diff --git a/test-cases/secure-boot-imx6.yaml b/test-cases/secure-boot-imx6.yaml new file mode 100644 index 0000000000000000000000000000000000000000..2f8b1fa52e65a416dfeff35d0b0ce38f6adbe8f0 --- /dev/null +++ b/test-cases/secure-boot-imx6.yaml @@ -0,0 +1,70 @@ +metadata: + name: secure-boot-imx6 + format: "Apertis Test Definition 1.0" + image-types: + minimal: [ armhf ] + image-deployment: + - OSTree + type: functional + exec-type: manual + priority: medium + maintainer: "Apertis Project" + description: "Test that Secure Boot via HAB on the SabreLite board works for bootloader and + initial OS image in FIT format." + + pre-conditions: + - "Requires the DUT to be flashed with a signed U-Boot built with HAB and FIT image support + as provided since version 2019.01+dfsg-7co6. U-Boot could be installed with + [public U-Boot installer v2021dev1.0](https://images.apertis.org/release/v2021dev1/v2021dev1.0/installer/mx6qsabrelite-uboot/) + or any newer version." + - "Requires a DUT with fused SRK hash (it's a irreversible operation! Please refer to the documentation)" + - 'It is expected that DUT is working in "open" HAB mode' + - "In addition need to use image without signed kernel, for example older OSTree-based image + from [v2019 release](https://images.apertis.org/release/v2019/v2019.2/armhf/minimal/)" + + expected: + - "U-Boot is booted without HAB validation errors" + - "U-Boot is able to verify and boot signed FIT image" + - 'U-Boot hangs in "closed" state trying to boot with unsigned image' + + notes: + - 'All commands should be typed in U-Boot CLI' + - 'In the "open" mode HAB will accept the FIT image signed with any signature' + +run: + steps: + - "Stop in U-Boot prompt" + - "Check if flashed U-Boot have HAB support and correct SRK hash fused" + - $ hab_status + - | + >Secure boot disabled + + HAB Configuration: 0xf0, HAB State: 0x66 + No HAB Events Found! + - "Insert SD-card with flashed Apertis OSTree-based armhf image and start the boot process" + - $ run bootcmd + - "The output must contain following output while loading the image, meaning the Secure Boot is enabled and the image + is signed with the proper signature" + - | + >hab fuse not enabled + + Authenticate image from DDR location 0x12000000... + + Secure boot disabled + + HAB Configuration: 0xf0, HAB State: 0x66 + No HAB Events Found! + + i.MX HAB verification: image verification passed + ## Loading kernel from FIT Image at 12000000 ... + - "Switch off the DUT to clear any signature-related artifacts from the memory" + - "Power on the device and stop in U-Boot prompt" + - "Emulate that device is in 'closed' state:" + - $ fuse override 0 6 0x2 + - "Swap the SD-card to another one with flashed old Apertis armhf image with the unsigned kernel, and start the boot process" + - $ run bootcmd + - "The system should be stopped just after kernel load with error below" + - | + >i.MX HAB verification: IVT not found + ### ERROR ### Please RESET the board ### +