diff options
Diffstat (limited to 'tools/binman/ftest.py')
| -rw-r--r-- | tools/binman/ftest.py | 96 |
1 files changed, 85 insertions, 11 deletions
diff --git a/tools/binman/ftest.py b/tools/binman/ftest.py index ea2fa6eb83a..a0e8bde7901 100644 --- a/tools/binman/ftest.py +++ b/tools/binman/ftest.py @@ -8029,6 +8029,39 @@ fdt fdtmap Extract the devicetree blob from the fdtmap err = stderr.getvalue() self.assertRegex(err, "Image 'image'.*missing bintools.*: cst") + def testNxpImx8mCSTPKCS11(self): + """Test CST signing with IVT-format input (pkcs11 auth, no unlock)""" + # Create fake IVT blob: magic(4) + padding(20) + signsize_addr(4) + # + padding(36) = 64 bytes + ivt_data = struct.pack('<I', 0x412000d1) + ivt_data += b'\x00' * 20 + ivt_data += struct.pack('<I', 0) + ivt_data += b'\x00' * 36 + self._MakeInputFile('imx8m-ivt.bin', ivt_data) + with terminal.capture() as (_, stderr): + self._DoTestFile('vendor/nxp_imx8_csf_pkcs11.dts', + force_missing_bintools='cst') + err = stderr.getvalue() + self.assertRegex(err, "Image 'image'.*missing bintools.*: cst") + + def testNxpImx8mCSTFCFB(self): + """Test CST signing with FCFB-format input (normal auth, no unlock)""" + # Create fake FCFB blob: magic(4) + padding(4116) + ivt_data = struct.pack('<I', 0x42464346) + ivt_data += b'\x00' * 4116 + # Create fake IVT blob: magic(4) + padding(20) + signsize_addr(4) + # + padding(36) = 64 bytes + ivt_data += struct.pack('<I', 0x412000d1) + ivt_data += b'\x00' * 20 + ivt_data += struct.pack('<I', 0) + ivt_data += b'\x00' * 36 + self._MakeInputFile('imx8m-ivt.bin', ivt_data) + with terminal.capture() as (_, stderr): + self._DoTestFile('vendor/nxp_imx8_csf.dts', + force_missing_bintools='cst') + err = stderr.getvalue() + self.assertRegex(err, "Image 'image'.*missing bintools.*: cst") + def testNxpImx8mCSTFastAuth(self): """Test CST signing with fast-auth mode, unlock, and FIT format""" # FIT magic covers the FIT-signing path; fast-auth/unlock cover the @@ -8106,17 +8139,18 @@ fdt fdtmap Extract the devicetree blob from the fdtmap def testNxpImx8MFSPI(self): """Test that binman can produce an iMX8m FSPI image""" - testdir = tempfile.mkdtemp(prefix='binman.') - - tools.write_file(os.path.join(testdir, 'fspi_header.bin'), tools.get_bytes(0, 448)) - with terminal.capture(): - self._DoTestFile('vendor/nxp_imx8m_fspi.dts', output_dir=testdir) - self._DoTestFile('vendor/nxp_imx8m_fspi_pass.dts', output_dir=testdir) - - tools.write_file(os.path.join(testdir, 'fspi_header_fail.bin'), tools.get_bytes(0, 4097)) - with terminal.capture(): - with self.assertRaises(ValueError) as e: - self._DoTestFile('vendor/nxp_imx8m_fspi_fail.dts', output_dir=testdir) + self._DoTestFile('vendor/nxp_imx8m_fspi.dts') + self._DoTestFile('vendor/nxp_imx8m_fspi_pass.dts') + with self.assertRaises(ValueError) as e: + self._DoTestFile('vendor/nxp_imx8m_fspi_fail_columnadresswidth.dts') + with self.assertRaises(ValueError) as e: + self._DoTestFile('vendor/nxp_imx8m_fspi_fail_devicetype.dts') + with self.assertRaises(ValueError) as e: + self._DoTestFile('vendor/nxp_imx8m_fspi_fail_flashpadtype.dts') + with self.assertRaises(ValueError) as e: + self._DoTestFile('vendor/nxp_imx8m_fspi_fail_readsampleclksrc.dts') + with self.assertRaises(ValueError) as e: + self._DoTestFile('vendor/nxp_imx8m_fspi_fail_serialclkfreq.dts') def testNxpHeaderDdrfw(self): """Test that binman can add a header to DDR PHY firmware images""" @@ -8172,6 +8206,31 @@ fdt fdtmap Extract the devicetree blob from the fdtmap self.assertIsNotNone(signature) self.assertIsNotNone(signature.props.get('value')) + def testFitSignKeydir(self): + """Test that the keydir EntryArg is passed to mkimage""" + if not elf.ELF_TOOLS: + self.skipTest('Python elftools not available') + data = tools.read_file(self.TestFile("fit/rsa2048.key")) + self._MakeInputFile("keys/rsa2048.key", data) + + test_subdir = os.path.join(self._indir, TEST_FDT_SUBDIR) + keys_subdir = os.path.join(self._indir, "keys") + entry_args = { + 'of-list': 'test-fdt1', + 'default-dt': 'test-fdt1', + 'atf-bl31-path': 'bl31.elf', + 'keydir': keys_subdir, + } + data = self._DoReadFileDtb( + 'fit/signature.dts', + entry_args=entry_args, + extra_indirs=[test_subdir])[0] + + dtb = fdt.Fdt.FromData(data) + dtb.Scan() + signature = dtb.GetNode('/configurations/conf-uboot-1/signature') + self.assertIsNotNone(signature.props.get('value')) + def testFitSignEngineSimple(self): """Test that image with FIT and signature nodes can be signed with an OpenSSL Engine""" @@ -8512,6 +8571,21 @@ fdt fdtmap Extract the devicetree blob from the fdtmap dec_data = file.read() self.assertEqual(U_BOOT_NODTB_DATA, dec_data.encode('ascii')) + def testSimpleFitEncryptedDataKeydir(self): + """Test that encrypted FIT data uses the keydir EntryArg""" + data = tools.read_file(self.TestFile("fit/aes256.bin")) + self._MakeInputFile("keys/aes256.bin", data) + + keys_subdir = os.path.join(self._indir, "keys") + data = self._DoReadFileDtb( + 'fit/encrypt_data.dts', + entry_args={'keydir': keys_subdir})[0] + + fit = fdt.Fdt.FromData(data) + fit.Scan() + node = fit.GetNode('/images/u-boot') + self.assertIn('data-size-unciphered', fit.GetProps(node)) + def testSimpleFitEncryptedDataMissingKey(self): """Test an image with a FIT containing data to be encrypted but with a missing key""" with self.assertRaises(ValueError) as e: |