xref: /openbmc/u-boot/test/py/tests/test_vboot.py (revision fc47cf9d) 
1# Copyright (c) 2016, Google Inc.
2#
3# SPDX-License-Identifier:	GPL-2.0+
4#
5# U-Boot Verified Boot Test
6
7"""
8This tests verified boot in the following ways:
9
10For image verification:
11- Create FIT (unsigned) with mkimage
12- Check that verification shows that no keys are verified
13- Sign image
14- Check that verification shows that a key is now verified
15
16For configuration verification:
17- Corrupt signature and check for failure
18- Create FIT (with unsigned configuration) with mkimage
19- Check that image verification works
20- Sign the FIT and mark the key as 'required' for verification
21- Check that image verification works
22- Corrupt the signature
23- Check that image verification no-longer works
24
25Tests run with both SHA1 and SHA256 hashing.
26"""
27
28import pytest
29import sys
30import u_boot_utils as util
31
32@pytest.mark.boardspec('sandbox')
33@pytest.mark.buildconfigspec('fit_signature')
34def test_vboot(u_boot_console):
35    """Test verified boot signing with mkimage and verification with 'bootm'.
36
37    This works using sandbox only as it needs to update the device tree used
38    by U-Boot to hold public keys from the signing process.
39
40    The SHA1 and SHA256 tests are combined into a single test since the
41    key-generation process is quite slow and we want to avoid doing it twice.
42    """
43    def dtc(dts):
44        """Run the device tree compiler to compile a .dts file
45
46        The output file will be the same as the input file but with a .dtb
47        extension.
48
49        Args:
50            dts: Device tree file to compile.
51        """
52        dtb = dts.replace('.dts', '.dtb')
53        util.run_and_log(cons, 'dtc %s %s%s -O dtb '
54                         '-o %s%s' % (dtc_args, datadir, dts, tmpdir, dtb))
55
56    def run_bootm(sha_algo, test_type, expect_string, boots):
57        """Run a 'bootm' command U-Boot.
58
59        This always starts a fresh U-Boot instance since the device tree may
60        contain a new public key.
61
62        Args:
63            test_type: A string identifying the test type.
64            expect_string: A string which is expected in the output.
65            sha_algo: Either 'sha1' or 'sha256', to select the algorithm to
66                    use.
67            boots: A boolean that is True if Linux should boot and False if
68                    we are expected to not boot
69        """
70        cons.restart_uboot()
71        with cons.log.section('Verified boot %s %s' % (sha_algo, test_type)):
72            output = cons.run_command_list(
73                ['sb load hostfs - 100 %stest.fit' % tmpdir,
74                'fdt addr 100',
75                'bootm 100'])
76        assert(expect_string in ''.join(output))
77        if boots:
78            assert('sandbox: continuing, as we cannot run' in ''.join(output))
79
80    def make_fit(its):
81        """Make a new FIT from the .its source file.
82
83        This runs 'mkimage -f' to create a new FIT.
84
85        Args:
86            its: Filename containing .its source.
87        """
88        util.run_and_log(cons, [mkimage, '-D', dtc_args, '-f',
89                                '%s%s' % (datadir, its), fit])
90
91    def sign_fit(sha_algo):
92        """Sign the FIT
93
94        Signs the FIT and writes the signature into it. It also writes the
95        public key into the dtb.
96
97        Args:
98            sha_algo: Either 'sha1' or 'sha256', to select the algorithm to
99                    use.
100        """
101        cons.log.action('%s: Sign images' % sha_algo)
102        util.run_and_log(cons, [mkimage, '-F', '-k', tmpdir, '-K', dtb,
103                                '-r', fit])
104
105    def test_with_algo(sha_algo):
106        """Test verified boot with the given hash algorithm.
107
108        This is the main part of the test code. The same procedure is followed
109        for both hashing algorithms.
110
111        Args:
112            sha_algo: Either 'sha1' or 'sha256', to select the algorithm to
113                    use.
114        """
115        # Compile our device tree files for kernel and U-Boot. These are
116        # regenerated here since mkimage will modify them (by adding a
117        # public key) below.
118        dtc('sandbox-kernel.dts')
119        dtc('sandbox-u-boot.dts')
120
121        # Build the FIT, but don't sign anything yet
122        cons.log.action('%s: Test FIT with signed images' % sha_algo)
123        make_fit('sign-images-%s.its' % sha_algo)
124        run_bootm(sha_algo, 'unsigned images', 'dev-', True)
125
126        # Sign images with our dev keys
127        sign_fit(sha_algo)
128        run_bootm(sha_algo, 'signed images', 'dev+', True)
129
130        # Create a fresh .dtb without the public keys
131        dtc('sandbox-u-boot.dts')
132
133        cons.log.action('%s: Test FIT with signed configuration' % sha_algo)
134        make_fit('sign-configs-%s.its' % sha_algo)
135        run_bootm(sha_algo, 'unsigned config', '%s+ OK' % sha_algo, True)
136
137        # Sign images with our dev keys
138        sign_fit(sha_algo)
139        run_bootm(sha_algo, 'signed config', 'dev+', True)
140
141        cons.log.action('%s: Check signed config on the host' % sha_algo)
142
143        util.run_and_log(cons, [fit_check_sign, '-f', fit, '-k', tmpdir,
144                                '-k', dtb])
145
146        # Increment the first byte of the signature, which should cause failure
147        sig = util.run_and_log(cons, 'fdtget -t bx %s %s value' %
148                               (fit, sig_node))
149        byte_list = sig.split()
150        byte = int(byte_list[0], 16)
151        byte_list[0] = '%x' % (byte + 1)
152        sig = ' '.join(byte_list)
153        util.run_and_log(cons, 'fdtput -t bx %s %s value %s' %
154                         (fit, sig_node, sig))
155
156        run_bootm(sha_algo, 'Signed config with bad hash', 'Bad Data Hash', False)
157
158        cons.log.action('%s: Check bad config on the host' % sha_algo)
159        util.run_and_log_expect_exception(cons, [fit_check_sign, '-f', fit,
160                '-k', dtb], 1, 'Failed to verify required signature')
161
162    cons = u_boot_console
163    tmpdir = cons.config.result_dir + '/'
164    tmp = tmpdir + 'vboot.tmp'
165    datadir = cons.config.source_dir + '/test/py/tests/vboot/'
166    fit = '%stest.fit' % tmpdir
167    mkimage = cons.config.build_dir + '/tools/mkimage'
168    fit_check_sign = cons.config.build_dir + '/tools/fit_check_sign'
169    dtc_args = '-I dts -O dtb -i %s' % tmpdir
170    dtb = '%ssandbox-u-boot.dtb' % tmpdir
171    sig_node = '/configurations/conf@1/signature@1'
172
173    # Create an RSA key pair
174    public_exponent = 65537
175    util.run_and_log(cons, 'openssl genpkey -algorithm RSA -out %sdev.key '
176                     '-pkeyopt rsa_keygen_bits:2048 '
177                     '-pkeyopt rsa_keygen_pubexp:%d '
178                     '2>/dev/null'  % (tmpdir, public_exponent))
179
180    # Create a certificate containing the public key
181    util.run_and_log(cons, 'openssl req -batch -new -x509 -key %sdev.key -out '
182                     '%sdev.crt' % (tmpdir, tmpdir))
183
184    # Create a number kernel image with zeroes
185    with open('%stest-kernel.bin' % tmpdir, 'w') as fd:
186        fd.write(5000 * chr(0))
187
188    try:
189        # We need to use our own device tree file. Remember to restore it
190        # afterwards.
191        old_dtb = cons.config.dtb
192        cons.config.dtb = dtb
193        test_with_algo('sha1')
194        test_with_algo('sha256')
195    finally:
196        # Go back to the original U-Boot with the correct dtb.
197        cons.config.dtb = old_dtb
198        cons.restart_uboot()
199