Remaining unit tests for rollback_index.c

BUG=chromium-os:17564
TEST=make && make runtests

Change-Id: If2fbfb788bc3199603c8646e8f1c9e061199bc6f
Reviewed-on: http://gerrit.chromium.org/gerrit/6832
Reviewed-by: Bill Richardson <wfrichar@chromium.org>
Tested-by: Randall Spangler <rspangler@chromium.org>

3 files changed, 439 insertions, 40 deletions

diff --git a/firmware/lib/rollback_index.c b/firmware/lib/rollback_index.c
index 47579135..1d0f1d0f 100644
--- a/firmware/lib/rollback_index.c
+++ b/firmware/lib/rollback_index.c
@@ -12,6 +12,14 @@
 #include "utility.h"
 #include "vboot_api.h"
 
+#ifdef ROLLBACK_UNITTEST
+/* Compiling for unit test, so we need the real implementations of
+ * rollback functions.  The unit test mocks the underlying tlcl
+ * functions, so this is ok to run on the host. */
+#undef CHROMEOS_ENVIRONMENT
+#undef DISABLE_ROLLBACK_TPM
+#endif
+
 static int g_rollback_recovery_mode = 0;
 
 /* disable MSVC warning on const logical expression (as in } while(0);) */
diff --git a/tests/Makefile b/tests/Makefile
index f602b1e8..98d08a2c 100644
--- a/tests/Makefile
+++ b/tests/Makefile
@@ -55,6 +55,17 @@ ${BUILD_ROOT}/rollback_index_test: rollback_index_test.c ${HOSTLIB}
 	$(CC) $(CFLAGS) -I/usr/include $(INCLUDES) $< -o $@ \
         -ltlcl ${HOSTLIB} -lcrypto -lrt
 
+# Compile rollback_index.c for unit test, so it uses the same implementation
+# as it does in the firmware.
+${BUILD_ROOT}/rollback_index_for_test.o : $(FWDIR)/lib/rollback_index.c
+	$(CC) $(CFLAGS) -DROLLBACK_UNITTEST $(INCLUDES) \
+	-MMD -MF $@.d -c -o $@ $<
+
+${BUILD_ROOT}/rollback_index2_tests: rollback_index2_tests.c \
+		${BUILD_ROOT}/rollback_index_for_test.o ${LIBS}
+	$(CC) $(CFLAGS) $(INCLUDES) $< ${BUILD_ROOT}/rollback_index2.o \
+	${LIBS} -o $@ -lcrypto -lrt
+
 ${BUILD_ROOT}/%.o : %.c
 	$(CC) $(CFLAGS) $(INCLUDES) -MMD -MF $@.d -c -o $@ $<
 
diff --git a/tests/rollback_index2_tests.c b/tests/rollback_index2_tests.c
index cd5fcb90..7acb0989 100644
--- a/tests/rollback_index2_tests.c
+++ b/tests/rollback_index2_tests.c
@@ -17,47 +17,98 @@
 #include "utility.h"
 #include "vboot_common.h"
 
-static char calls[16384];
-static char *cnext = calls;
-static int ccount = 0;
-static int cfail = 0;
-static uint32_t cfail_err = TPM_SUCCESS;
-
+/* Buffer to hold accumulated list of calls to mocked Tlcl functions.
+ * Each function appends itself to the buffer and updates mock_cnext.
+ *
+ * Size of mock_calls[] should be big enough to handle all expected
+ * call sequences; 16KB should be plenty since none of the sequences
+ * below is more than a few hundred bytes.  We could be more clever
+ * and use snprintf() with length checking below, at the expense of
+ * making all the mock implementations bigger.  If this were code used
+ * outside of unit tests we'd want to do that, but here if we did
+ * overrun the buffer the worst that's likely to happen is we'll crash
+ * the test, and crash = failure anyway. */
+static char mock_calls[16384];
+static char *mock_cnext = mock_calls;
+
+/* Variables to support mocked error values from Tlcl functions.  Each
+ * call, mock_count is incremented.  If mock_count==fail_at_count, return
+ * fail_with_error instead of the normal return value. */
+static int mock_count = 0;
+static int fail_at_count = 0;
+static uint32_t fail_with_error = TPM_SUCCESS;
+
+/* Params / backing store for mocked Tlcl functions. */
 static TPM_PERMANENT_FLAGS mock_pflags;
 static RollbackSpaceFirmware mock_rsf;
 static RollbackSpaceKernel mock_rsk;
+static uint32_t mock_permissions;
 
+/* Reset the variables for the Tlcl mock functions. */
 static void ResetMocks(int fail_on_call, uint32_t fail_with_err) {
-  cnext = calls;
-  ccount = 0;
-  cfail = fail_on_call;
-  cfail_err = fail_with_err;
+  *mock_calls = 0;
+  mock_cnext = mock_calls;
+  mock_count = 0;
+  fail_at_count = fail_on_call;
+  fail_with_error = fail_with_err;
 
   Memset(&mock_pflags, 0, sizeof(mock_pflags));
   Memset(&mock_rsf, 0, sizeof(mock_rsf));
   Memset(&mock_rsk, 0, sizeof(mock_rsk));
+  mock_permissions = 0;
 }
 
 /****************************************************************************/
-/* Mocks for tlcl functions which log the calls made to calls[]. */
+/* Mocks for tlcl functions which log the calls made to mock_calls[]. */
+
+uint32_t TlclLibInit(void) {
+  mock_cnext += sprintf(mock_cnext, "TlclLibInit()\n");
+  return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
+}
+
+uint32_t TlclStartup(void) {
+  mock_cnext += sprintf(mock_cnext, "TlclStartup()\n");
+  return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
+}
+
+uint32_t TlclResume(void) {
+  mock_cnext += sprintf(mock_cnext, "TlclResume()\n");
+  return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
+}
 
 uint32_t TlclForceClear(void) {
-  cnext += sprintf(cnext, "TlclForceClear()\n");
-  return (++ccount == cfail) ? cfail_err : TPM_SUCCESS;
+  mock_cnext += sprintf(mock_cnext, "TlclForceClear()\n");
+  return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
 }
 
 uint32_t TlclSetEnable(void) {
-  cnext += sprintf(cnext, "TlclSetEnable()\n");
-  return (++ccount == cfail) ? cfail_err : TPM_SUCCESS;
+  mock_cnext += sprintf(mock_cnext, "TlclSetEnable()\n");
+  return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
 }
 
 uint32_t TlclSetDeactivated(uint8_t flag) {
-  cnext += sprintf(cnext, "TlclSetDeactivated(%d)\n", flag);
-  return (++ccount == cfail) ? cfail_err : TPM_SUCCESS;
+  mock_cnext += sprintf(mock_cnext, "TlclSetDeactivated(%d)\n", flag);
+  return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
+}
+
+uint32_t TlclRead(uint32_t index, void* data, uint32_t length) {
+  mock_cnext += sprintf(mock_cnext, "TlclRead(0x%x, %d)\n", index, length);
+
+  if (FIRMWARE_NV_INDEX == index) {
+    TEST_EQ(length, sizeof(mock_rsf), "TlclRead rsf size");
+    Memcpy(data, &mock_rsf, length);
+  } else if (KERNEL_NV_INDEX == index) {
+    TEST_EQ(length, sizeof(mock_rsk), "TlclRead rsk size");
+    Memcpy(data, &mock_rsk, length);
+  } else {
+    Memset(data, 0, length);
+  }
+
+  return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
 }
 
 uint32_t TlclWrite(uint32_t index, const void* data, uint32_t length) {
-  cnext += sprintf(cnext, "TlclWrite(0x%x, %d)\n", index, length);
+  mock_cnext += sprintf(mock_cnext, "TlclWrite(0x%x, %d)\n", index, length);
 
   if (FIRMWARE_NV_INDEX == index) {
     TEST_EQ(length, sizeof(mock_rsf), "TlclWrite rsf size");
@@ -67,36 +118,69 @@ uint32_t TlclWrite(uint32_t index, const void* data, uint32_t length) {
     Memcpy(&mock_rsk, data, length);
   }
 
-  return (++ccount == cfail) ? cfail_err : TPM_SUCCESS;
+  return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
 }
 
 uint32_t TlclDefineSpace(uint32_t index, uint32_t perm, uint32_t size) {
-  cnext += sprintf(cnext, "TlclDefineSpace(0x%x, 0x%x, %d)\n",
+  mock_cnext += sprintf(mock_cnext, "TlclDefineSpace(0x%x, 0x%x, %d)\n",
                    index, perm, size);
-  return (++ccount == cfail) ? cfail_err : TPM_SUCCESS;
+  return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
 }
 
 uint32_t TlclSelfTestFull(void) {
-  cnext += sprintf(cnext, "TlclSelfTestFull()\n");
-  return (++ccount == cfail) ? cfail_err : TPM_SUCCESS;
+  mock_cnext += sprintf(mock_cnext, "TlclSelfTestFull()\n");
+  return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
+}
+
+uint32_t TlclContinueSelfTest(void) {
+  mock_cnext += sprintf(mock_cnext, "TlclContinueSelfTest()\n");
+  return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
 }
 
 uint32_t TlclGetPermanentFlags(TPM_PERMANENT_FLAGS* pflags) {
-  cnext += sprintf(cnext, "TlclGetPermanentFlags()\n");
+  mock_cnext += sprintf(mock_cnext, "TlclGetPermanentFlags()\n");
   Memcpy(pflags, &mock_pflags, sizeof(mock_pflags));
-  return (++ccount == cfail) ? cfail_err : TPM_SUCCESS;
+  return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
+}
+
+/* TlclGetFlags() doesn't need mocking; it calls TlclGetPermanentFlags() */
+
+uint32_t TlclAssertPhysicalPresence(void) {
+  mock_cnext += sprintf(mock_cnext, "TlclAssertPhysicalPresence()\n");
+  return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
 }
 
 uint32_t TlclFinalizePhysicalPresence(void) {
-  cnext += sprintf(cnext, "TlclFinalizePhysicalPresence()\n");
+  mock_cnext += sprintf(mock_cnext, "TlclFinalizePhysicalPresence()\n");
   mock_pflags.physicalPresenceLifetimeLock = 1;
-  return (++ccount == cfail) ? cfail_err : TPM_SUCCESS;
+  return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
+}
+
+uint32_t TlclPhysicalPresenceCMDEnable(void) {
+  mock_cnext += sprintf(mock_cnext, "TlclPhysicalPresenceCMDEnable()\n");
+  return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
 }
 
 uint32_t TlclSetNvLocked(void) {
-  cnext += sprintf(cnext, "TlclSetNvLocked()\n");
+  mock_cnext += sprintf(mock_cnext, "TlclSetNvLocked()\n");
   mock_pflags.nvLocked = 1;
-  return (++ccount == cfail) ? cfail_err : TPM_SUCCESS;
+  return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
+}
+
+uint32_t TlclSetGlobalLock(void) {
+  mock_cnext += sprintf(mock_cnext, "TlclSetGlobalLock()\n");
+  return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
+}
+
+uint32_t TlclLockPhysicalPresence(void) {
+  mock_cnext += sprintf(mock_cnext, "TlclLockPhysicalPresence()\n");
+  return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
+}
+
+uint32_t TlclGetPermissions(uint32_t index, uint32_t* permissions) {
+  mock_cnext += sprintf(mock_cnext, "TlclGetPermissions(0x%x)\n", index);
+  *permissions = mock_permissions;
+  return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
 }
 
 /****************************************************************************/
@@ -107,7 +191,7 @@ static void MiscTest(void) {
 
   ResetMocks(0, 0);
   TEST_EQ(TPMClearAndReenable(), 0, "TPMClearAndReenable()");
-  TEST_STR_EQ(calls,
+  TEST_STR_EQ(mock_calls,
               "TlclForceClear()\n"
               "TlclSetEnable()\n"
               "TlclSetDeactivated(0)\n",
@@ -115,19 +199,19 @@ static void MiscTest(void) {
 
   ResetMocks(0, 0);
   TEST_EQ(SafeWrite(0x123, buf, 8), 0, "SafeWrite()");
-  TEST_STR_EQ(calls,
+  TEST_STR_EQ(mock_calls,
               "TlclWrite(0x123, 8)\n",
               "tlcl calls");
 
   ResetMocks(1, TPM_E_BADINDEX);
   TEST_EQ(SafeWrite(0x123, buf, 8), TPM_E_BADINDEX, "SafeWrite() bad");
-  TEST_STR_EQ(calls,
+  TEST_STR_EQ(mock_calls,
               "TlclWrite(0x123, 8)\n",
               "tlcl calls");
 
   ResetMocks(1, TPM_E_MAXNVWRITES);
   TEST_EQ(SafeWrite(0x123, buf, 8), 0, "SafeWrite() retry max writes");
-  TEST_STR_EQ(calls,
+  TEST_STR_EQ(mock_calls,
               "TlclWrite(0x123, 8)\n"
               "TlclForceClear()\n"
               "TlclSetEnable()\n"
@@ -137,21 +221,21 @@ static void MiscTest(void) {
 
   ResetMocks(0, 0);
   TEST_EQ(SafeDefineSpace(0x123, 6, 8), 0, "SafeDefineSpace()");
-  TEST_STR_EQ(calls,
+  TEST_STR_EQ(mock_calls,
               "TlclDefineSpace(0x123, 0x6, 8)\n",
               "tlcl calls");
 
   ResetMocks(1, TPM_E_BADINDEX);
   TEST_EQ(SafeDefineSpace(0x123, 6, 8), TPM_E_BADINDEX,
           "SafeDefineSpace() bad");
-  TEST_STR_EQ(calls,
+  TEST_STR_EQ(mock_calls,
               "TlclDefineSpace(0x123, 0x6, 8)\n",
               "tlcl calls");
 
   ResetMocks(1, TPM_E_MAXNVWRITES);
   TEST_EQ(SafeDefineSpace(0x123, 6, 8), 0,
           "SafeDefineSpace() retry max writes");
-  TEST_STR_EQ(calls,
+  TEST_STR_EQ(mock_calls,
               "TlclDefineSpace(0x123, 0x6, 8)\n"
               "TlclForceClear()\n"
               "TlclSetEnable()\n"
@@ -170,7 +254,7 @@ static void OneTimeInitTest(void) {
   /* Complete initialization */
   ResetMocks(0, 0);
   TEST_EQ(OneTimeInitializeTPM(&rsf, &rsk), 0, "OneTimeInitializeTPM()");
-  TEST_STR_EQ(calls,
+  TEST_STR_EQ(mock_calls,
               "TlclSelfTestFull()\n"
               "TlclGetPermanentFlags()\n"
               "TlclFinalizePhysicalPresence()\n"
@@ -196,7 +280,7 @@ static void OneTimeInitTest(void) {
   ResetMocks(0, 0);
   mock_pflags.physicalPresenceLifetimeLock = 1;
   TEST_EQ(OneTimeInitializeTPM(&rsf, &rsk), 0, "OneTimeInitializeTPM()");
-  TEST_STR_EQ(calls,
+  TEST_STR_EQ(mock_calls,
               "TlclSelfTestFull()\n"
               "TlclGetPermanentFlags()\n"
               "TlclSetNvLocked()\n"
@@ -215,7 +299,7 @@ static void OneTimeInitTest(void) {
   ResetMocks(0, 0);
   mock_pflags.nvLocked = 1;
   TEST_EQ(OneTimeInitializeTPM(&rsf, &rsk), 0, "OneTimeInitializeTPM()");
-  TEST_STR_EQ(calls,
+  TEST_STR_EQ(mock_calls,
               "TlclSelfTestFull()\n"
               "TlclGetPermanentFlags()\n"
               "TlclFinalizePhysicalPresence()\n"
@@ -234,11 +318,303 @@ static void OneTimeInitTest(void) {
   ResetMocks(1, TPM_E_IOERROR);
   TEST_EQ(OneTimeInitializeTPM(&rsf, &rsk), TPM_E_IOERROR,
           "OneTimeInitializeTPM() selftest");
-  TEST_STR_EQ(calls,
+  TEST_STR_EQ(mock_calls,
               "TlclSelfTestFull()\n",
               "tlcl calls");
 }
 
+/****************************************************************************/
+/* Tests for TPM setup */
+
+static void SetupTpmTest(void) {
+  RollbackSpaceFirmware rsf;
+
+  /* Complete setup */
+  ResetMocks(0, 0);
+  TEST_EQ(SetupTPM(0, 0, &rsf), 0, "SetupTPM()");
+  TEST_STR_EQ(mock_calls,
+              "TlclLibInit()\n"
+              "TlclStartup()\n"
+              "TlclAssertPhysicalPresence()\n"
+              "TlclGetPermanentFlags()\n"
+              "TlclRead(0x1007, 10)\n",
+              "tlcl calls");
+
+  /* If TPM is disabled or deactivated, must enable it */
+  ResetMocks(0, 0);
+  mock_pflags.disable = 1;
+  TEST_EQ(SetupTPM(0, 0, &rsf), TPM_E_MUST_REBOOT, "SetupTPM() disabled");
+  TEST_STR_EQ(mock_calls,
+              "TlclLibInit()\n"
+              "TlclStartup()\n"
+              "TlclAssertPhysicalPresence()\n"
+              "TlclGetPermanentFlags()\n"
+              "TlclSetEnable()\n"
+              "TlclSetDeactivated(0)\n",
+              "tlcl calls");
+
+  ResetMocks(0, 0);
+  mock_pflags.deactivated = 1;
+  TEST_EQ(SetupTPM(0, 0, &rsf), TPM_E_MUST_REBOOT, "SetupTPM() deactivated");
+  TEST_STR_EQ(mock_calls,
+              "TlclLibInit()\n"
+              "TlclStartup()\n"
+              "TlclAssertPhysicalPresence()\n"
+              "TlclGetPermanentFlags()\n"
+              "TlclSetEnable()\n"
+              "TlclSetDeactivated(0)\n",
+              "tlcl calls");
+
+  /* If physical presence command isn't enabled, should try to enable it */
+  ResetMocks(3, TPM_E_IOERROR);
+  TEST_EQ(SetupTPM(0, 0, &rsf), 0, "SetupTPM() pp cmd");
+  TEST_STR_EQ(mock_calls,
+              "TlclLibInit()\n"
+              "TlclStartup()\n"
+              "TlclAssertPhysicalPresence()\n"
+              "TlclPhysicalPresenceCMDEnable()\n"
+              "TlclAssertPhysicalPresence()\n"
+              "TlclGetPermanentFlags()\n"
+              "TlclRead(0x1007, 10)\n",
+              "tlcl calls");
+
+  /* If firmware space is missing, do one-time init */
+  ResetMocks(5, TPM_E_BADINDEX);
+  mock_pflags.physicalPresenceLifetimeLock = 1;
+  mock_pflags.nvLocked = 1;
+  TEST_EQ(SetupTPM(0, 0, &rsf), 0, "SetupTPM() no firmware space");
+  TEST_STR_EQ(mock_calls,
+              "TlclLibInit()\n"
+              "TlclStartup()\n"
+              "TlclAssertPhysicalPresence()\n"
+              "TlclGetPermanentFlags()\n"
+              "TlclRead(0x1007, 10)\n"
+              /* Calls from one-time init */
+              "TlclSelfTestFull()\n"
+              "TlclGetPermanentFlags()\n"
+              "TlclForceClear()\n"
+              "TlclSetEnable()\n"
+              "TlclSetDeactivated(0)\n"
+              "TlclDefineSpace(0x1008, 0x1, 13)\n"
+              "TlclWrite(0x1008, 13)\n"
+              "TlclDefineSpace(0x1007, 0x8001, 10)\n"
+              "TlclWrite(0x1007, 10)\n",
+              "tlcl calls");
+
+  /* Other firmware space error is passed through */
+  ResetMocks(5, TPM_E_IOERROR);
+  TEST_EQ(SetupTPM(0, 0, &rsf), TPM_E_CORRUPTED_STATE,
+          "SetupTPM() bad firmware space");
+  TEST_STR_EQ(mock_calls,
+              "TlclLibInit()\n"
+              "TlclStartup()\n"
+              "TlclAssertPhysicalPresence()\n"
+              "TlclGetPermanentFlags()\n"
+              "TlclRead(0x1007, 10)\n",
+              "tlcl calls");
+
+  /* If developer flag has toggled, clear ownership and write new flag */
+  ResetMocks(0, 0);
+  TEST_EQ(SetupTPM(0, 1, &rsf), 0, "SetupTPM() to dev");
+  TEST_STR_EQ(mock_calls,
+              "TlclLibInit()\n"
+              "TlclStartup()\n"
+              "TlclAssertPhysicalPresence()\n"
+              "TlclGetPermanentFlags()\n"
+              "TlclRead(0x1007, 10)\n"
+              "TlclForceClear()\n"
+              "TlclSetEnable()\n"
+              "TlclSetDeactivated(0)\n"
+              "TlclWrite(0x1007, 10)\n",
+              "tlcl calls");
+  TEST_EQ(mock_rsf.flags, FLAG_LAST_BOOT_DEVELOPER, "fw space flags to dev");
+
+  ResetMocks(0, 0);
+  mock_rsf.flags = FLAG_LAST_BOOT_DEVELOPER;
+  TEST_EQ(SetupTPM(0, 0, &rsf), 0, "SetupTPM() from dev");
+  TEST_STR_EQ(mock_calls,
+              "TlclLibInit()\n"
+              "TlclStartup()\n"
+              "TlclAssertPhysicalPresence()\n"
+              "TlclGetPermanentFlags()\n"
+              "TlclRead(0x1007, 10)\n"
+              "TlclForceClear()\n"
+              "TlclSetEnable()\n"
+              "TlclSetDeactivated(0)\n"
+              "TlclWrite(0x1007, 10)\n",
+              "tlcl calls");
+  TEST_EQ(mock_rsf.flags, 0, "fw space flags from dev");
+
+  /* Note: SetupTPM() recovery_mode parameter sets a global flag in
+   * rollback_index.c; this is tested along with RollbackKernelLock() below. */
+}
+
+/****************************************************************************/
+/* Tests for RollbackFirmware() calls */
+static void RollbackFirmwareTest(void) {
+  uint32_t version;
+
+  /* Normal setup */
+  ResetMocks(0, 0);
+  version = 123;
+  mock_rsf.fw_versions = 0x12345678;
+  TEST_EQ(RollbackFirmwareSetup(0, 0, &version), 0, "RollbackFirmwareSetup()");
+  TEST_STR_EQ(mock_calls,
+              "TlclLibInit()\n"
+              "TlclStartup()\n"
+              "TlclAssertPhysicalPresence()\n"
+              "TlclGetPermanentFlags()\n"
+              "TlclRead(0x1007, 10)\n",
+              "tlcl calls");
+  TEST_EQ(version, 0x12345678, "RollbackFirmwareSetup() version");
+
+  /* Error during setup should clear version */
+  ResetMocks(1, TPM_E_IOERROR);
+  version = 123;
+  mock_rsf.fw_versions = 0x12345678;
+  TEST_EQ(RollbackFirmwareSetup(0, 0, &version), TPM_E_IOERROR,
+          "RollbackFirmwareSetup() error");
+  TEST_STR_EQ(mock_calls,
+              "TlclLibInit()\n",
+              "tlcl calls");
+  TEST_EQ(version, 0, "RollbackFirmwareSetup() version on error");
+
+  /* Developer mode flag gets passed properly */
+  ResetMocks(0, 0);
+  TEST_EQ(RollbackFirmwareSetup(0, 1, &version), 0,
+          "RollbackFirmwareSetup() to dev");
+  TEST_STR_EQ(mock_calls,
+              "TlclLibInit()\n"
+              "TlclStartup()\n"
+              "TlclAssertPhysicalPresence()\n"
+              "TlclGetPermanentFlags()\n"
+              "TlclRead(0x1007, 10)\n"
+              "TlclForceClear()\n"
+              "TlclSetEnable()\n"
+              "TlclSetDeactivated(0)\n"
+              "TlclWrite(0x1007, 10)\n",
+              "tlcl calls");
+  TEST_EQ(mock_rsf.flags, FLAG_LAST_BOOT_DEVELOPER, "fw space flags to dev");
+
+  /* Test write */
+  ResetMocks(0, 0);
+  TEST_EQ(RollbackFirmwareWrite(0xBEAD1234), 0, "RollbackFirmwareWrite()");
+  TEST_EQ(mock_rsf.fw_versions, 0xBEAD1234, "RollbackFirmwareWrite() version");
+  TEST_STR_EQ(mock_calls,
+              "TlclRead(0x1007, 10)\n"
+              "TlclWrite(0x1007, 10)\n",
+              "tlcl calls");
+
+  ResetMocks(1, TPM_E_IOERROR);
+  TEST_EQ(RollbackFirmwareWrite(123), TPM_E_IOERROR,
+          "RollbackFirmwareWrite() error");
+
+  /* Test lock */
+  ResetMocks(0, 0);
+  TEST_EQ(RollbackFirmwareLock(), 0, "RollbackFirmwareLock()");
+  TEST_STR_EQ(mock_calls,
+              "TlclSetGlobalLock()\n",
+              "tlcl calls");
+
+  ResetMocks(1, TPM_E_IOERROR);
+  TEST_EQ(RollbackFirmwareLock(), TPM_E_IOERROR,
+          "RollbackFirmwareLock() error");
+}
+
+/****************************************************************************/
+/* Tests for RollbackKernel() calls */
+
+static void RollbackKernelTest(void) {
+  RollbackSpaceFirmware rsf;
+  uint32_t version = 0;
+
+  /* RollbackKernel*() functions use a global flag inside
+   * rollback_index.c based on recovery mode, which is set by
+   * SetupTPM().  Clear the flag for the first set of tests. */
+  TEST_EQ(SetupTPM(0, 0, &rsf), 0, "SetupTPM()");
+
+  /* Normal read */
+  ResetMocks(0, 0);
+  mock_rsk.uid = ROLLBACK_SPACE_KERNEL_UID;
+  mock_permissions = TPM_NV_PER_PPWRITE;
+  mock_rsk.kernel_versions = 0x87654321;
+  TEST_EQ(RollbackKernelRead(&version), 0, "RollbackKernelRead()");
+  TEST_STR_EQ(mock_calls,
+              "TlclRead(0x1008, 13)\n"
+              "TlclGetPermissions(0x1008)\n",
+              "tlcl calls");
+  TEST_EQ(version, 0x87654321, "RollbackKernelRead() version");
+
+  /* Read error */
+  ResetMocks(1, TPM_E_IOERROR);
+  TEST_EQ(RollbackKernelRead(&version), TPM_E_IOERROR,
+          "RollbackKernelRead() error");
+  TEST_STR_EQ(mock_calls,
+              "TlclRead(0x1008, 13)\n",
+              "tlcl calls");
+
+  /* Wrong permission or UID will return error */
+  ResetMocks(0, 0);
+  mock_rsk.uid = ROLLBACK_SPACE_KERNEL_UID + 1;
+  mock_permissions = TPM_NV_PER_PPWRITE;
+  TEST_EQ(RollbackKernelRead(&version), TPM_E_CORRUPTED_STATE,
+          "RollbackKernelRead() bad uid");
+
+  ResetMocks(0, 0);
+  mock_rsk.uid = ROLLBACK_SPACE_KERNEL_UID;
+  mock_permissions = TPM_NV_PER_PPWRITE + 1;
+  TEST_EQ(RollbackKernelRead(&version), TPM_E_CORRUPTED_STATE,
+          "RollbackKernelRead() bad permissions");
+
+  /* Test write */
+  ResetMocks(0, 0);
+  TEST_EQ(RollbackKernelWrite(0xBEAD4321), 0, "RollbackKernelWrite()");
+  TEST_EQ(mock_rsk.kernel_versions, 0xBEAD4321,
+          "RollbackKernelWrite() version");
+  TEST_STR_EQ(mock_calls,
+              "TlclRead(0x1008, 13)\n"
+              "TlclWrite(0x1008, 13)\n",
+              "tlcl calls");
+
+  ResetMocks(1, TPM_E_IOERROR);
+  TEST_EQ(RollbackKernelWrite(123), TPM_E_IOERROR,
+          "RollbackKernelWrite() error");
+
+  /* Test lock (recovery off) */
+  ResetMocks(0, 0);
+  TEST_EQ(RollbackKernelLock(), 0, "RollbackKernelLock()");
+  TEST_STR_EQ(mock_calls,
+              "TlclLockPhysicalPresence()\n",
+              "tlcl calls");
+
+  ResetMocks(1, TPM_E_IOERROR);
+  TEST_EQ(RollbackKernelLock(), TPM_E_IOERROR, "RollbackKernelLock() error");
+
+  /* Test lock with recovery on; shouldn't lock PP */
+  SetupTPM(1, 0, &rsf);
+  ResetMocks(0, 0);
+  TEST_EQ(RollbackKernelLock(), 0, "RollbackKernelLock() in recovery");
+  TEST_STR_EQ(mock_calls, "", "no tlcl calls");
+}
+
+/* Tests for RollbackS3Resume() */
+static void RollbackS3ResumeTest(void) {
+
+  ResetMocks(0, 0);
+  TEST_EQ(RollbackS3Resume(), 0, "RollbackS3Resume()");
+  TEST_STR_EQ(mock_calls,
+              "TlclLibInit()\n"
+              "TlclResume()\n",
+              "tlcl calls");
+
+  /* Should ignore postinit error */
+  ResetMocks(2, TPM_E_INVALID_POSTINIT);
+  TEST_EQ(RollbackS3Resume(), 0, "RollbackS3Resume() postinit");
+
+  /* Resume with other error */
+  ResetMocks(2, TPM_E_IOERROR);
+  TEST_EQ(RollbackS3Resume(), TPM_E_IOERROR, "RollbackS3Resume() other error");
+}
 
 /* disable MSVC warnings on unused arguments */
 __pragma(warning (disable: 4100))
@@ -248,6 +624,10 @@ int main(int argc, char* argv[]) {
 
   MiscTest();
   OneTimeInitTest();
+  SetupTpmTest();
+  RollbackFirmwareTest();
+  RollbackKernelTest();
+  RollbackS3ResumeTest();
 
   if (!gTestSuccess)
     error_code = 255;