conftest.py 5.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123
  1. # SPDX-License-Identifier: GPL-2.0+
  2. # Copyright (c) 2020, Linaro Limited
  3. # Author: AKASHI Takahiro <takahiro.akashi@linaro.org>
  4. import os
  5. import os.path
  6. import re
  7. from subprocess import call, check_call, check_output, CalledProcessError
  8. import pytest
  9. from capsule_defs import *
  10. #
  11. # Fixture for UEFI capsule test
  12. #
  13. @pytest.fixture(scope='session')
  14. def efi_capsule_data(request, u_boot_config):
  15. """Set up a file system to be used in UEFI capsule and
  16. authentication test.
  17. Args:
  18. request: Pytest request object.
  19. u_boot_config: U-boot configuration.
  20. Return:
  21. A path to disk image to be used for testing
  22. """
  23. global CAPSULE_DATA_DIR, CAPSULE_INSTALL_DIR
  24. mnt_point = u_boot_config.persistent_data_dir + '/test_efi_capsule'
  25. data_dir = mnt_point + CAPSULE_DATA_DIR
  26. install_dir = mnt_point + CAPSULE_INSTALL_DIR
  27. image_path = u_boot_config.persistent_data_dir + '/test_efi_capsule.img'
  28. try:
  29. # Create a target device
  30. check_call('dd if=/dev/zero of=./spi.bin bs=1MiB count=16', shell=True)
  31. check_call('rm -rf %s' % mnt_point, shell=True)
  32. check_call('mkdir -p %s' % data_dir, shell=True)
  33. check_call('mkdir -p %s' % install_dir, shell=True)
  34. capsule_auth_enabled = u_boot_config.buildconfig.get(
  35. 'config_efi_capsule_authenticate')
  36. if capsule_auth_enabled:
  37. # Create private key (SIGNER.key) and certificate (SIGNER.crt)
  38. check_call('cd %s; '
  39. 'openssl req -x509 -sha256 -newkey rsa:2048 '
  40. '-subj /CN=TEST_SIGNER/ -keyout SIGNER.key '
  41. '-out SIGNER.crt -nodes -days 365'
  42. % data_dir, shell=True)
  43. check_call('cd %s; %scert-to-efi-sig-list SIGNER.crt SIGNER.esl'
  44. % (data_dir, EFITOOLS_PATH), shell=True)
  45. # Update dtb adding capsule certificate
  46. check_call('cd %s; '
  47. 'cp %s/test/py/tests/test_efi_capsule/signature.dts .'
  48. % (data_dir, u_boot_config.source_dir), shell=True)
  49. check_call('cd %s; '
  50. 'dtc -@ -I dts -O dtb -o signature.dtbo signature.dts; '
  51. 'fdtoverlay -i %s/arch/sandbox/dts/test.dtb '
  52. '-o test_sig.dtb signature.dtbo'
  53. % (data_dir, u_boot_config.build_dir), shell=True)
  54. # Create *malicious* private key (SIGNER2.key) and certificate
  55. # (SIGNER2.crt)
  56. check_call('cd %s; '
  57. 'openssl req -x509 -sha256 -newkey rsa:2048 '
  58. '-subj /CN=TEST_SIGNER/ -keyout SIGNER2.key '
  59. '-out SIGNER2.crt -nodes -days 365'
  60. % data_dir, shell=True)
  61. # Create capsule files
  62. # two regions: one for u-boot.bin and the other for u-boot.env
  63. check_call('cd %s; echo -n u-boot:Old > u-boot.bin.old; echo -n u-boot:New > u-boot.bin.new; echo -n u-boot-env:Old -> u-boot.env.old; echo -n u-boot-env:New > u-boot.env.new' % data_dir,
  64. shell=True)
  65. check_call('sed -e \"s?BINFILE1?u-boot.bin.new?\" -e \"s?BINFILE2?u-boot.env.new?\" %s/test/py/tests/test_efi_capsule/uboot_bin_env.its > %s/uboot_bin_env.its' %
  66. (u_boot_config.source_dir, data_dir),
  67. shell=True)
  68. check_call('cd %s; %s/tools/mkimage -f uboot_bin_env.its uboot_bin_env.itb' %
  69. (data_dir, u_boot_config.build_dir),
  70. shell=True)
  71. check_call('cd %s; %s/tools/mkeficapsule --index 1 --fit uboot_bin_env.itb Test01' %
  72. (data_dir, u_boot_config.build_dir),
  73. shell=True)
  74. check_call('cd %s; %s/tools/mkeficapsule --index 1 --raw u-boot.bin.new Test02' %
  75. (data_dir, u_boot_config.build_dir),
  76. shell=True)
  77. check_call('cd %s; %s/tools/mkeficapsule --index 1 --guid E2BB9C06-70E9-4B14-97A3-5A7913176E3F u-boot.bin.new Test03' %
  78. (data_dir, u_boot_config.build_dir),
  79. shell=True)
  80. if capsule_auth_enabled:
  81. # firmware signed with proper key
  82. check_call('cd %s; '
  83. '%s/tools/mkeficapsule --index 1 --monotonic-count 1 '
  84. '--private-key SIGNER.key --certificate SIGNER.crt '
  85. '--raw u-boot.bin.new Test11'
  86. % (data_dir, u_boot_config.build_dir),
  87. shell=True)
  88. # firmware signed with *mal* key
  89. check_call('cd %s; '
  90. '%s/tools/mkeficapsule --index 1 --monotonic-count 1 '
  91. '--private-key SIGNER2.key '
  92. '--certificate SIGNER2.crt '
  93. '--raw u-boot.bin.new Test12'
  94. % (data_dir, u_boot_config.build_dir),
  95. shell=True)
  96. # Create a disk image with EFI system partition
  97. check_call('virt-make-fs --partition=gpt --size=+1M --type=vfat %s %s' %
  98. (mnt_point, image_path), shell=True)
  99. check_call('sgdisk %s -A 1:set:0 -t 1:C12A7328-F81F-11D2-BA4B-00A0C93EC93B' %
  100. image_path, shell=True)
  101. except CalledProcessError as exception:
  102. pytest.skip('Setup failed: %s' % exception.cmd)
  103. return
  104. else:
  105. yield image_path
  106. finally:
  107. call('rm -rf %s' % mnt_point, shell=True)
  108. call('rm -f %s' % image_path, shell=True)
  109. call('rm -f ./spi.bin', shell=True)