https://docs.firmware-ci.com/references/2_commands/bios-operations/index.htmlBIOS/UEFI configuration and management commands. BIOS Certificate BIOS Settings Get BIOS Settings Set SecureBoot Management Expecting a failure Several of these commands take a should_fail flag. It asserts that the target refused the operation, which is how you test that firmware rejects a signature it should not accept. Only the target can satisfy it. If the step never reaches the target the step fails, whatever should_fail says:Hugoen-ushttps://docs.firmware-ci.com/references/2_commands/bios-operations/bios-certificate-management/index.htmlMon, 01 Jan 0001 00:00:00 +0000https://docs.firmware-ci.com/references/2_commands/bios-operations/bios-certificate-management/index.htmlCheck BIOS Options on the DUT. The DUT must be a Lenovo system with the Linux think-lmi driver loaded, and needs sudo. Attribute Type Required Default Description cmd const Yes bios certificate management Command Name name string Yes Name to uniquely identify the teststep. This name will show up in reports, logs and the WebUI transport TransportObject Yes Additional transport options options OptionsObject No Additional command options parameters BIOS Certificate Options Yes Options passed into BIOS Certificate BIOS Certificate Options Attribute Type Required Default Description password string Either of* BIOS Password old_password string Either of* Old BIOS Password cert_path string Either of* BIOS Certificate key_path string Either of* BIOS Certificate Private Key serial string Either of* Serial number of device expect BIOS Certificate Expect Options No Array of expected BIOS Certificate Options BIOS Certificate Expect Options Attribute Type Required Default Description should_fail bool No false Expect the firmware to refuse the operation. See Expecting a failure. BIOS Certificate Example - cmd: bios certificate management name: Enable certificate transport: *transport parameters: command: enable password: mypassword cert_path: /root/default-tools/system-suite/4k/new/cert.pem - cmd: bios certificate management name: Check certificate thumbprint transport: *transport parameters: command: check cert_path: /root/default-tools/system-suite/4k/new/cert.pem - cmd: bios certificate management name: Disable certificate transport: *transport parameters: command: disable key_path: /root/default-tools/system-suite/4k/new/key.pem password: mypassword - cmd: bios certificate management name: Clear certificate transport: *transport parameters: command: clear key_path: /root/default-tools/system-suite/4k/new/key.pem - cmd: bios certificate management name: Update password transport: *transport parameters: command: set-password old_password: mypassword password: mynewpasswordhttps://docs.firmware-ci.com/references/2_commands/bios-operations/bios-get-setting/index.htmlMon, 01 Jan 0001 00:00:00 +0000https://docs.firmware-ci.com/references/2_commands/bios-operations/bios-get-setting/index.htmlCheck BIOS Options on the DUT. The DUT must be a Lenovo system with the Linux think-lmi driver loaded, and needs sudo. Attribute Type Required Default Description cmd const Yes get bios setting Command Name name string Yes Name to uniquely identify the teststep. This name will show up in reports, logs and the WebUI transport TransportObject Yes Additional transport options options OptionsObject No Additional command options parameters BIOS Settings Get Options Yes Options passed into BIOS Settings Get BIOS Settings Get Options Attribute Type Required Default Description expect []BIOS Settings Get Expect Options Yes Array of expected BIOS Settings BIOS Settings Get Expect Options Attribute Type Required Default Description option string Yes BIOS Option value string Yes Expected Value (supports regex) BIOS Settings Get Example cmd: get bios setting name: "Check BIOS Settings" transport: *transport parameters: expect: - option: BootDisplayDevice value: LCD - option: BootMode value: Quick - option: BootOrderLock value: Disablehttps://docs.firmware-ci.com/references/2_commands/bios-operations/bios-set-setting/index.htmlMon, 01 Jan 0001 00:00:00 +0000https://docs.firmware-ci.com/references/2_commands/bios-operations/bios-set-setting/index.htmlTry to set BIOS Options on the DUT. The DUT must be a Lenovo system with the Linux think-lmi driver loaded, and needs sudo. Attribute Type Required Default Description cmd const Yes set bios setting Command Name name string Yes Name to uniquely identify the teststep. This name will show up in reports, logs and the WebUI transport TransportObject Yes Additional transport options options OptionsObject No Additional command options parameters BIOS Settings Set Options Yes Options passed into BIOS Settings Set BIOS Settings Set Options Attribute Type Required Default Description password string No BIOS Password key_path string No BIOS Cert Key bios_options []BIOS Options Yes Array of BIOS Options to set BIOS Options Attribute Type Required Default Description option string Yes BIOS Option value string Yes Value to set should_fail bool No false Expect the firmware to refuse this write. See Expecting a failure. BIOS Settings Set Example cmd: set bios setting name: "Set Target BIOS Settings" transport: *transport parameters: password: <bios-password> bios_options: - option: AlwaysOnUSB value: Disable - option: FingerprintPasswordAuthentication value: Disablehttps://docs.firmware-ci.com/references/2_commands/bios-operations/secureboot-management/index.htmlMon, 01 Jan 0001 00:00:00 +0000https://docs.firmware-ci.com/references/2_commands/bios-operations/secureboot-management/index.htmlRun different commands, based on sbctl on the DUT. The step copies sbctl from the runner to /root/default-tools/sbctl on the DUT over SFTP and runs it with sudo. The DUT needs sudo and an SSH server with SFTP, and the SSH user must be able to write to /root/default-tools. Attribute Type Required Default Description cmd const Yes secure boot management Command Name name string Yes Name to uniquely identify the teststep. This name will show up in reports, logs and the WebUI transport TransportObject Yes Additional transport options options OptionsObject No Additional command options parameters SecureBoot Options Yes Options passed into the Secure Boot Management cmd SecureBoot Options Attribute Type Required Default Description command string Yes Command to execute. Can be one of: status, enroll-key, rotate-key, reset, custom-key. hierarchy string Yes Hierarchy to use for the key. Can be one of: db, dbx, KEK, PK. key_file string No Path to the key file used for enroll-key and rotate-key commands. custom_key_file string No Path to the custom key file used for custom-key command. cert_file string No Path to the certificate file used for enroll-key and rotate-key commands. signing_key_file string No Path to the signing key file used for enroll-key and rotate-key commands. signing_cert_file string No Path to the signing certificate file used for enroll-key and rotate-key commands. append boolean No false Append the key to the existing key database. expect SecureBoot Expect Options No parameters Expectations for the command execution. SecureBoot Expect Options Attribute Type Required Default Description should_fail boolean No false Expect the target to refuse the operation. See Expecting a failure. secure_boot boolean Yes false If set to true, the test step will fail if Secure Boot is not enabled. setup_mode boolean Yes false If set to true, the test step will fail if Secure Boot is not in setup mode. SecureBoot Management Examples - cmd: secure boot management name: Check if SetupMode is enabled transport: *transport parameters: command: status expect: secure_boot: false setup_mode: true - cmd: secure boot management name: Enroll invalid signed PK key transport: *transport parameters: command: custom-key hierarchy: PK custom_key_file: /tmp/sbctl/keys/invalidPK.auth expect: should_fail: true - cmd: secure boot management name: Enroll db key transport: *transport parameters: command: enroll-key hierarchy: db key_file: /tmp/sbctl/keys/DB.key cert_file: /tmp/sbctl/keys/DB.crt signing_key_file: /tmp/sbctl/keys/KEK.key signing_cert_file: /tmp/sbctl/keys/KEK.crt append: true - cmd: secure boot management name: Rotate db key transport: *transport parameters: command: rotate-key hierarchy: db key_file: /tmp/sbctl/keys-new/DB.key cert_file: /tmp/sbctl/keys-new/DB.crt signing_key_file: /tmp/sbctl/keys/KEK.key signing_cert_file: /tmp/sbctl/keys/KEK.crt - cmd: secure boot management name: Reset db key transport: *transport parameters: command: reset hierarchy: db signing_key_file: /tmp/sbctl/keys/KEK.key signing_cert_file: /tmp/sbctl/keys/KEK.crt cert_file: /tmp/sbctl/keys/DB.crt