-# Copyright (c) 2016, Google Inc.
-#
# SPDX-License-Identifier: GPL-2.0+
+# Copyright (c) 2016, Google Inc.
#
# U-Boot Verified Boot Test
@pytest.mark.boardspec('sandbox')
@pytest.mark.buildconfigspec('fit_signature')
+@pytest.mark.requiredtool('dtc')
+@pytest.mark.requiredtool('fdtget')
+@pytest.mark.requiredtool('fdtput')
+@pytest.mark.requiredtool('openssl')
def test_vboot(u_boot_console):
"""Test verified boot signing with mkimage and verification with 'bootm'.
util.run_and_log(cons, 'dtc %s %s%s -O dtb '
'-o %s%s' % (dtc_args, datadir, dts, tmpdir, dtb))
- def run_bootm(sha_algo, test_type, expect_string):
+ def run_bootm(sha_algo, test_type, expect_string, boots):
"""Run a 'bootm' command U-Boot.
This always starts a fresh U-Boot instance since the device tree may
expect_string: A string which is expected in the output.
sha_algo: Either 'sha1' or 'sha256', to select the algorithm to
use.
+ boots: A boolean that is True if Linux should boot and False if
+ we are expected to not boot
"""
cons.restart_uboot()
with cons.log.section('Verified boot %s %s' % (sha_algo, test_type)):
'fdt addr 100',
'bootm 100'])
assert(expect_string in ''.join(output))
+ if boots:
+ assert('sandbox: continuing, as we cannot run' in ''.join(output))
def make_fit(its):
"""Make a new FIT from the .its source file.
# Build the FIT, but don't sign anything yet
cons.log.action('%s: Test FIT with signed images' % sha_algo)
make_fit('sign-images-%s.its' % sha_algo)
- run_bootm(sha_algo, 'unsigned images', 'dev-')
+ run_bootm(sha_algo, 'unsigned images', 'dev-', True)
# Sign images with our dev keys
sign_fit(sha_algo)
- run_bootm(sha_algo, 'signed images', 'dev+')
+ run_bootm(sha_algo, 'signed images', 'dev+', True)
# Create a fresh .dtb without the public keys
dtc('sandbox-u-boot.dts')
cons.log.action('%s: Test FIT with signed configuration' % sha_algo)
make_fit('sign-configs-%s.its' % sha_algo)
- run_bootm(sha_algo, 'unsigned config', '%s+ OK' % sha_algo)
+ run_bootm(sha_algo, 'unsigned config', '%s+ OK' % sha_algo, True)
# Sign images with our dev keys
sign_fit(sha_algo)
- run_bootm(sha_algo, 'signed config', 'dev+')
+ run_bootm(sha_algo, 'signed config', 'dev+', True)
cons.log.action('%s: Check signed config on the host' % sha_algo)
util.run_and_log(cons, 'fdtput -t bx %s %s value %s' %
(fit, sig_node, sig))
- run_bootm(sha_algo, 'Signed config with bad hash', 'Bad Data Hash')
+ run_bootm(sha_algo, 'Signed config with bad hash', 'Bad Data Hash', False)
cons.log.action('%s: Check bad config on the host' % sha_algo)
util.run_and_log_expect_exception(cons, [fit_check_sign, '-f', fit,
public_exponent = 65537
util.run_and_log(cons, 'openssl genpkey -algorithm RSA -out %sdev.key '
'-pkeyopt rsa_keygen_bits:2048 '
- '-pkeyopt rsa_keygen_pubexp:%d '
- '2>/dev/null' % (tmpdir, public_exponent))
+ '-pkeyopt rsa_keygen_pubexp:%d' %
+ (tmpdir, public_exponent))
# Create a certificate containing the public key
util.run_and_log(cons, 'openssl req -batch -new -x509 -key %sdev.key -out '