Skip to content

Commit 32b1f94

Browse files
philipandaphilipanda
committed
coreboot-redundant-boot: Add slot A protection test
Signed-off-by: Filip Gołaś <[email protected]>
1 parent b0ecd0e commit 32b1f94

File tree

3 files changed

+99
-5
lines changed

3 files changed

+99
-5
lines changed

‎dasharo-stability/coreboot-redundant-boot.robot‎

Lines changed: 94 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,18 +5,19 @@ Library String
55
Resource ../variables.robot
66
Resource ../keywords.robot
77

8-
Suite Setup Run Keyword
8+
Suite Setup Run Keywords
99
... Prepare Test Suite
10+
... AND Skip If not ${COREBOOT_REDUNDANT_BOOT_SUPPORT}
1011
Suite Teardown Run Keyword
1112
... Log Out And Close Connection
1213

1314
Default Tags automated
1415

1516

1617
*** Variables ***
17-
${NVRAM_ATTEMPT_B_FLAG}= attempt_slot_b # TBD
18-
${NVRAM_ATTEMPT_B_FLAG_SET}= Enable # TBD
19-
${NVRAM_ATTEMPT_B_FLAG_CLR}= Disable # TBD
18+
${NVRAM_ATTEMPT_B_FLAG}= attempt_slot_b
19+
${NVRAM_ATTEMPT_B_FLAG_SET}= Enable
20+
${NVRAM_ATTEMPT_B_FLAG_CLR}= Disable
2021

2122

2223
*** Test Cases ***
@@ -76,8 +77,71 @@ CRB003.201 Boot Slot A After Clearing Attempt Slot B Flag (Ubuntu)
7677
Switch To Root User
7778
Should Have Booted From Slot COREBOOT
7879

80+
CRB004.201 Slot A Protection (Ubuntu)
81+
[Documentation] Check if the coreboot Slot A is protected with the
82+
... redundant boot feature turned on.
83+
Skip If ${COREBOOT_REDUNDANT_BOOT_BOOTBLOCK_OFFSET} is ${None} ${COREBOOT_REDUNDANT_BOOT_BOOTBLOCK_OFFSET} not defined, skipping test
84+
Power On
85+
Boot System Or From Connected Disk ${ENV_ID_UBUNTU}
86+
Login To Linux
87+
Switch To Root User
88+
Set Attempt Slot B Flag ${TRUE}
89+
Execute Reboot Command
90+
91+
Boot System Or From Connected Disk ${ENV_ID_UBUNTU}
92+
Login To Linux
93+
Switch To Root User
94+
95+
Verify Region Range Protected # BOOTBLOCK
96+
... BIOS
97+
... ${COREBOOT_REDUNDANT_BOOT_BOOTBLOCK_OFFSET.start}
98+
... ${COREBOOT_REDUNDANT_BOOT_BOOTBLOCK_OFFSET.end}
99+
100+
Verify Region Range Protected # COREBOOT
101+
... BIOS
102+
... ${COREBOOT_REDUNDANT_BOOT_COREBOOT_OFFSET.start}
103+
... ${COREBOOT_REDUNDANT_BOOT_COREBOOT_OFFSET.end}
104+
79105

80106
*** Keywords ***
107+
Verify Region Range Protected
108+
[Arguments] ${region_name} ${expected_start} ${expected_end}
109+
${readonly_regions}= Get Flashrom Readonly Offsets
110+
IF len(${readonly_regions}) == 0
111+
Fail No readonly regions found in flashrom output
112+
END
113+
114+
${expected_readonly_bootblock}= Calculate Expected Flashrom Readonly Region
115+
... region_name=${region_name}
116+
... start_offset=${expected_start}
117+
... end_offset=${expected_end}
118+
119+
VAR ${expected_readonly_found}= ${FALSE}
120+
FOR ${region} IN @{readonly_regions}
121+
Log To Console Found readonly region: ${region}
122+
Log To Console Expected readonly region: ${expected_readonly_bootblock}
123+
${start_matches}= Evaluate int(${region['start']}) == int(${expected_readonly_bootblock['start']})
124+
${end_matches}= Evaluate int(${region['end']}) == int(${expected_readonly_bootblock['end']})
125+
IF ${start_matches} and ${end_matches}
126+
VAR ${expected_readonly_found}= ${TRUE}
127+
BREAK
128+
END
129+
END
130+
IF not ${expected_readonly_found}
131+
Fail Expected readonly region ${expected_readonly_bootblock} not found in flashrom output
132+
END
133+
134+
Calculate Expected Flashrom Readonly Region
135+
[Arguments] ${region_name} ${start_offset} ${end_offset}
136+
${flashrom_regions}= Get Flashrom Regions
137+
${bios_start}= Get From Dictionary ${flashrom_regions['${region_name}']} start
138+
${bios_end}= Get From Dictionary ${flashrom_regions['${region_name}']} end
139+
${expected_readonly_start}= Evaluate hex(${bios_start} + ${COREBOOT_REDUNDANT_BOOT_BOOTBLOCK_OFFSET.start})
140+
${expected_readonly_end}= Evaluate hex(${bios_start} + ${COREBOOT_REDUNDANT_BOOT_BOOTBLOCK_OFFSET.end})
141+
${expected_readonly}= Create Dictionary start=${expected_readonly_start} end=${expected_readonly_end}
142+
RETURN ${expected_readonly}
143+
144+
81145
Set Attempt Slot B Flag
82146
[Arguments] ${state}=${TRUE}
83147
IF ${state}
@@ -93,8 +157,33 @@ Set Attempt Slot B Flag
93157
Should Have Booted From Slot
94158
[Arguments] ${slot}
95159
${slot}= Convert To Lower Case ${slot}
96-
# TBD - will this show slot B?
97160
${out}= Execute Command In Terminal cbmem -c | grep "Booting from"
98161
${out}= Convert To Lower Case ${out}
99162
${out}= Strip String ${out}
100163
Should Contain ${out} ${slot}
164+
165+
Get Flashrom Regions
166+
${output}= Execute Command In Terminal flashrom -p internal
167+
${lines}= Split To Lines ${output}
168+
${dict}= Create Dictionary
169+
FOR ${l} IN @{lines}
170+
${m}= Get Regexp Matches ${l} FREG[0-9]+: (.+) region \\((0x[0-9a-f]+)-(0x[0-9a-f]+)\\) is (.+) 1 2 3 4
171+
IF ${m} != []
172+
${region}= Create Dictionary start=${m[0][1]} end=${m[0][2]} state=${m[0][3]}
173+
Set To Dictionary ${dict} ${m[0][0]}=${region}
174+
END
175+
END
176+
RETURN ${dict}
177+
178+
Get Flashrom Readonly Offsets
179+
${output}= Execute Command In Terminal flashrom -p internal
180+
${lines}= Split To Lines ${output}
181+
${list}= Create List
182+
FOR ${l} IN @{lines}
183+
${m}= Get Regexp Matches ${l} Warning: (0x[0-9a-f]+)-(0x[0-9a-f]+) is read-only 1 2
184+
IF ${m} != []
185+
${region}= Create Dictionary start=${m[0][0]} end=${m[0][1]}
186+
Append To List ${list} ${region}
187+
END
188+
END
189+
RETURN ${list}

‎platform-configs/include/default.robot‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -199,6 +199,8 @@ ${POWERSHELL_STR_INTERNAL_IN}= Microphone Array (Realtek(R)
199199
${POWERSHELL_STR_HEADSET_OUT}= ${POWERSHELL_STR_INTERNAL_OUT}
200200
${POWERSHELL_STR_HEADSET_IN}= Microphone (Realtek(R) Audio)
201201
${POWERSHELL_STR_HDMI_OUT}= Audio Driver for Display Audio
202+
${COREBOOT_REDUNDANT_BOOT_SUPPORT}= ${FALSE}
203+
${COREBOOT_REDUNDANT_BOOT_BOOTBLOCK_OFFSET}= ${NONE}
202204

203205
# Test module: dasharo-security
204206
${TPM_SUPPORTED_VERSION}= ${NONE}

‎platform-configs/protectli-vp6650.robot‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,9 @@ ${SATA_SUPPORT}= ${True}
3939
${TESTS_IN_XCP_NG_SUPPORT}= ${True}
4040
@{TESTED_LINUX_DISTROS}= ${ENV_ID_UBUNTU} ${ENV_ID_XCP_NG}
4141

42+
# TODO - define in platform configs depending on platforms fmap
43+
${COREBOOT_REDUNDANT_BOOT_BOOTBLOCK_OFFSET}= ${None}
44+
${COREBOOT_REDUNDANT_BOOT_COREBOOT_OFFSET}= ${None}
4245

4346
*** Keywords ***
4447
Power On

0 commit comments

Comments
 (0)