Skip to content

Commit 1f83eb7

Browse files
miczyg1macpijan
miczyg1
authored and
macpijan
committed
dasharo-security/sovereign-boot.robot: Add Sovereign Boot tests for phase 1
Signed-off-by: Michał Żygowski <[email protected]>
1 parent 6ae8420 commit 1f83eb7

File tree

2 files changed

+204
-0
lines changed

2 files changed

+204
-0
lines changed

‎dasharo-security/sovereign-boot.robot‎

Lines changed: 201 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,201 @@
1+
*** Settings ***
2+
Library Collections
3+
Library Dialogs
4+
Library OperatingSystem
5+
Library Process
6+
Library String
7+
Library Telnet timeout=20 seconds connection_timeout=120 seconds
8+
Library SSHLibrary timeout=90 seconds
9+
Library RequestsLibrary
10+
Resource ../keywords.robot
11+
Resource ../keys.robot
12+
Resource ../variables.robot
13+
14+
Suite Setup Run Keywords
15+
... Prepare Test Suite
16+
... AND
17+
... Skip If not ${SOVEREIGN_BOOT_SUPPORT} Sovereign Boot tests not supported
18+
Suite Teardown Run Keyword
19+
... Log Out And Close Connection
20+
# This must be in Test Setup, not Suite Setup, because of a known problem
21+
# with QEMU: https://github.com/Dasharo/open-source-firmware-validation/issues/132
22+
Test Setup Run Keyword If ${TESTS_IN_FIRMWARE_SUPPORT}
23+
... Restore Initial DUT Connection Method
24+
25+
26+
*** Variables ***
27+
${SET_SV_BOOT_PROVISIONED_CMD}= setvar SvBootConfig -guid B57031B9-1ABB-45F8-A9CB-AC5AAD72AD31 -bs -nv \=0101
28+
29+
30+
*** Test Cases ***
31+
SVB001.001 Sovereign Boot Wizard shows up on first boot
32+
[Documentation] This test aims to verify that wizard is launched on
33+
... first boot.
34+
Skip If not ${TESTS_IN_FIRMWARE_SUPPORT} SVB001.001 not supported
35+
Power On
36+
${out}= Read From Terminal Until Sovereign Boot Provisioning Wizard
37+
Should Not Contain ${out} ${TIANOCORE_STRING}
38+
39+
SVB001.002 Sovereign Boot Wizard shows up after settings reset
40+
[Documentation] This test aims to verify that wizard is launched after
41+
... settings reset.
42+
Skip If not ${TESTS_IN_FIRMWARE_SUPPORT} SVB001.002 not supported
43+
Power On
44+
Read From Terminal Until Sovereign Boot Provisioning Wizard
45+
Read From Terminal Until restored default system settings.
46+
${menu}= Get Menu Construction Esc=Exit 0 1
47+
# Read the remaining part of the menu
48+
Read From Terminal
49+
# We should check if [Exit] exists, but the menu is so small, that it has to be scrolled
50+
Press Key N Times 1 ${ESC}
51+
# Pressing ESC will get us to setup
52+
${menu}= Get Setup Menu Construction
53+
# Boot to Shell and emulate provisioned state. Will be removed in later phases of the project
54+
Enter UEFI Shell From Setup ${menu}
55+
Execute UEFI Shell Command ${SET_SV_BOOT_PROVISIONED_CMD}
56+
# Reset the system
57+
Tianocore Reset System
58+
# From now on we can use generic keywords
59+
Enter Setup Menu Tianocore
60+
Reset To Defaults Tianocore
61+
Save Changes And Reset
62+
${out}= Read From Terminal Until Sovereign Boot Provisioning Wizard
63+
64+
SVB001.003 Sovereign Boot Wizard shows up after first boot option verification fails
65+
[Documentation] This test aims to verify that wizard is launched after
66+
... settings reset.
67+
Skip If not ${TESTS_IN_FIRMWARE_SUPPORT} SVB001.002 not supported
68+
# FIXME: doesn't work on QEMU, start QEMU with DTS already mounted!
69+
# Mount USB Disk Image ${TEST_DATA_DIR}/dts/dts-base-image-v2.1.3.wic
70+
Power On
71+
Read From Terminal Until Sovereign Boot Provisioning Wizard
72+
Read From Terminal Until restored default system settings.
73+
${menu}= Get Menu Construction Esc=Exit 0 1
74+
# Read the remaining part of the menu
75+
Read From Terminal
76+
# We should check if [Exit] exists, but the menu is so small, that it has to be scrolled
77+
Press Key N Times 1 ${ESC}
78+
# Pressing ESC will get us to setup
79+
${menu}= Get Setup Menu Construction
80+
# Boot to Shell and emulate provisioned state. Will be removed in later phases of the project
81+
Enter UEFI Shell From Setup ${menu}
82+
Execute UEFI Shell Command ${SET_SV_BOOT_PROVISIONED_CMD}
83+
# Reset the system
84+
Tianocore Reset System
85+
${sb_menu}= Enter Secure Boot Menu And Return Construction
86+
Enable Secure Boot ${sb_menu}
87+
# Save Changes And Reset
88+
# Changes to Secure Boot menu takes action immediately, so we can just reset
89+
Tianocore Reset System
90+
# Now the DTS should fail to boot
91+
# TODO: Ensure the veri first boot option is really unsigned. On real HW it may need to set
92+
# DTS as first boot option beforehand.
93+
Read From Terminal Until Sovereign Boot Provisioning Wizard
94+
Read From Terminal Until boot an untrusted image.
95+
${menu}= Get Menu Construction Esc=Exit 0 1
96+
# Read the remaining part of the menu
97+
Read From Terminal
98+
Press Key N Times 1 ${ESC}
99+
# UEFI Boot Manager should print information about Secure Boot status and image verification status
100+
Read From Terminal Until Secure Boot is enabled.
101+
Read From Terminal Until The image signature is invalid or missing!
102+
103+
SVB002.001 Sovereign Boot Wizard disable option works
104+
[Documentation] This test aims to verify that wizard disable option works.
105+
Power On
106+
# Sovereign Boot should be provisioend at this point, use generic keyword.
107+
${sb_menu}= Enter Secure Boot Menu And Return Construction
108+
# Remove line that is not an option
109+
${sv_index}= Get Index From List ${sb_menu} *** Sovereign Boot Options ***
110+
Remove From List ${sb_menu} ${sv_index}
111+
${changed}= Set Option State ${sb_menu} Enable Sovereign Boot ${FALSE}
112+
IF ${changed} == ${TRUE}
113+
# Changing Sovereign Boot state to disabled issues a special popup
114+
Read From Terminal Until Disabling Sovereign Boot will restore default Secure Boot Keys & databases.
115+
Read From Terminal Until Are you sure?
116+
# Confirm the choice
117+
Press Enter
118+
# Wait until the popup disappears
119+
Get Secure Boot Menu Construction
120+
ELSE
121+
Fail "Sovereign Boot should be enabled at this point"
122+
END
123+
Tianocore Reset System
124+
# We should be able to boot straight to setup with prompts when wizard is disabled
125+
${sb_menu}= Enter Secure Boot Menu And Return Construction
126+
${sv_index}= Get Index From List ${sb_menu} *** Sovereign Boot Options ***
127+
Remove From List ${sb_menu} ${sv_index}
128+
List Should Not Contain Value ${sb_menu} > Launch Sovereign Boot Wizard
129+
${changed}= Set Option State ${sb_menu} Enable Sovereign Boot ${FALSE}
130+
Should Not Be True ${changed}
131+
132+
SVB002.002 Sovereign Boot Wizard enable option works
133+
[Documentation] This test aims to verify that wizard enable option works.
134+
Power On
135+
${sb_menu}= Enter Secure Boot Menu And Return Construction
136+
# Remove line that is not an option
137+
${sv_index}= Get Index From List ${sb_menu} *** Sovereign Boot Options ***
138+
Remove From List ${sb_menu} ${sv_index}
139+
${changed}= Set Option State ${sb_menu} Enable Sovereign Boot ${TRUE}
140+
IF ${changed} == ${TRUE}
141+
# Changing Sovereign Boot state to enabled takes action immediately
142+
Tianocore Reset System
143+
ELSE
144+
Fail "Sovereign Boot should be disabled at this point"
145+
END
146+
# Sovereign boot welcome string should appear again
147+
Read From Terminal Until Sovereign Boot Provisioning Wizard
148+
Read From Terminal Until restored default system settings.
149+
${menu}= Get Menu Construction Esc=Exit 0 1
150+
# Read the remaining part of the menu
151+
Read From Terminal
152+
# We should check if [Exit] exists, but the menu is so small, that it has to be scrolled
153+
Press Key N Times 1 ${ESC}
154+
# Pressing ESC will get us to setup
155+
${menu}= Get Setup Menu Construction
156+
${sb_menu}= Enter Secure Boot Menu From Setup ${menu}
157+
List Should Contain Value ${sb_menu} > Launch Sovereign Boot Wizard
158+
159+
SVB003.001 Sovereign Boot Wizard parses boot options correctly
160+
Power On
161+
Read From Terminal Until Sovereign Boot Provisioning Wizard
162+
Read From Terminal Until scheme you would like to use:
163+
${menu}= Get Menu Construction Esc=Exit 0 1
164+
# No default selection here, just one press to go to SOvereign Boot configuration view
165+
Press Key N Times And Enter 1 ${ARROW_DOWN}
166+
Read From Terminal Until A new bootloader/key has been detected.
167+
${out}= Read From Terminal Until Esc=Exit
168+
# TODO: check the Bootorder and Boot#### variables to get a list of expected boot options
169+
Should Contain ${out} Description: Dasharo Tools Suite (on QEMU HARDDISK)
170+
Should Contain ${out} File path: \\EFI\\DTS\\grubx64.efi
171+
# Press Enter to do not trust the key and move to the next bootloader
172+
Press Enter
173+
${out}= Read From Terminal Until Esc=Exit
174+
Should Contain ${out} Description: QEMU HARDDISK
175+
Should Contain ${out} File path: \\EFI\\BOOT\\BOOTX64.EFI
176+
# Now there should be no more bootloaders found
177+
Press Enter
178+
Read From Terminal Until No more bootloaders found.
179+
Read From Terminal Until Press ENTER to continue ...
180+
Press Enter
181+
# Remove it later once the proper flow is implemented
182+
Read From Terminal Until Sovereign Boot is already provisioned.
183+
184+
185+
*** Keywords ***
186+
Enter UEFI Shell From Setup
187+
[Arguments] ${setup_menu}
188+
${boot_menu}= Enter Submenu From Snapshot And Return Construction ${setup_menu} One Time Boot
189+
Set Prompt For Terminal Shell>
190+
Enter Submenu From Snapshot ${boot_menu} UEFI Shell
191+
Read From Terminal Until Prompt
192+
Sleep 1s
193+
194+
Enter Secure Boot Menu From Setup
195+
[Arguments] ${setup_menu}
196+
${device_mgr_menu}= Enter Submenu From Snapshot And Return Construction
197+
... ${setup_menu}
198+
... Device Manager
199+
Enter Submenu From Snapshot ${device_mgr_menu} Secure Boot Configuration
200+
${sb_menu}= Get Secure Boot Menu Construction
201+
RETURN ${sb_menu}

‎platform-configs/qemu.robot‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,9 @@ ${AUTO_BOOT_TIME_OUT_DEFAULT_VALUE}= 0
8383
# Test module: dasharo-stability
8484
${CAPSULE_UPDATE_SUPPORT}= ${TRUE}
8585

86+
# Test module: dasharo-security
87+
${SOVEREIGN_BOOT_SUPPORT}= ${TRUE}
88+
8689

8790
*** Keywords ***
8891
Power On

0 commit comments

Comments
 (0)