From 5999ea20fa42e78f872720ec3d0ee1d8df1a1f40 Mon Sep 17 00:00:00 2001 From: Eddie James Date: Tue, 24 Oct 2023 10:43:51 -0500 Subject: test: Add sandbox TPM boot measurement Use the sandbox TPM driver to measure some boot images in a unit test case. Signed-off-by: Eddie James Reviewed-by: Simon Glass Acked-by: Ilias Apalodimas Signed-off-by: Ilias Apalodimas --- test/boot/Makefile | 1 + test/boot/measurement.c | 66 +++++++++++++++++++++++++++++++++++++++++++++++++ test/cmd_ut.c | 4 +++ 3 files changed, 71 insertions(+) create mode 100644 test/boot/measurement.c (limited to 'test') diff --git a/test/boot/Makefile b/test/boot/Makefile index 52947580ae6..068522cb9e0 100644 --- a/test/boot/Makefile +++ b/test/boot/Makefile @@ -4,6 +4,7 @@ obj-$(CONFIG_BOOTSTD) += bootdev.o bootstd_common.o bootflow.o bootmeth.o obj-$(CONFIG_FIT) += image.o +obj-$(CONFIG_MEASURED_BOOT) += measurement.o obj-$(CONFIG_EXPO) += expo.o obj-$(CONFIG_CEDIT) += cedit.o diff --git a/test/boot/measurement.c b/test/boot/measurement.c new file mode 100644 index 00000000000..9db2ed324c2 --- /dev/null +++ b/test/boot/measurement.c @@ -0,0 +1,66 @@ +// SPDX-License-Identifier: GPL-2.0+ +/* + * Test for measured boot functions + * + * Copyright 2023 IBM Corp. + * Written by Eddie James + */ + +#include +#include +#include +#include +#include +#include +#include + +#define MEASUREMENT_TEST(_name, _flags) \ + UNIT_TEST(_name, _flags, measurement_test) + +static int measure(struct unit_test_state *uts) +{ + struct bootm_headers images; + const size_t size = 1024; + u8 *kernel; + u8 *initrd; + size_t i; + + kernel = malloc(size); + initrd = malloc(size); + + images.os.image_start = map_to_sysmem(kernel); + images.os.image_len = size; + + images.rd_start = map_to_sysmem(initrd); + images.rd_end = images.rd_start + size; + + images.ft_addr = malloc(size); + images.ft_len = size; + + env_set("bootargs", "measurement testing"); + + for (i = 0; i < size; ++i) { + kernel[i] = 0xf0 | (i & 0xf); + initrd[i] = (i & 0xf0) | 0xf; + images.ft_addr[i] = i & 0xff; + } + + ut_assertok(bootm_measure(&images)); + + free(images.ft_addr); + free(initrd); + free(kernel); + + return 0; +} +MEASUREMENT_TEST(measure, 0); + +int do_ut_measurement(struct cmd_tbl *cmdtp, int flag, int argc, + char *const argv[]) +{ + struct unit_test *tests = UNIT_TEST_SUITE_START(measurement_test); + const int n_ents = UNIT_TEST_SUITE_COUNT(measurement_test); + + return cmd_ut_category("measurement", "measurement_test_", tests, + n_ents, argc, argv); +} diff --git a/test/cmd_ut.c b/test/cmd_ut.c index 0f56409e803..e87adcb71e2 100644 --- a/test/cmd_ut.c +++ b/test/cmd_ut.c @@ -99,6 +99,10 @@ static struct cmd_tbl cmd_ut_sub[] = { #if CONFIG_IS_ENABLED(UT_UNICODE) && !defined(API_BUILD) U_BOOT_CMD_MKENT(unicode, CONFIG_SYS_MAXARGS, 1, do_ut_unicode, "", ""), #endif +#ifdef CONFIG_MEASURED_BOOT + U_BOOT_CMD_MKENT(measurement, CONFIG_SYS_MAXARGS, 1, do_ut_measurement, + "", ""), +#endif #ifdef CONFIG_SANDBOX U_BOOT_CMD_MKENT(compression, CONFIG_SYS_MAXARGS, 1, do_ut_compression, "", ""), -- cgit v1.3.1 From 539e2f7c1011549a5a98a59b506c6d3927549b03 Mon Sep 17 00:00:00 2001 From: Ilias Apalodimas Date: Tue, 24 Oct 2023 10:43:54 -0500 Subject: test: use a non system PCR for testing PCR extend We currently use PCR 0 for testing the PCR read/extend functionality in our selftests. How ever those PCRs are defined by the TCG spec for platform use. For example if the tests run *after* the efi subsystem initialization, which extends PCRs 0 & 7 it will give a false positive. So let's switch over to a PCR which is more suitable and is defined for OS use. It's worth noting that we are using PCR10 here, since PCR9 is used internally by U-Boot if we choose to measure the loaded DTB Reviewed-by: Simon Glass Signed-off-by: Ilias Apalodimas --- test/py/tests/test_tpm2.py | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) (limited to 'test') diff --git a/test/py/tests/test_tpm2.py b/test/py/tests/test_tpm2.py index c2579fa02c5..47392b87a98 100644 --- a/test/py/tests/test_tpm2.py +++ b/test/py/tests/test_tpm2.py @@ -239,7 +239,7 @@ def test_tpm2_dam_parameters(u_boot_console): def test_tpm2_pcr_read(u_boot_console): """Execute a TPM2_PCR_Read command. - Perform a PCR read of the 0th PCR. Must be zero. + Perform a PCR read of the 10th PCR. Must be zero. """ if is_sandbox(u_boot_console): tpm2_sandbox_init(u_boot_console) @@ -247,7 +247,7 @@ def test_tpm2_pcr_read(u_boot_console): force_init(u_boot_console) ram = u_boot_utils.find_ram_base(u_boot_console) - read_pcr = u_boot_console.run_command('tpm2 pcr_read 0 0x%x' % ram) + read_pcr = u_boot_console.run_command('tpm2 pcr_read 10 0x%x' % ram) output = u_boot_console.run_command('echo $?') assert output.endswith('0') @@ -257,7 +257,7 @@ def test_tpm2_pcr_read(u_boot_console): updates = int(re.findall(r'\d+', str)[0]) # Check the output value - assert 'PCR #0 content' in read_pcr + assert 'PCR #10 content' in read_pcr assert '00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00' in read_pcr @pytest.mark.buildconfigspec('cmd_tpm_v2') @@ -275,19 +275,19 @@ def test_tpm2_pcr_extend(u_boot_console): force_init(u_boot_console) ram = u_boot_utils.find_ram_base(u_boot_console) - read_pcr = u_boot_console.run_command('tpm2 pcr_read 0 0x%x' % (ram + 0x20)) + read_pcr = u_boot_console.run_command('tpm2 pcr_read 10 0x%x' % (ram + 0x20)) output = u_boot_console.run_command('echo $?') assert output.endswith('0') str = re.findall(r'\d+ known updates', read_pcr)[0] updates = int(re.findall(r'\d+', str)[0]) - u_boot_console.run_command('tpm2 pcr_extend 0 0x%x' % ram) + u_boot_console.run_command('tpm2 pcr_extend 10 0x%x' % ram) output = u_boot_console.run_command('echo $?') assert output.endswith('0') # Read the value back into a different place so we can still use 'ram' as # our zero bytes - read_pcr = u_boot_console.run_command('tpm2 pcr_read 0 0x%x' % (ram + 0x20)) + read_pcr = u_boot_console.run_command('tpm2 pcr_read 10 0x%x' % (ram + 0x20)) output = u_boot_console.run_command('echo $?') assert output.endswith('0') assert 'f5 a5 fd 42 d1 6a 20 30 27 98 ef 6e d3 09 97 9b' in read_pcr @@ -297,11 +297,11 @@ def test_tpm2_pcr_extend(u_boot_console): new_updates = int(re.findall(r'\d+', str)[0]) assert (updates + 1) == new_updates - u_boot_console.run_command('tpm2 pcr_extend 0 0x%x' % ram) + u_boot_console.run_command('tpm2 pcr_extend 10 0x%x' % ram) output = u_boot_console.run_command('echo $?') assert output.endswith('0') - read_pcr = u_boot_console.run_command('tpm2 pcr_read 0 0x%x' % (ram + 0x20)) + read_pcr = u_boot_console.run_command('tpm2 pcr_read 10 0x%x' % (ram + 0x20)) output = u_boot_console.run_command('echo $?') assert output.endswith('0') assert '7a 05 01 f5 95 7b df 9c b3 a8 ff 49 66 f0 22 65' in read_pcr -- cgit v1.3.1 From 4fd7d27ccb763ce8b836a0e4c5dd005392d38e18 Mon Sep 17 00:00:00 2001 From: Ilias Apalodimas Date: Wed, 25 Oct 2023 10:25:25 +0300 Subject: test/py: always use autostart on tpm2 selftests commit 789ed2784256 ("test/py: replace 'tpm2 init, startup, selftest' sequences") changed some of the tpm2 init sequences to 'tpm2 autostart' instead of calling 'tpm init', 'tpm startup TPM2_SU_CLEAR', 'tpm2 self_test full'. The autostart command calls the afforementioned sequence and on top of that deals with the 'tpm2 init' return codes if the tpm is already started. Since we initialize the tpm from various subsystems now, replace the last remaining instances of 'tpm2 init' with 'tpm2 autostart'. Since the latter calls 'tpm2 init' anyway we will still be implicitly testing the validity of that command It's worth noting that since 'tpm2 autostart' performs the startup and self tests sequences of the tpm we could drop 'test_tpm2_sandbox_self_test_full' and 'test_tpm2_startup, but let's keep the since they test tpm commands and options Signed-off-by: Ilias Apalodimas --- test/py/tests/test_tpm2.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'test') diff --git a/test/py/tests/test_tpm2.py b/test/py/tests/test_tpm2.py index 47392b87a98..1d654cd4a23 100644 --- a/test/py/tests/test_tpm2.py +++ b/test/py/tests/test_tpm2.py @@ -61,7 +61,7 @@ def test_tpm2_init(u_boot_console): skip_test = u_boot_console.config.env.get('env__tpm_device_test_skip', False) if skip_test: pytest.skip('skip TPM device test') - u_boot_console.run_command('tpm2 init') + u_boot_console.run_command('tpm2 autostart') output = u_boot_console.run_command('echo $?') assert output.endswith('0') @@ -100,7 +100,7 @@ def test_tpm2_sandbox_self_test_full(u_boot_console): """ if is_sandbox(u_boot_console): u_boot_console.restart_uboot() - u_boot_console.run_command('tpm2 init') + u_boot_console.run_command('tpm2 autostart') output = u_boot_console.run_command('echo $?') assert output.endswith('0') -- cgit v1.3.1