blob: c2579fa02c58deb386add444944738d659ba7474 [file] [log] [blame]
Miquel Raynalcaaf40a2018-05-15 11:57:24 +02001# SPDX-License-Identifier: GPL-2.0+
2# Copyright (c) 2018, Bootlin
3# Author: Miquel Raynal <miquel.raynal@bootlin.com>
4
5import os.path
6import pytest
7import u_boot_utils
8import re
9import time
10
11"""
12Test the TPMv2.x related commands. You must have a working hardware setup in
13order to do these tests.
14
15Notes:
16* These tests will prove the password mechanism. The TPM chip must be cleared of
17any password.
18* Commands like pcr_setauthpolicy and pcr_resetauthpolicy are not implemented
19here because they would fail the tests in most cases (TPMs do not implement them
20and return an error).
T Karthik Reddyeca717c2021-07-23 06:18:26 -060021
22
23Note:
24This test doesn't rely on boardenv_* configuration value but can change test
25behavior.
26
27* Setup env__tpm_device_test_skip to True if tests with TPM devices should be
28skipped.
29
Miquel Raynalcaaf40a2018-05-15 11:57:24 +020030"""
31
32updates = 0
33
34def force_init(u_boot_console, force=False):
35 """When a test fails, U-Boot is reset. Because TPM stack must be initialized
36 after each reboot, we must ensure these lines are always executed before
37 trying any command or they will fail with no reason. Executing 'tpm init'
38 twice will spawn an error used to detect that the TPM was not reset and no
39 initialization code should be run.
40 """
T Karthik Reddyeca717c2021-07-23 06:18:26 -060041 skip_test = u_boot_console.config.env.get('env__tpm_device_test_skip', False)
42 if skip_test:
43 pytest.skip('skip TPM device test')
Ilias Apalodimas55c8ce52023-06-07 12:18:11 +030044 output = u_boot_console.run_command('tpm2 autostart')
Miquel Raynalcaaf40a2018-05-15 11:57:24 +020045 if force or not 'Error' in output:
46 u_boot_console.run_command('echo --- start of init ---')
Miquel Raynal6a53b822018-07-19 22:35:10 +020047 u_boot_console.run_command('tpm2 clear TPM2_RH_LOCKOUT')
Miquel Raynalcaaf40a2018-05-15 11:57:24 +020048 output = u_boot_console.run_command('echo $?')
49 if not output.endswith('0'):
Miquel Raynal6a53b822018-07-19 22:35:10 +020050 u_boot_console.run_command('tpm2 clear TPM2_RH_PLATFORM')
Miquel Raynalcaaf40a2018-05-15 11:57:24 +020051 u_boot_console.run_command('echo --- end of init ---')
52
Simon Glass9fdddc82021-09-19 15:14:50 -060053def is_sandbox(cons):
54 # Array slice removes leading/trailing quotes.
55 sys_arch = cons.config.buildconfig.get('config_sys_arch', '"sandbox"')[1:-1]
56 return sys_arch == 'sandbox'
57
Miquel Raynalcaaf40a2018-05-15 11:57:24 +020058@pytest.mark.buildconfigspec('cmd_tpm_v2')
59def test_tpm2_init(u_boot_console):
60 """Init the software stack to use TPMv2 commands."""
T Karthik Reddyeca717c2021-07-23 06:18:26 -060061 skip_test = u_boot_console.config.env.get('env__tpm_device_test_skip', False)
62 if skip_test:
63 pytest.skip('skip TPM device test')
Miquel Raynal6a53b822018-07-19 22:35:10 +020064 u_boot_console.run_command('tpm2 init')
Miquel Raynalcaaf40a2018-05-15 11:57:24 +020065 output = u_boot_console.run_command('echo $?')
66 assert output.endswith('0')
67
68@pytest.mark.buildconfigspec('cmd_tpm_v2')
69def test_tpm2_startup(u_boot_console):
70 """Execute a TPM2_Startup command.
71
72 Initiate the TPM internal state machine.
73 """
Michal Simeka59a24b2023-08-30 18:36:23 +020074 skip_test = u_boot_console.config.env.get('env__tpm_device_test_skip', False)
75 if skip_test:
76 pytest.skip('skip TPM device test')
Simon Glass9fdddc82021-09-19 15:14:50 -060077 u_boot_console.run_command('tpm2 startup TPM2_SU_CLEAR')
78 output = u_boot_console.run_command('echo $?')
79 assert output.endswith('0')
80
81def tpm2_sandbox_init(u_boot_console):
82 """Put sandbox back into a known state so we can run a test
83
84 This allows all tests to run in parallel, since no test depends on another.
85 """
86 u_boot_console.restart_uboot()
Ilias Apalodimas55c8ce52023-06-07 12:18:11 +030087 u_boot_console.run_command('tpm2 autostart')
Simon Glass9fdddc82021-09-19 15:14:50 -060088 output = u_boot_console.run_command('echo $?')
89 assert output.endswith('0')
Miquel Raynalcaaf40a2018-05-15 11:57:24 +020090
T Karthik Reddyeca717c2021-07-23 06:18:26 -060091 skip_test = u_boot_console.config.env.get('env__tpm_device_test_skip', False)
92 if skip_test:
93 pytest.skip('skip TPM device test')
Simon Glass9fdddc82021-09-19 15:14:50 -060094
Miquel Raynalcaaf40a2018-05-15 11:57:24 +020095@pytest.mark.buildconfigspec('cmd_tpm_v2')
Simon Glass9fdddc82021-09-19 15:14:50 -060096def test_tpm2_sandbox_self_test_full(u_boot_console):
Miquel Raynalcaaf40a2018-05-15 11:57:24 +020097 """Execute a TPM2_SelfTest (full) command.
98
99 Ask the TPM to perform all self tests to also enable full capabilities.
100 """
Simon Glass9fdddc82021-09-19 15:14:50 -0600101 if is_sandbox(u_boot_console):
102 u_boot_console.restart_uboot()
103 u_boot_console.run_command('tpm2 init')
104 output = u_boot_console.run_command('echo $?')
105 assert output.endswith('0')
106
107 u_boot_console.run_command('tpm2 startup TPM2_SU_CLEAR')
108 output = u_boot_console.run_command('echo $?')
109 assert output.endswith('0')
Miquel Raynalcaaf40a2018-05-15 11:57:24 +0200110
T Karthik Reddyeca717c2021-07-23 06:18:26 -0600111 skip_test = u_boot_console.config.env.get('env__tpm_device_test_skip', False)
112 if skip_test:
113 pytest.skip('skip TPM device test')
Miquel Raynal6a53b822018-07-19 22:35:10 +0200114 u_boot_console.run_command('tpm2 self_test full')
Miquel Raynalcaaf40a2018-05-15 11:57:24 +0200115 output = u_boot_console.run_command('echo $?')
116 assert output.endswith('0')
117
118@pytest.mark.buildconfigspec('cmd_tpm_v2')
119def test_tpm2_continue_self_test(u_boot_console):
120 """Execute a TPM2_SelfTest (continued) command.
121
122 Ask the TPM to finish its self tests (alternative to the full test) in order
123 to enter a fully operational state.
124 """
125
T Karthik Reddyeca717c2021-07-23 06:18:26 -0600126 skip_test = u_boot_console.config.env.get('env__tpm_device_test_skip', False)
127 if skip_test:
128 pytest.skip('skip TPM device test')
Simon Glass9fdddc82021-09-19 15:14:50 -0600129 if is_sandbox(u_boot_console):
130 tpm2_sandbox_init(u_boot_console)
Miquel Raynal6a53b822018-07-19 22:35:10 +0200131 u_boot_console.run_command('tpm2 self_test continue')
Miquel Raynalcaaf40a2018-05-15 11:57:24 +0200132 output = u_boot_console.run_command('echo $?')
133 assert output.endswith('0')
134
135@pytest.mark.buildconfigspec('cmd_tpm_v2')
136def test_tpm2_clear(u_boot_console):
137 """Execute a TPM2_Clear command.
138
139 Ask the TPM to reset entirely its internal state (including internal
140 configuration, passwords, counters and DAM parameters). This is half of the
141 TAKE_OWNERSHIP command from TPMv1.
142
143 Use the LOCKOUT hierarchy for this. The LOCKOUT/PLATFORM hierarchies must
144 not have a password set, otherwise this test will fail. ENDORSEMENT and
145 PLATFORM hierarchies are also available.
146 """
Simon Glass9fdddc82021-09-19 15:14:50 -0600147 if is_sandbox(u_boot_console):
148 tpm2_sandbox_init(u_boot_console)
Miquel Raynalcaaf40a2018-05-15 11:57:24 +0200149
T Karthik Reddyeca717c2021-07-23 06:18:26 -0600150 skip_test = u_boot_console.config.env.get('env__tpm_device_test_skip', False)
151 if skip_test:
152 pytest.skip('skip TPM device test')
Miquel Raynal6a53b822018-07-19 22:35:10 +0200153 u_boot_console.run_command('tpm2 clear TPM2_RH_LOCKOUT')
Miquel Raynalcaaf40a2018-05-15 11:57:24 +0200154 output = u_boot_console.run_command('echo $?')
155 assert output.endswith('0')
156
Miquel Raynal6a53b822018-07-19 22:35:10 +0200157 u_boot_console.run_command('tpm2 clear TPM2_RH_PLATFORM')
Miquel Raynalcaaf40a2018-05-15 11:57:24 +0200158 output = u_boot_console.run_command('echo $?')
159 assert output.endswith('0')
160
161@pytest.mark.buildconfigspec('cmd_tpm_v2')
162def test_tpm2_change_auth(u_boot_console):
163 """Execute a TPM2_HierarchyChangeAuth command.
164
165 Ask the TPM to change the owner, ie. set a new password: 'unicorn'
166
167 Use the LOCKOUT hierarchy for this. ENDORSEMENT and PLATFORM hierarchies are
168 also available.
169 """
Simon Glass9fdddc82021-09-19 15:14:50 -0600170 if is_sandbox(u_boot_console):
171 tpm2_sandbox_init(u_boot_console)
Miquel Raynalcaaf40a2018-05-15 11:57:24 +0200172 force_init(u_boot_console)
173
Miquel Raynal6a53b822018-07-19 22:35:10 +0200174 u_boot_console.run_command('tpm2 change_auth TPM2_RH_LOCKOUT unicorn')
Miquel Raynalcaaf40a2018-05-15 11:57:24 +0200175 output = u_boot_console.run_command('echo $?')
176 assert output.endswith('0')
177
Miquel Raynal6a53b822018-07-19 22:35:10 +0200178 u_boot_console.run_command('tpm2 clear TPM2_RH_LOCKOUT unicorn')
Miquel Raynalcaaf40a2018-05-15 11:57:24 +0200179 output = u_boot_console.run_command('echo $?')
Miquel Raynal6a53b822018-07-19 22:35:10 +0200180 u_boot_console.run_command('tpm2 clear TPM2_RH_PLATFORM')
Miquel Raynalcaaf40a2018-05-15 11:57:24 +0200181 assert output.endswith('0')
182
Heinrich Schuchardta0faaff2021-11-15 18:13:10 +0100183@pytest.mark.buildconfigspec('sandbox')
Miquel Raynalcaaf40a2018-05-15 11:57:24 +0200184@pytest.mark.buildconfigspec('cmd_tpm_v2')
185def test_tpm2_get_capability(u_boot_console):
186 """Execute a TPM_GetCapability command.
187
188 Display one capability. In our test case, let's display the default DAM
189 lockout counter that should be 0 since the CLEAR:
190 - TPM_CAP_TPM_PROPERTIES = 0x6
191 - TPM_PT_LOCKOUT_COUNTER (1st parameter) = PTR_VAR + 14
192
193 There is no expected default values because it would depend on the chip
194 used. We can still save them in order to check they have changed later.
195 """
Simon Glass9fdddc82021-09-19 15:14:50 -0600196 if is_sandbox(u_boot_console):
197 tpm2_sandbox_init(u_boot_console)
Miquel Raynalcaaf40a2018-05-15 11:57:24 +0200198
199 force_init(u_boot_console)
200 ram = u_boot_utils.find_ram_base(u_boot_console)
201
Miquel Raynal6a53b822018-07-19 22:35:10 +0200202 read_cap = u_boot_console.run_command('tpm2 get_capability 0x6 0x20e 0x200 1') #0x%x 1' % ram)
Miquel Raynalcaaf40a2018-05-15 11:57:24 +0200203 output = u_boot_console.run_command('echo $?')
204 assert output.endswith('0')
205 assert 'Property 0x0000020e: 0x00000000' in read_cap
206
207@pytest.mark.buildconfigspec('cmd_tpm_v2')
208def test_tpm2_dam_parameters(u_boot_console):
209 """Execute a TPM2_DictionaryAttackParameters command.
210
211 Change Dictionary Attack Mitigation (DAM) parameters. Ask the TPM to change:
212 - Max number of failed authentication before lockout: 3
213 - Time before the failure counter is automatically decremented: 10 sec
214 - Time after a lockout failure before it can be attempted again: 0 sec
215
216 For an unknown reason, the DAM parameters must be changed before changing
217 the authentication, otherwise the lockout will be engaged after the first
218 failed authentication attempt.
219 """
Simon Glass9fdddc82021-09-19 15:14:50 -0600220 if is_sandbox(u_boot_console):
221 tpm2_sandbox_init(u_boot_console)
Miquel Raynalcaaf40a2018-05-15 11:57:24 +0200222 force_init(u_boot_console)
223 ram = u_boot_utils.find_ram_base(u_boot_console)
224
225 # Set the DAM parameters to known values
Miquel Raynal6a53b822018-07-19 22:35:10 +0200226 u_boot_console.run_command('tpm2 dam_parameters 3 10 0')
Miquel Raynalcaaf40a2018-05-15 11:57:24 +0200227 output = u_boot_console.run_command('echo $?')
228 assert output.endswith('0')
229
230 # Check the values have been saved
Miquel Raynal6a53b822018-07-19 22:35:10 +0200231 read_cap = u_boot_console.run_command('tpm2 get_capability 0x6 0x20f 0x%x 3' % ram)
Miquel Raynalcaaf40a2018-05-15 11:57:24 +0200232 output = u_boot_console.run_command('echo $?')
233 assert output.endswith('0')
234 assert 'Property 0x0000020f: 0x00000003' in read_cap
235 assert 'Property 0x00000210: 0x0000000a' in read_cap
236 assert 'Property 0x00000211: 0x00000000' in read_cap
237
238@pytest.mark.buildconfigspec('cmd_tpm_v2')
239def test_tpm2_pcr_read(u_boot_console):
240 """Execute a TPM2_PCR_Read command.
241
242 Perform a PCR read of the 0th PCR. Must be zero.
243 """
Simon Glass9fdddc82021-09-19 15:14:50 -0600244 if is_sandbox(u_boot_console):
245 tpm2_sandbox_init(u_boot_console)
Miquel Raynalcaaf40a2018-05-15 11:57:24 +0200246
247 force_init(u_boot_console)
Quentin Schulzdae1aa82018-07-09 19:16:27 +0200248 ram = u_boot_utils.find_ram_base(u_boot_console)
Miquel Raynalcaaf40a2018-05-15 11:57:24 +0200249
Miquel Raynal6a53b822018-07-19 22:35:10 +0200250 read_pcr = u_boot_console.run_command('tpm2 pcr_read 0 0x%x' % ram)
Miquel Raynalcaaf40a2018-05-15 11:57:24 +0200251 output = u_boot_console.run_command('echo $?')
252 assert output.endswith('0')
253
254 # Save the number of PCR updates
255 str = re.findall(r'\d+ known updates', read_pcr)[0]
256 global updates
257 updates = int(re.findall(r'\d+', str)[0])
258
259 # Check the output value
260 assert 'PCR #0 content' in read_pcr
261 assert '00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00' in read_pcr
262
263@pytest.mark.buildconfigspec('cmd_tpm_v2')
264def test_tpm2_pcr_extend(u_boot_console):
265 """Execute a TPM2_PCR_Extend command.
266
267 Perform a PCR extension with a known hash in memory (zeroed since the board
268 must have been rebooted).
269
270 No authentication mechanism is used here, not protecting against packet
271 replay, yet.
272 """
Simon Glass9fdddc82021-09-19 15:14:50 -0600273 if is_sandbox(u_boot_console):
274 tpm2_sandbox_init(u_boot_console)
Miquel Raynalcaaf40a2018-05-15 11:57:24 +0200275 force_init(u_boot_console)
Quentin Schulzdae1aa82018-07-09 19:16:27 +0200276 ram = u_boot_utils.find_ram_base(u_boot_console)
Miquel Raynalcaaf40a2018-05-15 11:57:24 +0200277
Ilias Apalodimasc5967e72023-06-07 12:18:12 +0300278 read_pcr = u_boot_console.run_command('tpm2 pcr_read 0 0x%x' % (ram + 0x20))
279 output = u_boot_console.run_command('echo $?')
280 assert output.endswith('0')
281 str = re.findall(r'\d+ known updates', read_pcr)[0]
282 updates = int(re.findall(r'\d+', str)[0])
283
Miquel Raynal6a53b822018-07-19 22:35:10 +0200284 u_boot_console.run_command('tpm2 pcr_extend 0 0x%x' % ram)
Miquel Raynalcaaf40a2018-05-15 11:57:24 +0200285 output = u_boot_console.run_command('echo $?')
286 assert output.endswith('0')
287
Simon Glass00211022021-07-18 14:18:06 -0600288 # Read the value back into a different place so we can still use 'ram' as
289 # our zero bytes
290 read_pcr = u_boot_console.run_command('tpm2 pcr_read 0 0x%x' % (ram + 0x20))
Miquel Raynalcaaf40a2018-05-15 11:57:24 +0200291 output = u_boot_console.run_command('echo $?')
292 assert output.endswith('0')
293 assert 'f5 a5 fd 42 d1 6a 20 30 27 98 ef 6e d3 09 97 9b' in read_pcr
294 assert '43 00 3d 23 20 d9 f0 e8 ea 98 31 a9 27 59 fb 4b' in read_pcr
295
296 str = re.findall(r'\d+ known updates', read_pcr)[0]
297 new_updates = int(re.findall(r'\d+', str)[0])
298 assert (updates + 1) == new_updates
299
Simon Glass00211022021-07-18 14:18:06 -0600300 u_boot_console.run_command('tpm2 pcr_extend 0 0x%x' % ram)
301 output = u_boot_console.run_command('echo $?')
302 assert output.endswith('0')
303
304 read_pcr = u_boot_console.run_command('tpm2 pcr_read 0 0x%x' % (ram + 0x20))
305 output = u_boot_console.run_command('echo $?')
306 assert output.endswith('0')
307 assert '7a 05 01 f5 95 7b df 9c b3 a8 ff 49 66 f0 22 65' in read_pcr
308 assert 'f9 68 65 8b 7a 9c 62 64 2c ba 11 65 e8 66 42 f5' in read_pcr
309
310 str = re.findall(r'\d+ known updates', read_pcr)[0]
311 new_updates = int(re.findall(r'\d+', str)[0])
312 assert (updates + 2) == new_updates
313
Miquel Raynalcaaf40a2018-05-15 11:57:24 +0200314@pytest.mark.buildconfigspec('cmd_tpm_v2')
315def test_tpm2_cleanup(u_boot_console):
316 """Ensure the TPM is cleared from password or test related configuration."""
317
318 force_init(u_boot_console, True)