vboot_test.sh 3.2 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126
  1. #!/bin/sh
  2. #
  3. # Copyright (c) 2013, Google Inc.
  4. #
  5. # Simple Verified Boot Test Script
  6. #
  7. # This program is free software; you can redistribute it and/or
  8. # modify it under the terms of the GNU General Public License as
  9. # published by the Free Software Foundation; either version 2 of
  10. # the License, or (at your option) any later version.
  11. #
  12. # This program is distributed in the hope that it will be useful,
  13. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  14. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  15. # GNU General Public License for more details.
  16. #
  17. # You should have received a copy of the GNU General Public License
  18. # along with this program; if not, write to the Free Software
  19. # Foundation, Inc., 59 Temple Place, Suite 330, Boston,
  20. # MA 02111-1307 USA
  21. set -e
  22. # Run U-Boot and report the result
  23. # Args:
  24. # $1: Test message
  25. run_uboot() {
  26. echo -n "Test Verified Boot Run: $1: "
  27. ${uboot} -d sandbox-u-boot.dtb >${tmp} -c '
  28. sb load host 0 100 test.fit;
  29. fdt addr 100;
  30. bootm 100;
  31. reset'
  32. if ! grep -q "$2" ${tmp}; then
  33. echo
  34. echo "Verified boot key check failed, output follows:"
  35. cat ${tmp}
  36. false
  37. else
  38. echo "OK"
  39. fi
  40. }
  41. echo "Simple Verified Boot Test"
  42. echo "========================="
  43. echo
  44. echo "Please see doc/uImage.FIT/verified-boot.txt for more information"
  45. echo
  46. err=0
  47. tmp=/tmp/vboot_test.$$
  48. dir=$(dirname $0)
  49. if [ -z ${O} ]; then
  50. O=.
  51. fi
  52. O=$(readlink -f ${O})
  53. dtc="-I dts -O dtb -p 2000"
  54. uboot="${O}/u-boot"
  55. mkimage="${O}/tools/mkimage"
  56. keys="${dir}/dev-keys"
  57. echo ${mkimage} -D "${dtc}"
  58. echo "Build keys"
  59. mkdir -p ${keys}
  60. # Create an RSA key pair
  61. openssl genrsa -F4 -out ${keys}/dev.key 2048 2>/dev/null
  62. # Create a certificate containing the public key
  63. openssl req -batch -new -x509 -key ${keys}/dev.key -out ${keys}/dev.crt
  64. pushd ${dir} >/dev/null
  65. # Compile our device tree files for kernel and U-Boot (CONFIG_OF_CONTROL)
  66. dtc -p 0x1000 sandbox-kernel.dts -O dtb -o sandbox-kernel.dtb
  67. dtc -p 0x1000 sandbox-u-boot.dts -O dtb -o sandbox-u-boot.dtb
  68. # Create a number kernel image with zeroes
  69. head -c 5000 /dev/zero >test-kernel.bin
  70. # Build the FIT, but don't sign anything yet
  71. echo Build FIT with signed images
  72. ${mkimage} -D "${dtc}" -f sign-images.its test.fit >${tmp}
  73. run_uboot "unsigned signatures:" "dev-"
  74. # Sign images with our dev keys
  75. echo Sign images
  76. ${mkimage} -D "${dtc}" -F -k dev-keys -K sandbox-u-boot.dtb -r test.fit >${tmp}
  77. run_uboot "signed images" "dev+"
  78. # Create a fresh .dtb without the public keys
  79. dtc -p 0x1000 sandbox-u-boot.dts -O dtb -o sandbox-u-boot.dtb
  80. echo Build FIT with signed configuration
  81. ${mkimage} -D "${dtc}" -f sign-configs.its test.fit >${tmp}
  82. run_uboot "unsigned config" "sha1+ OK"
  83. # Sign images with our dev keys
  84. echo Sign images
  85. ${mkimage} -D "${dtc}" -F -k dev-keys -K sandbox-u-boot.dtb -r test.fit >${tmp}
  86. run_uboot "signed config" "dev+"
  87. # Increment the first byte of the signature, which should cause failure
  88. sig=$(fdtget -t bx test.fit /configurations/conf@1/signature@1 value)
  89. newbyte=$(printf %x $((0x${sig:0:2} + 1)))
  90. sig="${newbyte} ${sig:2}"
  91. fdtput -t bx test.fit /configurations/conf@1/signature@1 value ${sig}
  92. run_uboot "signed config with bad hash" "Bad Data Hash"
  93. popd >/dev/null
  94. echo
  95. if ${ok}; then
  96. echo "Test passed"
  97. else
  98. echo "Test failed"
  99. fi