[U-Boot] [RFC PATCH 0/44] RFC: Verified boot implementation based on FIT

Simon Glass sjg at chromium.org
Fri Mar 8 05:25:01 CET 2013


Hi,

On Fri, Jan 4, 2013 at 5:51 PM, Simon Glass <sjg at chromium.org> wrote:
> This series implemented a verified boot system based around FIT images
> as discussed on the U-Boot mailing list, including on this thread:
>
> http://permalink.gmane.org/gmane.comp.boot-loaders.u-boot/147830
>
> RSA is used to implement the encryption. Images are signed by mkimage
> using private keys created by the user. Public keys are written into
> U-Boot control FDT (CONFIG_OF_CONTROL) for access by bootm etc. at
> run-time. The control FDT must be stored in a secure place where it
> cannot be changed after manufacture. Some notes are provided in the
> documentaion on how this can be achieved.
>
> When images are loaded, they are verified with the public keys.
>
> Some minor restructuring of the image code is included in this series,
> since we now support signatures as well as hashes.
>
> It is important to have a test framework for this series. For this, sandbox
> is used, and a script is provided which signs images and gets sandbox to
> load them using a script, to check that all is well. So some of the patches
> here release to adding image support for sandbox.
>
> This series is not quite in final form since it still needs rollback
> support, using a TPM or some other mechanism to make sure that an attacker
> cannot boot your system with an old image that has been compromised.
>
> Also a few more tests are needed to check that image corruption has the
> desired effect, some proofreading is required, another review of error
> checking, etc.
>
> This series relies on two previous series: sandbox filesystem and sandbox
> memory. Without these, it is (at best) not possible to run the verified
> boot test on sandbox.
>
> This series and its dependencies are available at:
>
>    http://git.denx.de/u-boot-x86.git
>
> in the branch 'vboot'.
>
> Comments welcome.

I know are few people are trying this out. Are there any comments at this stage?

Che-Liang Chiou has posted a patch for the TPM command that are
referenced above. These include rollback support.

http://patchwork.ozlabs.org/patch/224163/

I intend to respin this soon to tidy up a few issues.

>
>
> Simon Glass (44):
>   sandbox: config: Enable CONFIG_FIT and CONFIG_CMD_FIT
>   bootstage: Don't build for HOSTCC
>   mkimage: Move ARRAY_SIZE to header file
>   libfdt: Add fdt_next_subnode() to permit easy subnode iteration
>   image: Move timestamp #ifdefs to header file
>   image: Export fit_check_ramdisk()
>   image: Split FIT code into new image-fit.c
>   image: Move HOSTCC image code to tools/
>   image: Split hash node processing into its own function
>   image: Convert fit_image_hash_set_value() to static, and rename
>   image: Rename fit_image_check_hashes() to fit_image_verify()
>   image: Move hash checking into its own functions
>   image: Move error! string to common place
>   image: Export fit_conf_get_prop_node()
>   image: Rename fit_add_hashes() to fit_add_verification_data()
>   image: Rename hash printing to fit_image_print_verification_data()
>   sandbox: Add CONFIG_OF_HOSTFILE to read FDT from host file
>   fdt: Add a parameter to fdt_valid()
>   Add getenv_hex() to return an environment variable as hex
>   fdt: Allow fdt command to check and update control FDT
>   sandbox: fdt: Support fdt command for sandbox
>   env: Fix minor comment typos in cmd_nvedit
>   fdt: Skip checking FDT if the pointer is NULL
>   Revert "fdt- Tell the FDT library where the device tree is"
>   Add stdarg to vsprintf.h
>   Add minor updates to README.fdt-control
>   hash: Add a way to calculate a hash for any algortihm
>   sandbox: config: Enable FIT signatures with RSA
>   sandbox: Provide a way to map from host RAM to U-Boot RAM
>   sandbox: image: Add support for booting images in sandbox
>   image: Add signing infrastructure
>   image: Support signing of images
>   image: Verify signatures in FIT images
>   image: Add RSA support for image signing
>   mkimage: Put FIT loading in function and tidy error handling
>   mkimage: Add -k option to specify key directory
>   mkimage: Add -K to write public keys to an FDT blob
>   mkimage: Add -F option to modify an existing .fit file
>   mkimage: Add -c option to specify a comment for key signing
>   mkimage: Add -r option to specify keys that must be verified
>   libfdt: Add fdt_find_regions()
>   image: Add support for signing of FIT configurations
>   Add verified boot information and test
>   WIP: sandbox: config: Add test config for verified boot
>
>  Makefile                         |    1 +
>  README                           |   15 +
>  arch/sandbox/cpu/cpu.c           |    5 +
>  arch/sandbox/cpu/start.c         |    7 +
>  arch/sandbox/include/asm/io.h    |    2 +
>  arch/sandbox/include/asm/state.h |    1 +
>  arch/sandbox/lib/board.c         |   42 +-
>  common/Makefile                  |    2 +
>  common/cmd_bootm.c               |   37 +-
>  common/cmd_fdt.c                 |   83 ++-
>  common/cmd_fpga.c                |    2 +-
>  common/cmd_nvedit.c              |   19 +-
>  common/cmd_source.c              |    2 +-
>  common/cmd_ximg.c                |    2 +-
>  common/hash.c                    |   22 +
>  common/image-fit.c               | 1544 +++++++++++++++++++++++++++++++++++
>  common/image-sig.c               |  407 +++++++++
>  common/image.c                   | 1677 +-------------------------------------
>  common/main.c                    |    8 -
>  common/update.c                  |    2 +-
>  config.mk                        |    1 +
>  doc/README.fdt-control           |   13 +-
>  doc/mkimage.1                    |   73 ++-
>  doc/uImage.FIT/sign-configs.its  |   45 +
>  doc/uImage.FIT/sign-images.its   |   42 +
>  doc/uImage.FIT/signature.txt     |  376 +++++++++
>  doc/uImage.FIT/verified-boot.txt |  104 +++
>  include/bootstage.h              |    5 +-
>  include/common.h                 |   18 +
>  include/configs/sandbox.h        |   20 +-
>  include/hash.h                   |   15 +
>  include/image.h                  |  213 +++++-
>  include/libfdt.h                 |   81 ++
>  include/rsa.h                    |  108 +++
>  include/vsprintf.h               |    2 +
>  lib/fdtdec.c                     |    3 +-
>  lib/libfdt/fdt.c                 |   12 +
>  lib/libfdt/fdt_wip.c             |  129 +++
>  lib/rsa/Makefile                 |   46 +
>  lib/rsa/rsa-sign.c               |  454 +++++++++++
>  lib/rsa/rsa-verify.c             |  374 +++++++++
>  test/vboot/.gitignore            |    3 +
>  test/vboot/sandbox-kernel.dts    |    7 +
>  test/vboot/sandbox-u-boot.dts    |    7 +
>  test/vboot/sign-configs.its      |   45 +
>  test/vboot/sign-images.its       |   42 +
>  test/vboot/vboot_test.sh         |  122 +++
>  tools/Makefile                   |   21 +-
>  tools/aisimage.c                 |    1 -
>  tools/fit_image.c                |  134 ++-
>  tools/image-host.c               |  727 +++++++++++++++++
>  tools/mkimage.c                  |   27 +-
>  tools/mkimage.h                  |    6 +
>  53 files changed, 5386 insertions(+), 1770 deletions(-)
>  create mode 100644 common/image-fit.c
>  create mode 100644 common/image-sig.c
>  create mode 100644 doc/uImage.FIT/sign-configs.its
>  create mode 100644 doc/uImage.FIT/sign-images.its
>  create mode 100644 doc/uImage.FIT/signature.txt
>  create mode 100644 doc/uImage.FIT/verified-boot.txt
>  create mode 100644 include/rsa.h
>  create mode 100644 lib/rsa/Makefile
>  create mode 100644 lib/rsa/rsa-sign.c
>  create mode 100644 lib/rsa/rsa-verify.c
>  create mode 100644 test/vboot/.gitignore
>  create mode 100644 test/vboot/sandbox-kernel.dts
>  create mode 100644 test/vboot/sandbox-u-boot.dts
>  create mode 100644 test/vboot/sign-configs.its
>  create mode 100644 test/vboot/sign-images.its
>  create mode 100755 test/vboot/vboot_test.sh
>  create mode 100644 tools/image-host.c
>
> --
> 1.7.7.3
>

Regards,
Simon


More information about the U-Boot mailing list