mirrors/u-boot
1
0
Fork 0
mirror of https://source.denx.de/u-boot/u-boot.git synced 2026-05-06 05:06:13 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

tools: binman: Test signing an encrypted FIT with a preload header

Browse Source 
Add a test to verify the preload header correctly signs an encrypted
FIT. This test exercises the case where encryption uses random IVs that
would change between mkimage calls.

Signed-off-by: Paul HENRYS <paul.henrys_ext@softathome.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
This commit is contained in:
Paul HENRYS 2026-04-17 10:30:50 +02:00 committed by Tom Rini
parent 9ff82a771c
commit b20d69e5f5
2 changed files with 84 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
tools/binman/ftest.py
View File

@ -5895,6 +5895,27 @@ fdt fdtmap Extract the devicetree blob from the fdtmap
data = self._DoReadFileDtb('security/pre_load_invalid_key.dts',
entry_args=entry_args)
def testPreLoadEncryptedFit(self):
"""Test an encrypted FIT image with a pre-load header"""
entry_args = {
'pre-load-key-path': os.path.join(self._binman_dir, 'test'),
}
data = tools.read_file(self.TestFile("fit/aes256.bin"))
self._MakeInputFile("keys/aes256.bin", data)
keys_subdir = os.path.join(self._indir, "keys")
data = self._DoReadFileDtb(
'security/pre_load_fit_encrypted.dts', entry_args=entry_args,
extra_indirs=[keys_subdir])[0]
image_fname = tools.get_output_filename('image.bin')
is_signed = self._CheckPreload(image_fname, self.TestFile("dev.key"))
self.assertEqual(PRE_LOAD_MAGIC, data[:len(PRE_LOAD_MAGIC)])
self.assertEqual(PRE_LOAD_VERSION, data[4:4 + len(PRE_LOAD_VERSION)])
self.assertEqual(PRE_LOAD_HDR_SIZE, data[8:8 + len(PRE_LOAD_HDR_SIZE)])
self.assertEqual(is_signed, True)
def _CheckSafeUniqueNames(self, *images):
"""Check all entries of given images for unsafe unique names"""
for image in images:

63
tools/binman/test/security/pre_load_fit_encrypted.dts Normal file
View File

@ -0,0 +1,63 @@
// SPDX-License-Identifier: GPL-2.0+
/dts-v1/;
/ {
#address-cells = <1>;
#size-cells = <1>;
binman {
pre-load {
content = <&image>;
algo-name = "sha256,rsa2048";
key-name = "dev.key";
header-size = <4096>;
version = <0x11223344>;
};
image: fit {
fit,encrypt;
description = "Test a FIT with encrypted data and signed with a preload";
#address-cells = <1>;
images {
u-boot {
description = "U-Boot";
type = "firmware";
arch = "arm64";
os = "U-Boot";
compression = "none";
load = <00000000>;
entry = <00000000>;
cipher {
algo = "aes256";
key-name-hint = "aes256";
};
u-boot-nodtb {
};
};
fdt-1 {
description = "Flattened Device Tree blob";
type = "flat_dt";
arch = "arm64";
compression = "none";
cipher {
algo = "aes256";
key-name-hint = "aes256";
};
u-boot-dtb {
};
};
};
configurations {
default = "conf-1";
conf-1 {
description = "Boot U-Boot with FDT blob";
firmware = "u-boot";
fdt = "fdt-1";
};
};
};
};
};