OLD | NEW |
1 This directory contains a reference implementation for Chrome OS | 1 This directory contains a reference implementation for Chrome OS |
2 verified boot in firmware. | 2 verified boot in firmware. |
3 | 3 |
4 ---------- | 4 ---------- |
5 Directory Structure | 5 Directory Structure |
6 ---------- | 6 ---------- |
7 | 7 |
8 The source is organized into distinct modules - | 8 The source is organized into distinct modules - |
9 | 9 |
10 vboot_firmware/ - Contains ONLY the code required by the BIOS to validate | 10 firmware/ - Contains ONLY the code required by the BIOS to validate |
11 the secure boot components. There shouldn't be any code in here that signs | 11 the secure boot components. There shouldn't be any code in here that |
12 or generates images. BIOS should require ONLY this directory to implement | 12 signs or generates images. BIOS should require ONLY this directory to |
13 secure boot. Refer to vboot_firmware/README for futher details. | 13 implement secure boot. Refer to firmware/README for futher details. |
14 | 14 |
15 cgptlib/ - Work in progress for handling GPT headers. Parts of this will no | 15 cgpt/ - Utility to read/write/modify GPT partitions. Much like the |
16 doubt be migrated into vboot_firmware/ | 16 gpt tool, but with support for Chrome OS extensiosn. |
17 | 17 |
18 misclibs/ - Miscellaneous functions used by userland utilities. | 18 host/ - Miscellaneous functions used by userland utilities. |
19 | 19 |
20 utility/ - Utilities for generating and verifying signed | 20 utility/ - Utilities for generating and verifying signed |
21 firmware and kernel images, as well as arbitrary blobs. | 21 firmware and kernel images, as well as arbitrary blobs. |
22 | 22 |
23 vfirmware/ and vkernel/ - Functions for generating, verifying, and | |
24 manipulating signed firmware and kernel images. | |
25 | |
26 tests/ - User-land tests and benchmarks that test the reference | 23 tests/ - User-land tests and benchmarks that test the reference |
27 implementation. Please have a look at these if you'd like to | 24 implementation. Please have a look at these if you'd like to |
28 understand how to use the reference implementation. | 25 understand how to use the reference implementation. |
29 | 26 |
30 build/ - a directory where the generated files go to. | 27 build/ - a directory where the generated files go to. |
31 | 28 |
32 -------------------- | 29 -------------------- |
33 Building and testing | 30 Building and testing |
34 -------------------- | 31 -------------------- |
35 | 32 |
(...skipping 18 matching lines...) Expand all Loading... |
54 in the top level directory or | 51 in the top level directory or |
55 | 52 |
56 cd tests | 53 cd tests |
57 BUILD=../build make runtests | 54 BUILD=../build make runtests |
58 | 55 |
59 | 56 |
60 ---------- | 57 ---------- |
61 Some useful utilities: | 58 Some useful utilities: |
62 ---------- | 59 ---------- |
63 | 60 |
64 firmware_utility.c To generate verified boot firmware images. | 61 vbutil_key» » Convert a public key into .vbpubk format |
| 62 vbutil_keyblock»» Wrap a public key inside a signature and checksum |
| 63 vbutil_firmware»» Create a .vblock with signature info for a |
| 64 » » » firmware image |
| 65 vbutil_kernel» » Pack a kernel image, bootloader, and config into |
| 66 » » » a signed binary |
65 | 67 |
66 kernel_utility.c To generate verified boot kernel images. | 68 dumpRSAPublicKey » Dump RSA Public key (from a DER-encoded X509 |
67 | 69 » » » certificate) in a format suitable for |
68 dumpRSAPublicKey.c Dump RSA Public key (from a DER-encoded X509 | 70 » » » use by RSAVerify* functions in |
69 certificate) in a format suitable for | 71 » crypto/. |
70 » » use by RSAVerify* functions in | |
71 crypto/. | |
72 | 72 |
73 verify_data.c Verify a given signature on a given file. | 73 verify_data.c Verify a given signature on a given file. |
74 | 74 |
75 | 75 |
76 | 76 |
77 ---------- | 77 ---------- |
78 Generating a signed firmware image: | 78 Generating a signed firmware image: |
79 ---------- | 79 ---------- |
80 | 80 |
81 * Step 1: Generate RSA root and signing keys. | 81 * Step 1: Generate RSA root and signing keys. |
(...skipping 10 matching lines...) Expand all Loading... |
92 | 92 |
93 * Step 2: Generate pre-processed public versions of the above keys using | 93 * Step 2: Generate pre-processed public versions of the above keys using |
94 utility/dumpRSAPublicKey | 94 utility/dumpRSAPublicKey |
95 | 95 |
96 # dumpRSAPublicKey expects an x509 certificate as input. | 96 # dumpRSAPublicKey expects an x509 certificate as input. |
97 $ openssl req -batch -new -x509 -key root_key.pem -out root_key.crt | 97 $ openssl req -batch -new -x509 -key root_key.pem -out root_key.crt |
98 $ openssl req -batch -new -x509 -key signing_key.pem -out signing_key.crt | 98 $ openssl req -batch -new -x509 -key signing_key.pem -out signing_key.crt |
99 $ utility/dumpRSAPublicKey root_key.crt > root_key.keyb | 99 $ utility/dumpRSAPublicKey root_key.crt > root_key.keyb |
100 $ utility/dumpRSAPublicKey signing_key.crt > signing_key.keyb | 100 $ utility/dumpRSAPublicKey signing_key.crt > signing_key.keyb |
101 | 101 |
| 102 ************** TODO: STUFF PAST HERE IS OUT OF DATE *************** |
| 103 |
102 At this point we have all the requisite keys needed to generate a signed | 104 At this point we have all the requisite keys needed to generate a signed |
103 firmware image. | 105 firmware image. |
104 | 106 |
105 .pem RSA Public/Private Key Pair | 107 .pem RSA Public/Private Key Pair |
106 .crt X509 Key Certificate | 108 .crt X509 Key Certificate |
107 .keyb Pre-processed RSA Public Key | 109 .keyb Pre-processed RSA Public Key |
108 | 110 |
109 | 111 |
110 * Step 3: Use utility/firmware_utility to generate a signed firmare blob. | 112 * Step 3: Use utility/firmware_utility to generate a signed firmare blob. |
111 | 113 |
(...skipping 32 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
144 | 146 |
145 ---------- | 147 ---------- |
146 Generating a signed kernel image: | 148 Generating a signed kernel image: |
147 ---------- | 149 ---------- |
148 | 150 |
149 The steps for generating a signed kernel image are similar to that of | 151 The steps for generating a signed kernel image are similar to that of |
150 a firmware image. Since verification is chained - RO firmware verifies | 152 a firmware image. Since verification is chained - RO firmware verifies |
151 RW firmware which verifies the kernel, only the keys change. An additional | 153 RW firmware which verifies the kernel, only the keys change. An additional |
152 kernel signing key must be generated. The firmware signing generated above | 154 kernel signing key must be generated. The firmware signing generated above |
153 is the root key equivalent for signed kernel images. | 155 is the root key equivalent for signed kernel images. |
OLD | NEW |