diff options
Diffstat (limited to 'qemu/roms/u-boot/test/vboot')
| -rw-r--r-- | qemu/roms/u-boot/test/vboot/.gitignore | 3 | ||||
| -rw-r--r-- | qemu/roms/u-boot/test/vboot/sandbox-kernel.dts | 7 | ||||
| -rw-r--r-- | qemu/roms/u-boot/test/vboot/sandbox-u-boot.dts | 7 | ||||
| -rw-r--r-- | qemu/roms/u-boot/test/vboot/sign-configs-sha1.its | 45 | ||||
| -rw-r--r-- | qemu/roms/u-boot/test/vboot/sign-configs-sha256.its | 45 | ||||
| -rw-r--r-- | qemu/roms/u-boot/test/vboot/sign-images-sha1.its | 42 | ||||
| -rw-r--r-- | qemu/roms/u-boot/test/vboot/sign-images-sha256.its | 42 | ||||
| -rwxr-xr-x | qemu/roms/u-boot/test/vboot/vboot_test.sh | 143 |
8 files changed, 334 insertions, 0 deletions
diff --git a/qemu/roms/u-boot/test/vboot/.gitignore b/qemu/roms/u-boot/test/vboot/.gitignore new file mode 100644 index 000000000..463124270 --- /dev/null +++ b/qemu/roms/u-boot/test/vboot/.gitignore @@ -0,0 +1,3 @@ +/*.dtb +/test.fit +/dev-keys diff --git a/qemu/roms/u-boot/test/vboot/sandbox-kernel.dts b/qemu/roms/u-boot/test/vboot/sandbox-kernel.dts new file mode 100644 index 000000000..a1e853c9c --- /dev/null +++ b/qemu/roms/u-boot/test/vboot/sandbox-kernel.dts @@ -0,0 +1,7 @@ +/dts-v1/; + +/ { + model = "Sandbox Verified Boot Test"; + compatible = "sandbox"; + +}; diff --git a/qemu/roms/u-boot/test/vboot/sandbox-u-boot.dts b/qemu/roms/u-boot/test/vboot/sandbox-u-boot.dts new file mode 100644 index 000000000..a1e853c9c --- /dev/null +++ b/qemu/roms/u-boot/test/vboot/sandbox-u-boot.dts @@ -0,0 +1,7 @@ +/dts-v1/; + +/ { + model = "Sandbox Verified Boot Test"; + compatible = "sandbox"; + +}; diff --git a/qemu/roms/u-boot/test/vboot/sign-configs-sha1.its b/qemu/roms/u-boot/test/vboot/sign-configs-sha1.its new file mode 100644 index 000000000..db2ed7935 --- /dev/null +++ b/qemu/roms/u-boot/test/vboot/sign-configs-sha1.its @@ -0,0 +1,45 @@ +/dts-v1/; + +/ { + description = "Chrome OS kernel image with one or more FDT blobs"; + #address-cells = <1>; + + images { + kernel@1 { + data = /incbin/("test-kernel.bin"); + type = "kernel_noload"; + arch = "sandbox"; + os = "linux"; + compression = "none"; + load = <0x4>; + entry = <0x8>; + kernel-version = <1>; + hash@1 { + algo = "sha1"; + }; + }; + fdt@1 { + description = "snow"; + data = /incbin/("sandbox-kernel.dtb"); + type = "flat_dt"; + arch = "sandbox"; + compression = "none"; + fdt-version = <1>; + hash@1 { + algo = "sha1"; + }; + }; + }; + configurations { + default = "conf@1"; + conf@1 { + kernel = "kernel@1"; + fdt = "fdt@1"; + signature@1 { + algo = "sha1,rsa2048"; + key-name-hint = "dev"; + sign-images = "fdt", "kernel"; + }; + }; + }; +}; diff --git a/qemu/roms/u-boot/test/vboot/sign-configs-sha256.its b/qemu/roms/u-boot/test/vboot/sign-configs-sha256.its new file mode 100644 index 000000000..1b3432ec1 --- /dev/null +++ b/qemu/roms/u-boot/test/vboot/sign-configs-sha256.its @@ -0,0 +1,45 @@ +/dts-v1/; + +/ { + description = "Chrome OS kernel image with one or more FDT blobs"; + #address-cells = <1>; + + images { + kernel@1 { + data = /incbin/("test-kernel.bin"); + type = "kernel_noload"; + arch = "sandbox"; + os = "linux"; + compression = "none"; + load = <0x4>; + entry = <0x8>; + kernel-version = <1>; + hash@1 { + algo = "sha256"; + }; + }; + fdt@1 { + description = "snow"; + data = /incbin/("sandbox-kernel.dtb"); + type = "flat_dt"; + arch = "sandbox"; + compression = "none"; + fdt-version = <1>; + hash@1 { + algo = "sha256"; + }; + }; + }; + configurations { + default = "conf@1"; + conf@1 { + kernel = "kernel@1"; + fdt = "fdt@1"; + signature@1 { + algo = "sha256,rsa2048"; + key-name-hint = "dev"; + sign-images = "fdt", "kernel"; + }; + }; + }; +}; diff --git a/qemu/roms/u-boot/test/vboot/sign-images-sha1.its b/qemu/roms/u-boot/test/vboot/sign-images-sha1.its new file mode 100644 index 000000000..f69326a39 --- /dev/null +++ b/qemu/roms/u-boot/test/vboot/sign-images-sha1.its @@ -0,0 +1,42 @@ +/dts-v1/; + +/ { + description = "Chrome OS kernel image with one or more FDT blobs"; + #address-cells = <1>; + + images { + kernel@1 { + data = /incbin/("test-kernel.bin"); + type = "kernel_noload"; + arch = "sandbox"; + os = "linux"; + compression = "none"; + load = <0x4>; + entry = <0x8>; + kernel-version = <1>; + signature@1 { + algo = "sha1,rsa2048"; + key-name-hint = "dev"; + }; + }; + fdt@1 { + description = "snow"; + data = /incbin/("sandbox-kernel.dtb"); + type = "flat_dt"; + arch = "sandbox"; + compression = "none"; + fdt-version = <1>; + signature@1 { + algo = "sha1,rsa2048"; + key-name-hint = "dev"; + }; + }; + }; + configurations { + default = "conf@1"; + conf@1 { + kernel = "kernel@1"; + fdt = "fdt@1"; + }; + }; +}; diff --git a/qemu/roms/u-boot/test/vboot/sign-images-sha256.its b/qemu/roms/u-boot/test/vboot/sign-images-sha256.its new file mode 100644 index 000000000..e6aa9fc40 --- /dev/null +++ b/qemu/roms/u-boot/test/vboot/sign-images-sha256.its @@ -0,0 +1,42 @@ +/dts-v1/; + +/ { + description = "Chrome OS kernel image with one or more FDT blobs"; + #address-cells = <1>; + + images { + kernel@1 { + data = /incbin/("test-kernel.bin"); + type = "kernel_noload"; + arch = "sandbox"; + os = "linux"; + compression = "none"; + load = <0x4>; + entry = <0x8>; + kernel-version = <1>; + signature@1 { + algo = "sha256,rsa2048"; + key-name-hint = "dev"; + }; + }; + fdt@1 { + description = "snow"; + data = /incbin/("sandbox-kernel.dtb"); + type = "flat_dt"; + arch = "sandbox"; + compression = "none"; + fdt-version = <1>; + signature@1 { + algo = "sha256,rsa2048"; + key-name-hint = "dev"; + }; + }; + }; + configurations { + default = "conf@1"; + conf@1 { + kernel = "kernel@1"; + fdt = "fdt@1"; + }; + }; +}; diff --git a/qemu/roms/u-boot/test/vboot/vboot_test.sh b/qemu/roms/u-boot/test/vboot/vboot_test.sh new file mode 100755 index 000000000..3c6efa774 --- /dev/null +++ b/qemu/roms/u-boot/test/vboot/vboot_test.sh @@ -0,0 +1,143 @@ +#!/bin/sh +# +# Copyright (c) 2013, Google Inc. +# +# Simple Verified Boot Test Script +# +# SPDX-License-Identifier: GPL-2.0+ + +set -e + +# Run U-Boot and report the result +# Args: +# $1: Test message +run_uboot() { + echo -n "Test Verified Boot Run: $1: " + ${uboot} -d sandbox-u-boot.dtb >${tmp} -c ' +sb load host 0 100 test.fit; +fdt addr 100; +bootm 100; +reset' + if ! grep -q "$2" ${tmp}; then + echo + echo "Verified boot key check failed, output follows:" + cat ${tmp} + false + else + echo "OK" + fi +} + +echo "Simple Verified Boot Test" +echo "=========================" +echo +echo "Please see doc/uImage.FIT/verified-boot.txt for more information" +echo + +err=0 +tmp=/tmp/vboot_test.$$ + +dir=$(dirname $0) + +if [ -z ${O} ]; then + O=. +fi +O=$(readlink -f ${O}) + +dtc="-I dts -O dtb -p 2000" +uboot="${O}/u-boot" +mkimage="${O}/tools/mkimage" +fit_check_sign="${O}/tools/fit_check_sign" +keys="${dir}/dev-keys" +echo ${mkimage} -D "${dtc}" + +echo "Build keys" +mkdir -p ${keys} + +# Create an RSA key pair +openssl genrsa -F4 -out ${keys}/dev.key 2048 2>/dev/null + +# Create a certificate containing the public key +openssl req -batch -new -x509 -key ${keys}/dev.key -out ${keys}/dev.crt + +pushd ${dir} >/dev/null + +function do_test { + echo do $sha test + # Compile our device tree files for kernel and U-Boot + dtc -p 0x1000 sandbox-kernel.dts -O dtb -o sandbox-kernel.dtb + dtc -p 0x1000 sandbox-u-boot.dts -O dtb -o sandbox-u-boot.dtb + + # Create a number kernel image with zeroes + head -c 5000 /dev/zero >test-kernel.bin + + # Build the FIT, but don't sign anything yet + echo Build FIT with signed images + ${mkimage} -D "${dtc}" -f sign-images-$sha.its test.fit >${tmp} + + run_uboot "unsigned signatures:" "dev-" + + # Sign images with our dev keys + echo Sign images + ${mkimage} -D "${dtc}" -F -k dev-keys -K sandbox-u-boot.dtb \ + -r test.fit >${tmp} + + run_uboot "signed images" "dev+" + + + # Create a fresh .dtb without the public keys + dtc -p 0x1000 sandbox-u-boot.dts -O dtb -o sandbox-u-boot.dtb + + echo Build FIT with signed configuration + ${mkimage} -D "${dtc}" -f sign-configs-$sha.its test.fit >${tmp} + + run_uboot "unsigned config" $sha"+ OK" + + # Sign images with our dev keys + echo Sign images + ${mkimage} -D "${dtc}" -F -k dev-keys -K sandbox-u-boot.dtb \ + -r test.fit >${tmp} + + run_uboot "signed config" "dev+" + + echo check signed config on the host + if ! ${fit_check_sign} -f test.fit -k sandbox-u-boot.dtb >${tmp}; then + echo + echo "Verified boot key check on host failed, output follows:" + cat ${tmp} + false + else + if ! grep -q "dev+" ${tmp}; then + echo + echo "Verified boot key check failed, output follows:" + cat ${tmp} + false + else + echo "OK" + fi + fi + + run_uboot "signed config" "dev+" + + # Increment the first byte of the signature, which should cause failure + sig=$(fdtget -t bx test.fit /configurations/conf@1/signature@1 value) + newbyte=$(printf %x $((0x${sig:0:2} + 1))) + sig="${newbyte} ${sig:2}" + fdtput -t bx test.fit /configurations/conf@1/signature@1 value ${sig} + + run_uboot "signed config with bad hash" "Bad Data Hash" +} + +sha=sha1 +do_test +sha=sha256 +do_test + +popd >/dev/null + +echo +if ${ok}; then + echo "Test passed" +else + echo "Test failed" +fi |