blob: 29fab35e343f5bed30a8dd777145b16d7256fc88 [file] [log] [blame]
# Copyright (c) 2011 The Chromium OS Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.
# Abort on error.
set -e
# Load common constants and variables.
. "$(dirname "$0")/"
# Given a kernel boot param string which includes"dmstuff"...
# this returns the dmstuff by itself.
get_dmparams() {
echo "$1" | sed 's/^.*\ dm="\([^"]*\)".*/\1/'
# Given a kernel boot param string which includes"stuff"...
# this returns the param string with the dm="..." section removed.
# Useful in conjunction with get_dmparams to divide and process
# the two sections of parameters in seperate passes
kparams_remove_dm() {
echo "$1" | sed 's/dm="[^"]*"//'
# Given a dm param string which includes a long and unpredictable
# sha1 hash, return the same string with the sha1 hash replaced
# with a magic placeholder. This same magic placeholder is used
# in the config file, for comparison purposes.
dmparams_mangle_sha1() {
echo "$1" | sed 's/sha1 [0-9a-fA-F]*/sha1 MAGIC_HASH/'
# This escapes any non-alphanum character, since many such characters
# are regex metacharacters.
escape_regexmetas() {
echo "$1" | sed 's/\([^a-zA-Z0-9]\)/\\\1/g'
usage() {
echo "Usage $PROG image [config]"
main() {
# We want to catch all the discrepancies, not just the first one.
# So, any time we find one, we set testfail=1 and continue.
# When finished we will use testfail to determine our exit value.
local testfail=0
if [[ $# -ne 1 ]] && [[ $# -ne 2 ]]; then
exit 1
local image="$1"
# Default config location: same name/directory as this script,
# with a .config file extension, ie ensure_secure_kernelparams.config.
local configfile="$(dirname "$0")/${0/}"
# Or, maybe a config was provided on the command line.
if [[ $# -eq 2 ]]; then
# Either way, load test-expectations data from config.
. "$configfile"
local kernelblob=$(make_temp_file)
extract_image_partition "$image" 2 "$kernelblob"
local rootfs=$(make_temp_dir)
mount_image_partition_ro "$image" 3 "$rootfs"
# Pick the right set of test-expectation data to use. The cuts
# turn e.g. x86-foo as a well as x86-foo-pvtkeys into x86_foo.
local board=$(grep CHROMEOS_RELEASE_BOARD= "$rootfs/etc/lsb-release" | \
cut -d = -f 2 | cut -d - -f 1,2 --output-delimiter=_)
eval "required_kparams=(\${required_kparams_$board[@]})"
eval "optional_kparams=(\${optional_kparams_$board[@]})"
eval "required_dmparams=\"\$required_dmparams_$board\""
# Divide the dm params from the rest and process seperately.
local kparams=$(dump_kernel_config "$kernelblob")
local dmparams=$(dmparams_mangle_sha1 "$(get_dmparams "$kparams")")
local kparams_nodm=$(kparams_remove_dm "$kparams")
# Special-case handling of the dm= param:
if [[ "$dmparams" != "$required_dmparams" ]]; then
echo "Kernel dm= parameter does not match expected value!"
echo "Expected: $required_dmparams"
echo "Actual: $dmparams"
# Ensure all other required params are present.
for param in ${required_kparams[@]}; do
if [[ "$kparams_nodm" != *$param* ]]; then
echo "Kernel parameters missing required value: $param"
# Remove matched params as we go. If all goes well, kparams_nodm
# will be nothing left but whitespace by the end.
param=$(escape_regexmetas "$param")
kparams_nodm=$(echo "$kparams_nodm" | sed "s/\b$param\b//")
# Check-off each of the allowed-but-optional params that were present.
for param in ${optional_kparams[@]}; do
param=$(escape_regexmetas "$param")
kparams_nodm=$(echo "$kparams_nodm" | sed "s/\b$param\b//")
# This section enforces the default-deny for any unexpected params
# not already processed by one of the above loops.
if [[ ! -z ${kparams_nodm// /} ]]; then
echo "Unexpected kernel parameters found: $kparams_nodm"
exit $testfail
main $@