << ") does not match the expected SHA-256 digest (" << bin2hex(sha256Digest)
+ << ").";
+ } else {
+ // Prior to VSR-V, there was no MUST requirement for the algorithm used by the bootloader
+ // to calculate the VBMeta digest. However, the only two supported options are SHA-256 and
+ // SHA-512, so we expect the attested VBMeta digest to match one of these.
+ vector<uint8_t> sha512Digest(AVB_SHA512_DIGEST_SIZE);
+ avb_slot_verify_data_calculate_vbmeta_digest(avbSlotData, AVB_DIGEST_TYPE_SHA512,
+ sha512Digest.data());
+
+ ASSERT_TRUE((attestedVbmetaDigest_ == sha256Digest) ||
+ (attestedVbmetaDigest_ == sha512Digest))
+ << "Attested VBMeta digest (" << bin2hex(attestedVbmetaDigest_)
+ << ") does not match the expected digest (SHA-256: " << bin2hex(sha256Digest)
+ << " or SHA-512: " << bin2hex(sha512Digest) << ").";
+ }
}
INSTANTIATE_KEYMINT_AIDL_TEST(BootloaderStateTest);