commit fc146c47a0531024b4aef4ba0302d7bf6c64e376
author Manish V Badarkhe <Manish.Badarkhe@arm.com> Wed Nov 24 15:34:00 2021 +0000
committer Zelalem Aweke <zelalem.aweke@arm.com> Fri Dec 10 23:02:51 2021 +0100
tree 9f0e55d535772d8726f3f437558f8352d4633efc
parent b8a40b979886e42ea82266a72168a10cdd72d185

ci(measured_boot): update expect script to check non-zero PCR1 value

Updated expect script to check the non-zero value of PCR1 as it contains
the measurement of critical data.

Change-Id: I03c52fddb9e7caf7e8009d7b7524ba5a20c2e1ca
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>

expect/linux-tpm.exp

diff --git a/expect/linux-tpm.exp b/expect/linux-tpm.exp
index 9d137e8..de34988 100644
--- a/expect/linux-tpm.exp
+++ b/expect/linux-tpm.exp
@@ -15,6 +15,7 @@
 
 # regexp for non-zero PCR0
 set non_zero_pcr "(?!(\\s00){16})((\\s(\[0-9a-f\]){2}){16}\\s)"
+set zero_pcr "(\\s00){16}\\s+(00\\s){16}"
 
 expect {
         # Parse the event log from the debug logs and store the digests
@@ -64,6 +65,23 @@
                 exp_continue
         }
 
+        "#" {
+                # get PCR1 value
+                send "pcrread -ha 1\n"
+        }
+
+        timeout {
+                exit_timeout
+        }
+}
+
+expect {
+        # Pass condition: PCR1 must not be all zeros.
+
+        -re $non_zero_pcr {
+                exp_continue
+        }
+
         "#" { }
 
         timeout {
@@ -72,11 +90,11 @@
 }
 
 # Iterate over the rest of PCRs and check that they all are zeros.
-for {set i 1} {$i < 11} {incr i} {
+for {set i 2} {$i < 11} {incr i} {
         send "pcrread -ha $i\n"
 
         expect {
-                -re "(\\s00){16}\\s+(00\\s){16}" { }
+                -re $zero_pcr { }
 
                 -re $non_zero_pcr {
                         exit_uart -1

lava-expect/linux-tpm-384.exp

diff --git a/lava-expect/linux-tpm-384.exp b/lava-expect/linux-tpm-384.exp
index 16eab17..fd92838 100644
--- a/lava-expect/linux-tpm-384.exp
+++ b/lava-expect/linux-tpm-384.exp
@@ -4,8 +4,8 @@
 # SPDX-License-Identifier: BSD-3-Clause
 #
 # Expect script for Linux/Buildroot using Measured Boot & fTPM
-# It is a copy of linux-tpm.exp which doesn't check PCR0 value,
-# as that doesn't apply to this config
+# It is a copy of linux-tpm.exp which doesn't check PCR0,PCR1
+# value, as that doesn't apply to this config
 #
 
 # Parse the event log from the debug logs and store the digests
@@ -22,7 +22,7 @@
 
 # Iterate over the rest of PCRs and check that they all are zeros.
 zero_pcr="(\s00){16}\s+(00\s){16}"
-for i in $(seq 1 11); do
+for i in $(seq 2 11); do
     expect_string+=("i;#")
     expect_string+=("i;${zero_pcr};;;pcrread -ha $i")
 done

lava-expect/linux-tpm.exp

diff --git a/lava-expect/linux-tpm.exp b/lava-expect/linux-tpm.exp
index 54e026f..fb02652 100644
--- a/lava-expect/linux-tpm.exp
+++ b/lava-expect/linux-tpm.exp
@@ -17,14 +17,15 @@
 expect_string+=("i;buildroot login:")
 
 # Login then load the fTPM driver and retrieves PCR0
-# Pass condition: PCR0 must not be all zeros.
+# Pass condition: PCR0 and PCR1 must not be all zeros.
 expect_string+=("i;#;;;root")
 expect_string+=("i;${non_zero_pcr};;;ftpm")
+expect_string+=("i;#")
+expect_string+=("i;${non_zero_pcr};;;pcrread -ha 1")
 
 # Iterate over the rest of PCRs and check that they all are zeros.
 zero_pcr="(\s00){16}\s+(00\s){16}"
-for i in $(seq 1 11); do
+for i in $(seq 2 11); do
     expect_string+=("i;#")
     expect_string+=("i;${zero_pcr};;;pcrread -ha $i")
 done
-