Skip to content

Commit c199c3d

Browse files
miczyg1philipanda
miczyg1
authored and
philipanda
committed
dasharo-security/sovereign-boot.robot: Add Sovereign Boot tests for phase 1
Signed-off-by: Michał Żygowski <[email protected]>
1 parent 43cba75 commit c199c3d

File tree

3 files changed

+207
-0
lines changed

3 files changed

+207
-0
lines changed

‎dasharo-security/sovereign-boot.robot

Lines changed: 203 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,203 @@
1+
*** Settings ***
2+
Library Collections
3+
Library OperatingSystem
4+
Library Process
5+
Library String
6+
Library Telnet timeout=20 seconds connection_timeout=120 seconds
7+
Library SSHLibrary timeout=90 seconds
8+
Library RequestsLibrary
9+
Resource ../keywords.robot
10+
Resource ../keys.robot
11+
Resource ../variables.robot
12+
13+
Suite Setup Run Keywords
14+
... Prepare Test Suite
15+
... AND
16+
... Skip If not ${SOVEREIGN_BOOT_SUPPORT} Sovereign Boot tests not supported
17+
Suite Teardown Run Keyword
18+
... Log Out And Close Connection
19+
# This must be in Test Setup, not Suite Setup, because of a known problem
20+
# with QEMU: https://github.com/Dasharo/open-source-firmware-validation/issues/132
21+
Test Setup Run Keyword If ${TESTS_IN_FIRMWARE_SUPPORT}
22+
... Restore Initial DUT Connection Method
23+
24+
25+
*** Variables ***
26+
${SET_SV_BOOT_PROVISIONED_CMD}= setvar SvBootConfig -guid B57031B9-1ABB-45F8-A9CB-AC5AAD72AD31 -bs -nv \=0101
27+
28+
29+
*** Test Cases ***
30+
SVB001.001 Sovereign Boot Wizard shows up on first boot
31+
[Documentation] This test aims to verify that wizard is launched on
32+
... first boot.
33+
Skip If not ${TESTS_IN_FIRMWARE_SUPPORT} SVB001.001 not supported
34+
Power On
35+
${out}= Read From Terminal Until Sovereign Boot Provisioning Wizard
36+
Should Not Contain ${out} ${TIANOCORE_STRING}
37+
38+
SVB001.002 Sovereign Boot Wizard shows up after settings reset
39+
[Documentation] This test aims to verify that wizard is launched after
40+
... settings reset.
41+
Skip If not ${TESTS_IN_FIRMWARE_SUPPORT} SVB001.002 not supported
42+
Power On
43+
Read From Terminal Until Sovereign Boot Provisioning Wizard
44+
Read From Terminal Until restored default system settings.
45+
${menu}= Get Menu Construction Esc=Exit 0 1
46+
# Read the remaining part of the menu
47+
Read From Terminal
48+
# We should check if [Exit] exists, but the menu is so small, that it has to be scrolled
49+
Press Key N Times 1 ${ESC}
50+
# Pressing ESC will get us to setup
51+
${menu}= Get Setup Menu Construction
52+
# Boot to Shell and emulate provisioned state. Will be removed in later phases of the project
53+
Enter UEFI Shell From Setup ${menu}
54+
Execute UEFI Shell Command ${SET_SV_BOOT_PROVISIONED_CMD}
55+
# Reset the system
56+
Tianocore Reset System
57+
# From now on we can use generic keywords
58+
Enter Setup Menu Tianocore
59+
Reset To Defaults Tianocore
60+
Save Changes And Reset
61+
${out}= Read From Terminal Until Sovereign Boot Provisioning Wizard
62+
63+
SVB001.003 Sovereign Boot Wizard shows up after first boot option verification fails
64+
[Documentation] This test aims to verify that wizard is launched after
65+
... settings reset.
66+
Skip If not ${TESTS_IN_FIRMWARE_SUPPORT} SVB001.003 not supported
67+
# FIXME: doesn't work on QEMU, start QEMU with DTS already mounted!
68+
# Mount USB Disk Image ${TEST_DATA_DIR}/dts/dts-base-image-v2.1.3.wic
69+
Power On
70+
Read From Terminal Until Sovereign Boot Provisioning Wizard
71+
Read From Terminal Until restored default system settings.
72+
${menu}= Get Menu Construction Esc=Exit 0 1
73+
# Read the remaining part of the menu
74+
Read From Terminal
75+
# We should check if [Exit] exists, but the menu is so small, that it has to be scrolled
76+
Press Key N Times 1 ${ESC}
77+
# Pressing ESC will get us to setup
78+
${menu}= Get Setup Menu Construction
79+
# Boot to Shell and emulate provisioned state. Will be removed in later phases of the project
80+
Enter UEFI Shell From Setup ${menu}
81+
Execute UEFI Shell Command ${SET_SV_BOOT_PROVISIONED_CMD}
82+
# Reset the system
83+
Tianocore Reset System
84+
${sb_menu}= Enter Secure Boot Menu And Return Construction
85+
Enable Secure Boot ${sb_menu}
86+
# Save Changes And Reset
87+
# Changes to Secure Boot menu takes action immediately, so we can just reset
88+
Tianocore Reset System
89+
# Now the DTS should fail to boot
90+
# TODO: Ensure the veri first boot option is really unsigned. On real HW it may need to set
91+
# DTS as first boot option beforehand.
92+
Read From Terminal Until Sovereign Boot Provisioning Wizard
93+
Read From Terminal Until boot an untrusted image.
94+
${menu}= Get Menu Construction Esc=Exit 0 1
95+
# Read the remaining part of the menu
96+
Read From Terminal
97+
Press Key N Times 1 ${ESC}
98+
# UEFI Boot Manager should print information about Secure Boot status and image verification status
99+
Read From Terminal Until Secure Boot is enabled.
100+
Read From Terminal Until The image signature is invalid or missing!
101+
102+
SVB002.001 Sovereign Boot Wizard disable option works
103+
[Documentation] This test aims to verify that wizard disable option works.
104+
Skip If not ${TESTS_IN_FIRMWARE_SUPPORT} SVB002.001 not supported
105+
Power On
106+
# Sovereign Boot should be provisioend at this point, use generic keyword.
107+
${sb_menu}= Enter Secure Boot Menu And Return Construction
108+
# Remove line that is not an option
109+
${sv_index}= Get Index From List ${sb_menu} *** Sovereign Boot Options ***
110+
Remove From List ${sb_menu} ${sv_index}
111+
${changed}= Set Option State ${sb_menu} Enable Sovereign Boot ${FALSE}
112+
IF ${changed} == ${TRUE}
113+
# Changing Sovereign Boot state to disabled issues a special popup
114+
Read From Terminal Until Disabling Sovereign Boot will restore default Secure Boot Keys & databases.
115+
Read From Terminal Until Are you sure?
116+
# Confirm the choice
117+
Press Enter
118+
# Wait until the popup disappears
119+
Get Secure Boot Menu Construction
120+
ELSE
121+
Fail "Sovereign Boot should be enabled at this point"
122+
END
123+
Tianocore Reset System
124+
# We should be able to boot straight to setup with prompts when wizard is disabled
125+
${sb_menu}= Enter Secure Boot Menu And Return Construction
126+
${sv_index}= Get Index From List ${sb_menu} *** Sovereign Boot Options ***
127+
Remove From List ${sb_menu} ${sv_index}
128+
List Should Not Contain Value ${sb_menu} > Launch Sovereign Boot Wizard
129+
${changed}= Set Option State ${sb_menu} Enable Sovereign Boot ${FALSE}
130+
Should Not Be True ${changed}
131+
132+
SVB002.002 Sovereign Boot Wizard enable option works
133+
[Documentation] This test aims to verify that wizard enable option works.
134+
Skip If not ${TESTS_IN_FIRMWARE_SUPPORT} SVB002.002 not supported
135+
Power On
136+
${sb_menu}= Enter Secure Boot Menu And Return Construction
137+
# Remove line that is not an option
138+
${sv_index}= Get Index From List ${sb_menu} *** Sovereign Boot Options ***
139+
Remove From List ${sb_menu} ${sv_index}
140+
${changed}= Set Option State ${sb_menu} Enable Sovereign Boot ${TRUE}
141+
IF ${changed} == ${TRUE}
142+
# Changing Sovereign Boot state to enabled takes action immediately
143+
Tianocore Reset System
144+
ELSE
145+
Fail "Sovereign Boot should be disabled at this point"
146+
END
147+
# Sovereign boot welcome string should appear again
148+
Read From Terminal Until Sovereign Boot Provisioning Wizard
149+
Read From Terminal Until restored default system settings.
150+
${menu}= Get Menu Construction Esc=Exit 0 1
151+
# Read the remaining part of the menu
152+
Read From Terminal
153+
# We should check if [Exit] exists, but the menu is so small, that it has to be scrolled
154+
Press Key N Times 1 ${ESC}
155+
# Pressing ESC will get us to setup
156+
${menu}= Get Setup Menu Construction
157+
${sb_menu}= Enter Secure Boot Menu From Setup ${menu}
158+
List Should Contain Value ${sb_menu} > Launch Sovereign Boot Wizard
159+
160+
SVB003.001 Sovereign Boot Wizard parses boot options correctly
161+
Skip If not ${TESTS_IN_FIRMWARE_SUPPORT} SVB003.001 not supported
162+
Power On
163+
Read From Terminal Until Sovereign Boot Provisioning Wizard
164+
Read From Terminal Until scheme you would like to use:
165+
${menu}= Get Menu Construction Esc=Exit 0 1
166+
# No default selection here, just one press to go to SOvereign Boot configuration view
167+
Press Key N Times And Enter 1 ${ARROW_DOWN}
168+
Read From Terminal Until A new bootloader/key has been detected.
169+
${out}= Read From Terminal Until Esc=Exit
170+
# TODO: check the Bootorder and Boot#### variables to get a list of expected boot options
171+
Should Contain ${out} Description: Dasharo Tools Suite (on QEMU HARDDISK)
172+
Should Contain ${out} File path: \\EFI\\DTS\\grubx64.efi
173+
# Press Enter to do not trust the key and move to the next bootloader
174+
Press Enter
175+
${out}= Read From Terminal Until Esc=Exit
176+
Should Contain ${out} Description: QEMU HARDDISK
177+
Should Contain ${out} File path: \\EFI\\BOOT\\BOOTX64.EFI
178+
# Now there should be no more bootloaders found
179+
Press Enter
180+
Read From Terminal Until No more bootloaders found.
181+
Read From Terminal Until Press ENTER to continue ...
182+
Press Enter
183+
# Remove it later once the proper flow is implemented
184+
Read From Terminal Until Sovereign Boot is already provisioned.
185+
186+
187+
*** Keywords ***
188+
Enter UEFI Shell From Setup
189+
[Arguments] ${setup_menu}
190+
${boot_menu}= Enter Submenu From Snapshot And Return Construction ${setup_menu} One Time Boot
191+
Set Prompt For Terminal Shell>
192+
Enter Submenu From Snapshot ${boot_menu} UEFI Shell
193+
Read From Terminal Until Prompt
194+
Sleep 1s
195+
196+
Enter Secure Boot Menu From Setup
197+
[Arguments] ${setup_menu}
198+
${device_mgr_menu}= Enter Submenu From Snapshot And Return Construction
199+
... ${setup_menu}
200+
... Device Manager
201+
Enter Submenu From Snapshot ${device_mgr_menu} Secure Boot Configuration
202+
${sb_menu}= Get Secure Boot Menu Construction
203+
RETURN ${sb_menu}

‎platform-configs/include/default.robot

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -199,6 +199,7 @@ ${UEFI_PASSWORD_SUPPORT}= ${FALSE}
199199
${HAS_SUPERIO_SERIAL}= ${FALSE}
200200
${INTEL_CBNT_SUPPORT}= ${FALSE}
201201
${INTEL_CBNT_STATUS_MENU_SUPPORT}= ${FALSE}
202+
${SOVEREIGN_BOOT_SUPPORT}= ${FALSE}
202203

203204
# Test module: dasharo-performance
204205
${SERIAL_BOOT_MEASURE}= ${FALSE}

‎platform-configs/qemu.robot

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,9 @@ ${AUTO_BOOT_TIME_OUT_DEFAULT_VALUE}= 0
8383
# Test module: dasharo-stability
8484
${CAPSULE_UPDATE_SUPPORT}= ${TRUE}
8585

86+
# Test module: dasharo-security
87+
${SOVEREIGN_BOOT_SUPPORT}= ${TRUE}
88+
8689

8790
*** Keywords ***
8891
Power On

0 commit comments

Comments
 (0)