vboot_test.sh 3.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143
  1. #!/bin/sh
  2. #
  3. # Copyright (c) 2013, Google Inc.
  4. #
  5. # Simple Verified Boot Test Script
  6. #
  7. # SPDX-License-Identifier: GPL-2.0+
  8. set -e
  9. # Run U-Boot and report the result
  10. # Args:
  11. # $1: Test message
  12. run_uboot() {
  13. echo -n "Test Verified Boot Run: $1: "
  14. ${uboot} -d sandbox-u-boot.dtb >${tmp} -c '
  15. sb load host 0 100 test.fit;
  16. fdt addr 100;
  17. bootm 100;
  18. reset'
  19. if ! grep -q "$2" ${tmp}; then
  20. echo
  21. echo "Verified boot key check failed, output follows:"
  22. cat ${tmp}
  23. false
  24. else
  25. echo "OK"
  26. fi
  27. }
  28. echo "Simple Verified Boot Test"
  29. echo "========================="
  30. echo
  31. echo "Please see doc/uImage.FIT/verified-boot.txt for more information"
  32. echo
  33. err=0
  34. tmp=/tmp/vboot_test.$$
  35. dir=$(dirname $0)
  36. if [ -z ${O} ]; then
  37. O=.
  38. fi
  39. O=$(readlink -f ${O})
  40. dtc="-I dts -O dtb -p 2000"
  41. uboot="${O}/u-boot"
  42. mkimage="${O}/tools/mkimage"
  43. fit_check_sign="${O}/tools/fit_check_sign"
  44. keys="${dir}/dev-keys"
  45. echo ${mkimage} -D "${dtc}"
  46. echo "Build keys"
  47. mkdir -p ${keys}
  48. # Create an RSA key pair
  49. openssl genrsa -F4 -out ${keys}/dev.key 2048 2>/dev/null
  50. # Create a certificate containing the public key
  51. openssl req -batch -new -x509 -key ${keys}/dev.key -out ${keys}/dev.crt
  52. pushd ${dir} >/dev/null
  53. function do_test {
  54. echo do $sha test
  55. # Compile our device tree files for kernel and U-Boot
  56. dtc -p 0x1000 sandbox-kernel.dts -O dtb -o sandbox-kernel.dtb
  57. dtc -p 0x1000 sandbox-u-boot.dts -O dtb -o sandbox-u-boot.dtb
  58. # Create a number kernel image with zeroes
  59. head -c 5000 /dev/zero >test-kernel.bin
  60. # Build the FIT, but don't sign anything yet
  61. echo Build FIT with signed images
  62. ${mkimage} -D "${dtc}" -f sign-images-$sha.its test.fit >${tmp}
  63. run_uboot "unsigned signatures:" "dev-"
  64. # Sign images with our dev keys
  65. echo Sign images
  66. ${mkimage} -D "${dtc}" -F -k dev-keys -K sandbox-u-boot.dtb \
  67. -r test.fit >${tmp}
  68. run_uboot "signed images" "dev+"
  69. # Create a fresh .dtb without the public keys
  70. dtc -p 0x1000 sandbox-u-boot.dts -O dtb -o sandbox-u-boot.dtb
  71. echo Build FIT with signed configuration
  72. ${mkimage} -D "${dtc}" -f sign-configs-$sha.its test.fit >${tmp}
  73. run_uboot "unsigned config" $sha"+ OK"
  74. # Sign images with our dev keys
  75. echo Sign images
  76. ${mkimage} -D "${dtc}" -F -k dev-keys -K sandbox-u-boot.dtb \
  77. -r test.fit >${tmp}
  78. run_uboot "signed config" "dev+"
  79. echo check signed config on the host
  80. if ! ${fit_check_sign} -f test.fit -k sandbox-u-boot.dtb >${tmp}; then
  81. echo
  82. echo "Verified boot key check on host failed, output follows:"
  83. cat ${tmp}
  84. false
  85. else
  86. if ! grep -q "dev+" ${tmp}; then
  87. echo
  88. echo "Verified boot key check failed, output follows:"
  89. cat ${tmp}
  90. false
  91. else
  92. echo "OK"
  93. fi
  94. fi
  95. run_uboot "signed config" "dev+"
  96. # Increment the first byte of the signature, which should cause failure
  97. sig=$(fdtget -t bx test.fit /configurations/conf@1/signature@1 value)
  98. newbyte=$(printf %x $((0x${sig:0:2} + 1)))
  99. sig="${newbyte} ${sig:2}"
  100. fdtput -t bx test.fit /configurations/conf@1/signature@1 value ${sig}
  101. run_uboot "signed config with bad hash" "Bad Data Hash"
  102. }
  103. sha=sha1
  104. do_test
  105. sha=sha256
  106. do_test
  107. popd >/dev/null
  108. echo
  109. if ${ok}; then
  110. echo "Test passed"
  111. else
  112. echo "Test failed"
  113. fi