Improve coverage of rollback_index.c

BUG=chromium-os:38139
BRANCH=none
TEST=make runtests

Change-Id: I21b62b5dd3fc6037f54f7c3bac768c2b67a4c12d
Signed-off-by: Randall Spangler <rspangler@chromium.org>
Reviewed-on: https://gerrit.chromium.org/gerrit/41859
Reviewed-by: Bill Richardson <wfrichar@chromium.org>

4 files changed, 1380 insertions, 1190 deletions

diff --git a/Makefile b/Makefile
index 62af1ed7..36d7a125 100644
--- a/Makefile
+++ b/Makefile
@@ -405,6 +405,7 @@ ALL_OBJS += ${TESTLIB_OBJS}
 TEST_NAMES = \
 	cgptlib_test \
 	rollback_index2_tests \
+	rollback_index3_tests \
 	rsa_padding_test \
 	rsa_utility_tests \
 	rsa_verify_benchmark \
@@ -932,6 +933,7 @@ runtestscripts: test_setup genfuzztestcases
 .PHONY: runmisctests
 runmisctests: test_setup
 	${RUNTEST} ${BUILD_RUN}/tests/rollback_index2_tests
+	${RUNTEST} ${BUILD_RUN}/tests/rollback_index3_tests
 	${RUNTEST} ${BUILD_RUN}/tests/rsa_utility_tests
 	${RUNTEST} ${BUILD_RUN}/tests/sha_tests
 	${RUNTEST} ${BUILD_RUN}/tests/stateful_util_tests
diff --git a/firmware/lib/rollback_index.c b/firmware/lib/rollback_index.c
index ee89d7e6..82323235 100644
--- a/firmware/lib/rollback_index.c
+++ b/firmware/lib/rollback_index.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2012 The Chromium OS Authors. All rights reserved.
+/* Copyright (c) 2013 The Chromium OS Authors. All rights reserved.
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  *
@@ -39,246 +39,281 @@ __pragma(warning (disable: 4127))
   } while (0)
 
 
-uint32_t TPMClearAndReenable(void) {
-  VBDEBUG(("TPM: Clear and re-enable\n"));
-  RETURN_ON_FAILURE(TlclForceClear());
-  RETURN_ON_FAILURE(TlclSetEnable());
-  RETURN_ON_FAILURE(TlclSetDeactivated(0));
+uint32_t TPMClearAndReenable(void)
+{
+	VBDEBUG(("TPM: Clear and re-enable\n"));
+	RETURN_ON_FAILURE(TlclForceClear());
+	RETURN_ON_FAILURE(TlclSetEnable());
+	RETURN_ON_FAILURE(TlclSetDeactivated(0));
 
-  return TPM_SUCCESS;
+	return TPM_SUCCESS;
 }
 
-
-uint32_t SafeWrite(uint32_t index, const void* data, uint32_t length) {
-  uint32_t result = TlclWrite(index, data, length);
-  if (result == TPM_E_MAXNVWRITES) {
-    RETURN_ON_FAILURE(TPMClearAndReenable());
-    return TlclWrite(index, data, length);
-  } else {
-    return result;
-  }
+uint32_t SafeWrite(uint32_t index, const void *data, uint32_t length)
+{
+	uint32_t result = TlclWrite(index, data, length);
+	if (result == TPM_E_MAXNVWRITES) {
+		RETURN_ON_FAILURE(TPMClearAndReenable());
+		return TlclWrite(index, data, length);
+	} else {
+		return result;
+	}
 }
 
-
-uint32_t SafeDefineSpace(uint32_t index, uint32_t perm, uint32_t size) {
-  uint32_t result = TlclDefineSpace(index, perm, size);
-  if (result == TPM_E_MAXNVWRITES) {
-    RETURN_ON_FAILURE(TPMClearAndReenable());
-    return TlclDefineSpace(index, perm, size);
-  } else {
-    return result;
-  }
+uint32_t SafeDefineSpace(uint32_t index, uint32_t perm, uint32_t size)
+{
+	uint32_t result = TlclDefineSpace(index, perm, size);
+	if (result == TPM_E_MAXNVWRITES) {
+		RETURN_ON_FAILURE(TPMClearAndReenable());
+		return TlclDefineSpace(index, perm, size);
+	} else {
+		return result;
+	}
 }
 
-
 /* Functions to read and write firmware and kernel spaces. */
-uint32_t ReadSpaceFirmware(RollbackSpaceFirmware* rsf) {
-  uint32_t r;
-  int attempts = 3;
-
-  while (attempts--) {
-    r = TlclRead(FIRMWARE_NV_INDEX, rsf, sizeof(RollbackSpaceFirmware));
-    if (r != TPM_SUCCESS)
-      return r;
-
-    /* No CRC in this version, so we'll create one when we write it. Note that
-     * we're marking this as version 2, not ROLLBACK_SPACE_FIRMWARE_VERSION,
-     * because version 2 just added the CRC. Later versions will need to
-     * set default values for any extra fields explicitly (probably here). */
-    if (rsf->struct_version < 2) {
-      rsf->struct_version = 2;          /* Danger Will Robinson! Danger! */
-      return TPM_SUCCESS;
-    }
-
-    /* If the CRC is good, we're done. If it's bad, try a couple more times to
-     * see if it gets better before we give up. It could just be noise. */
-    if (rsf->crc8 == Crc8(rsf, offsetof(RollbackSpaceFirmware, crc8)))
-      return TPM_SUCCESS;
-
-    VBDEBUG(("TPM: %s() - bad CRC\n", __func__));
-  }
-
-  VBDEBUG(("TPM: %s() - too many bad CRCs, giving up\n", __func__));
-  return TPM_E_CORRUPTED_STATE;
+uint32_t ReadSpaceFirmware(RollbackSpaceFirmware *rsf)
+{
+	uint32_t r;
+	int attempts = 3;
+
+	while (attempts--) {
+		r = TlclRead(FIRMWARE_NV_INDEX, rsf,
+			     sizeof(RollbackSpaceFirmware));
+		if (r != TPM_SUCCESS)
+			return r;
+
+		/*
+		 * No CRC in this version, so we'll create one when we write
+		 * it. Note that we're marking this as version 2, not
+		 * ROLLBACK_SPACE_FIRMWARE_VERSION, because version 2 just
+		 * added the CRC. Later versions will need to set default
+		 * values for any extra fields explicitly (probably here).
+		 */
+		if (rsf->struct_version < 2) {
+			/* Danger Will Robinson! Danger! */
+			rsf->struct_version = 2;
+			return TPM_SUCCESS;
+		}
+
+		/*
+		 * If the CRC is good, we're done. If it's bad, try a couple
+		 * more times to see if it gets better before we give up. It
+		 * could just be noise.
+		 */
+		if (rsf->crc8 == Crc8(rsf,
+				      offsetof(RollbackSpaceFirmware, crc8)))
+			return TPM_SUCCESS;
+
+		VBDEBUG(("TPM: %s() - bad CRC\n", __func__));
+	}
+
+	VBDEBUG(("TPM: %s() - too many bad CRCs, giving up\n", __func__));
+	return TPM_E_CORRUPTED_STATE;
 }
 
-uint32_t WriteSpaceFirmware(RollbackSpaceFirmware* rsf) {
-  RollbackSpaceFirmware rsf2;
-  uint32_t r;
-  int attempts = 3;
-
-  /* All writes should use struct_version 2 or greater. */
-  if (rsf->struct_version < 2)
-    rsf->struct_version = 2;
-  rsf->crc8 = Crc8(rsf, offsetof(RollbackSpaceFirmware, crc8));
-
-  while (attempts--) {
-    r = SafeWrite(FIRMWARE_NV_INDEX, rsf, sizeof(RollbackSpaceFirmware));
-    /* Can't write, not gonna try again */
-    if (r != TPM_SUCCESS)
-      return r;
-
-    /* Read it back to be sure it got the right values. */
-    r = ReadSpaceFirmware(&rsf2);    /* This checks the CRC */
-    if (r == TPM_SUCCESS)
-      return r;
-
-    VBDEBUG(("TPM: %s() - bad CRC\n", __func__));
-    /* Try writing it again. Maybe it was garbled on the way out. */
-  }
-
-  VBDEBUG(("TPM: %s() - too many bad CRCs, giving up\n", __func__));
-  return TPM_E_CORRUPTED_STATE;
+uint32_t WriteSpaceFirmware(RollbackSpaceFirmware *rsf)
+{
+	RollbackSpaceFirmware rsf2;
+	uint32_t r;
+	int attempts = 3;
+
+	/* All writes should use struct_version 2 or greater. */
+	if (rsf->struct_version < 2)
+		rsf->struct_version = 2;
+	rsf->crc8 = Crc8(rsf, offsetof(RollbackSpaceFirmware, crc8));
+
+	while (attempts--) {
+		r = SafeWrite(FIRMWARE_NV_INDEX, rsf,
+			      sizeof(RollbackSpaceFirmware));
+		/* Can't write, not gonna try again */
+		if (r != TPM_SUCCESS)
+			return r;
+
+		/* Read it back to be sure it got the right values. */
+		r = ReadSpaceFirmware(&rsf2);    /* This checks the CRC */
+		if (r == TPM_SUCCESS)
+			return r;
+
+		VBDEBUG(("TPM: %s() - bad CRC\n", __func__));
+		/* Try writing it again. Maybe it was garbled on the way out. */
+	}
+
+	VBDEBUG(("TPM: %s() - too many bad CRCs, giving up\n", __func__));
+	return TPM_E_CORRUPTED_STATE;
 }
 
-uint32_t SetVirtualDevMode(int val) {
-  RollbackSpaceFirmware rsf;
-
-  VBDEBUG(("TPM: Entering %s()\n", __func__));
-  if (TPM_SUCCESS != ReadSpaceFirmware(&rsf))
-    return VBERROR_TPM_FIRMWARE_SETUP;
-
-  VBDEBUG(("TPM: flags were 0x%02x\n", rsf.flags));
-  if (val)
-    rsf.flags |= FLAG_VIRTUAL_DEV_MODE_ON;
-  else
-    rsf.flags &= ~FLAG_VIRTUAL_DEV_MODE_ON;
-  /* NOTE: This doesn't update the FLAG_LAST_BOOT_DEVELOPER bit */
-  VBDEBUG(("TPM: flags are now 0x%02x\n", rsf.flags));
-
-  if (TPM_SUCCESS != WriteSpaceFirmware(&rsf))
-    return VBERROR_TPM_SET_BOOT_MODE_STATE;
-
-  VBDEBUG(("TPM: Leaving %s()\n", __func__));
-  return VBERROR_SUCCESS;
+uint32_t SetVirtualDevMode(int val)
+{
+	RollbackSpaceFirmware rsf;
+
+	VBDEBUG(("TPM: Entering %s()\n", __func__));
+	if (TPM_SUCCESS != ReadSpaceFirmware(&rsf))
+		return VBERROR_TPM_FIRMWARE_SETUP;
+
+	VBDEBUG(("TPM: flags were 0x%02x\n", rsf.flags));
+	if (val)
+		rsf.flags |= FLAG_VIRTUAL_DEV_MODE_ON;
+	else
+		rsf.flags &= ~FLAG_VIRTUAL_DEV_MODE_ON;
+	/*
+	 * NOTE: This doesn't update the FLAG_LAST_BOOT_DEVELOPER bit.  That
+	 * will be done by SetupTPM() on the next boot.
+	 */
+	VBDEBUG(("TPM: flags are now 0x%02x\n", rsf.flags));
+
+	if (TPM_SUCCESS != WriteSpaceFirmware(&rsf))
+		return VBERROR_TPM_SET_BOOT_MODE_STATE;
+
+	VBDEBUG(("TPM: Leaving %s()\n", __func__));
+	return VBERROR_SUCCESS;
 }
 
-uint32_t ReadSpaceKernel(RollbackSpaceKernel* rsk) {
-  uint32_t r;
-  int attempts = 3;
-
-  while (attempts--) {
-    r = TlclRead(KERNEL_NV_INDEX, rsk, sizeof(RollbackSpaceKernel));
-    if (r != TPM_SUCCESS)
-      return r;
-
-    /* No CRC in this version, so we'll create one when we write it. Note that
-     * we're marking this as version 2, not ROLLBACK_SPACE_KERNEL_VERSION,
-     * because version 2 just added the CRC. Later versions will need to
-     * set default values for any extra fields explicitly (probably here). */
-    if (rsk->struct_version < 2) {
-      rsk->struct_version = 2;          /* Danger Will Robinson! Danger! */
-      return TPM_SUCCESS;
-    }
-
-    /* If the CRC is good, we're done. If it's bad, try a couple more times to
-     * see if it gets better before we give up. It could just be noise. */
-    if (rsk->crc8 == Crc8(rsk, offsetof(RollbackSpaceKernel, crc8)))
-      return TPM_SUCCESS;
-
-    VBDEBUG(("TPM: %s() - bad CRC\n", __func__));
-  }
-
-  VBDEBUG(("TPM: %s() - too many bad CRCs, giving up\n", __func__));
-  return TPM_E_CORRUPTED_STATE;
+uint32_t ReadSpaceKernel(RollbackSpaceKernel *rsk)
+{
+	uint32_t r;
+	int attempts = 3;
+
+	while (attempts--) {
+		r = TlclRead(KERNEL_NV_INDEX, rsk, sizeof(RollbackSpaceKernel));
+		if (r != TPM_SUCCESS)
+			return r;
+
+		/*
+		 * No CRC in this version, so we'll create one when we write
+		 * it. Note that we're marking this as version 2, not
+		 * ROLLBACK_SPACE_KERNEL_VERSION, because version 2 just added
+		 * the CRC. Later versions will need to set default values for
+		 * any extra fields explicitly (probably here).
+		 */
+		if (rsk->struct_version < 2) {
+			/* Danger Will Robinson! Danger! */
+			rsk->struct_version = 2;
+			return TPM_SUCCESS;
+		}
+
+		/*
+		 * If the CRC is good, we're done. If it's bad, try a couple
+		 * more times to see if it gets better before we give up. It
+		 * could just be noise.
+		 */
+		if (rsk->crc8 == Crc8(rsk, offsetof(RollbackSpaceKernel, crc8)))
+			return TPM_SUCCESS;
+
+		VBDEBUG(("TPM: %s() - bad CRC\n", __func__));
+	}
+
+	VBDEBUG(("TPM: %s() - too many bad CRCs, giving up\n", __func__));
+	return TPM_E_CORRUPTED_STATE;
 }
 
-uint32_t WriteSpaceKernel(RollbackSpaceKernel* rsk) {
-  RollbackSpaceKernel rsk2;
-  uint32_t r;
-  int attempts = 3;
-
-  /* All writes should use struct_version 2 or greater. */
-  if (rsk->struct_version < 2)
-    rsk->struct_version = 2;
-  rsk->crc8 = Crc8(rsk, offsetof(RollbackSpaceKernel, crc8));
-
-  while (attempts--) {
-    r = SafeWrite(KERNEL_NV_INDEX, rsk, sizeof(RollbackSpaceKernel));
-    /* Can't write, not gonna try again */
-    if (r != TPM_SUCCESS)
-      return r;
-
-    /* Read it back to be sure it got the right values. */
-    r = ReadSpaceKernel(&rsk2);    /* This checks the CRC */
-    if (r == TPM_SUCCESS)
-      return r;
-
-    VBDEBUG(("TPM: %s() - bad CRC\n", __func__));
-    /* Try writing it again. Maybe it was garbled on the way out. */
-  }
-
-  VBDEBUG(("TPM: %s() - too many bad CRCs, giving up\n", __func__));
-  return TPM_E_CORRUPTED_STATE;
+uint32_t WriteSpaceKernel(RollbackSpaceKernel *rsk)
+{
+	RollbackSpaceKernel rsk2;
+	uint32_t r;
+	int attempts = 3;
+
+	/* All writes should use struct_version 2 or greater. */
+	if (rsk->struct_version < 2)
+		rsk->struct_version = 2;
+	rsk->crc8 = Crc8(rsk, offsetof(RollbackSpaceKernel, crc8));
+
+	while (attempts--) {
+		r = SafeWrite(KERNEL_NV_INDEX, rsk,
+			      sizeof(RollbackSpaceKernel));
+		/* Can't write, not gonna try again */
+		if (r != TPM_SUCCESS)
+			return r;
+
+		/* Read it back to be sure it got the right values. */
+		r = ReadSpaceKernel(&rsk2);    /* This checks the CRC */
+		if (r == TPM_SUCCESS)
+			return r;
+
+		VBDEBUG(("TPM: %s() - bad CRC\n", __func__));
+		/* Try writing it again. Maybe it was garbled on the way out. */
+	}
+
+	VBDEBUG(("TPM: %s() - too many bad CRCs, giving up\n", __func__));
+	return TPM_E_CORRUPTED_STATE;
 }
 
-
-uint32_t OneTimeInitializeTPM(RollbackSpaceFirmware* rsf,
-                              RollbackSpaceKernel* rsk) {
-  static const RollbackSpaceFirmware rsf_init = {
-    .struct_version = ROLLBACK_SPACE_FIRMWARE_VERSION,
-  };
-  static const RollbackSpaceKernel rsk_init = {
-    .struct_version = ROLLBACK_SPACE_KERNEL_VERSION,
-    .uid = ROLLBACK_SPACE_KERNEL_UID,
-  };
-  TPM_PERMANENT_FLAGS pflags;
-  uint32_t result;
-
-  VBDEBUG(("TPM: One-time initialization\n"));
-
-  /* Do a full test.  This only happens the first time the device is turned on
-   * in the factory, so performance is not an issue.  This is almost certainly
-   * not necessary, but it gives us more confidence about some code paths below
-   * that are difficult to test---specifically the ones that set lifetime
-   * flags, and are only executed once per physical TPM. */
-  result = TlclSelfTestFull();
-  if (result != TPM_SUCCESS)
-    return result;
-
-  result = TlclGetPermanentFlags(&pflags);
-  if (result != TPM_SUCCESS)
-    return result;
-
-  /* TPM may come from the factory without physical presence finalized.  Fix
-   * if necessary. */
-  VBDEBUG(("TPM: physicalPresenceLifetimeLock=%d\n",
-           pflags.physicalPresenceLifetimeLock));
-  if (!pflags.physicalPresenceLifetimeLock) {
-    VBDEBUG(("TPM: Finalizing physical presence\n"));
-    RETURN_ON_FAILURE(TlclFinalizePhysicalPresence());
-  }
-
-  /* The TPM will not enforce the NV authorization restrictions until the
-   * execution of a TPM_NV_DefineSpace with the handle of TPM_NV_INDEX_LOCK.
-   * Here we create that space if it doesn't already exist. */
-  VBDEBUG(("TPM: nvLocked=%d\n", pflags.nvLocked));
-  if (!pflags.nvLocked) {
-    VBDEBUG(("TPM: Enabling NV locking\n"));
-    RETURN_ON_FAILURE(TlclSetNvLocked());
-  }
-
-  /* Clear TPM owner, in case the TPM is already owned for some reason. */
-  VBDEBUG(("TPM: Clearing owner\n"));
-  RETURN_ON_FAILURE(TPMClearAndReenable());
-
-  /* Initializes the firmware and kernel spaces */
-  Memcpy(rsf, &rsf_init, sizeof(RollbackSpaceFirmware));
-  Memcpy(rsk, &rsk_init, sizeof(RollbackSpaceKernel));
-
-  /* Defines and sets firmware and kernel spaces */
-  RETURN_ON_FAILURE(SafeDefineSpace(KERNEL_NV_INDEX, TPM_NV_PER_PPWRITE,
-                                    sizeof(RollbackSpaceKernel)));
-  RETURN_ON_FAILURE(WriteSpaceKernel(rsk));
-  RETURN_ON_FAILURE(SafeDefineSpace(FIRMWARE_NV_INDEX,
-                                    TPM_NV_PER_GLOBALLOCK | TPM_NV_PER_PPWRITE,
-                                    sizeof(RollbackSpaceFirmware)));
-  RETURN_ON_FAILURE(WriteSpaceFirmware(rsf));
-  return TPM_SUCCESS;
+uint32_t OneTimeInitializeTPM(RollbackSpaceFirmware *rsf,
+                              RollbackSpaceKernel *rsk)
+{
+	static const RollbackSpaceFirmware rsf_init = {
+		.struct_version = ROLLBACK_SPACE_FIRMWARE_VERSION,
+	};
+	static const RollbackSpaceKernel rsk_init = {
+		.struct_version = ROLLBACK_SPACE_KERNEL_VERSION,
+		.uid = ROLLBACK_SPACE_KERNEL_UID,
+	};
+	TPM_PERMANENT_FLAGS pflags;
+	uint32_t result;
+
+	VBDEBUG(("TPM: One-time initialization\n"));
+
+	/*
+	 * Do a full test.  This only happens the first time the device is
+	 * turned on in the factory, so performance is not an issue.  This is
+	 * almost certainly not necessary, but it gives us more confidence
+	 * about some code paths below that are difficult to
+	 * test---specifically the ones that set lifetime flags, and are only
+	 * executed once per physical TPM.
+	 */
+	result = TlclSelfTestFull();
+	if (result != TPM_SUCCESS)
+		return result;
+
+	result = TlclGetPermanentFlags(&pflags);
+	if (result != TPM_SUCCESS)
+		return result;
+
+	/*
+	 * TPM may come from the factory without physical presence finalized.
+	 * Fix if necessary.
+	 */
+	VBDEBUG(("TPM: physicalPresenceLifetimeLock=%d\n",
+		 pflags.physicalPresenceLifetimeLock));
+	if (!pflags.physicalPresenceLifetimeLock) {
+		VBDEBUG(("TPM: Finalizing physical presence\n"));
+		RETURN_ON_FAILURE(TlclFinalizePhysicalPresence());
+	}
+
+	/*
+	 * The TPM will not enforce the NV authorization restrictions until the
+	 * execution of a TPM_NV_DefineSpace with the handle of
+	 * TPM_NV_INDEX_LOCK.  Here we create that space if it doesn't already
+	 * exist. */
+	VBDEBUG(("TPM: nvLocked=%d\n", pflags.nvLocked));
+	if (!pflags.nvLocked) {
+		VBDEBUG(("TPM: Enabling NV locking\n"));
+		RETURN_ON_FAILURE(TlclSetNvLocked());
+	}
+
+	/* Clear TPM owner, in case the TPM is already owned for some reason. */
+	VBDEBUG(("TPM: Clearing owner\n"));
+	RETURN_ON_FAILURE(TPMClearAndReenable());
+
+	/* Initializes the firmware and kernel spaces */
+	Memcpy(rsf, &rsf_init, sizeof(RollbackSpaceFirmware));
+	Memcpy(rsk, &rsk_init, sizeof(RollbackSpaceKernel));
+
+	/* Defines and sets firmware and kernel spaces */
+	RETURN_ON_FAILURE(SafeDefineSpace(KERNEL_NV_INDEX, TPM_NV_PER_PPWRITE,
+					  sizeof(RollbackSpaceKernel)));
+	RETURN_ON_FAILURE(WriteSpaceKernel(rsk));
+	RETURN_ON_FAILURE(SafeDefineSpace(
+			FIRMWARE_NV_INDEX,
+			TPM_NV_PER_GLOBALLOCK | TPM_NV_PER_PPWRITE,
+			sizeof(RollbackSpaceFirmware)));
+	RETURN_ON_FAILURE(WriteSpaceFirmware(rsf));
+	return TPM_SUCCESS;
 }
 
 
-/* SetupTPM starts the TPM and establishes the root of trust for the
+/*
+ * SetupTPM starts the TPM and establishes the root of trust for the
  * anti-rollback mechanism.  SetupTPM can fail for three reasons.  1 A bug. 2 a
  * TPM hardware failure. 3 An unexpected TPM state due to some attack.  In
  * general we cannot easily distinguish the kind of failure, so our strategy is
@@ -299,38 +334,40 @@ uint32_t OneTimeInitializeTPM(RollbackSpaceFirmware* rsf,
  */
 uint32_t SetupTPM(int recovery_mode, int developer_mode,
                   int disable_dev_request, int clear_tpm_owner_request,
-                  RollbackSpaceFirmware* rsf) {
-
-  uint8_t in_flags;
-  uint8_t disable;
-  uint8_t deactivated;
-  uint32_t result;
+                  RollbackSpaceFirmware* rsf)
+{
+	uint8_t in_flags;
+	uint8_t disable;
+	uint8_t deactivated;
+	uint32_t result;
 
-  VBDEBUG(("TPM: SetupTPM(r%d, d%d)\n", recovery_mode, developer_mode));
+	VBDEBUG(("TPM: SetupTPM(r%d, d%d)\n", recovery_mode, developer_mode));
 
-  if (recovery_mode)
-    g_rollback_recovery_mode = 1;  /* Global variables are usable in
-                                    * recovery mode */
+	/* Global variables are usable in recovery mode */
+	if (recovery_mode)
+		g_rollback_recovery_mode = 1;
 
-  RETURN_ON_FAILURE(TlclLibInit());
+	RETURN_ON_FAILURE(TlclLibInit());
 
 #ifdef TEGRA_SOFT_REBOOT_WORKAROUND
-  result = TlclStartup();
-  if (result == TPM_E_INVALID_POSTINIT) {
-    /* Some prototype hardware doesn't reset the TPM on a CPU reset.  We do a
-     * hard reset to get around this.
-     */
-    VBDEBUG(("TPM: soft reset detected\n", result));
-    return TPM_E_MUST_REBOOT;
-  } else if (result != TPM_SUCCESS) {
-    VBDEBUG(("TPM: TlclStartup returned %08x\n", result));
-    return result;
-  }
+	result = TlclStartup();
+	if (result == TPM_E_INVALID_POSTINIT) {
+		/*
+		 * Some prototype hardware doesn't reset the TPM on a CPU
+		 * reset.  We do a hard reset to get around this.
+		 */
+		VBDEBUG(("TPM: soft reset detected\n", result));
+		return TPM_E_MUST_REBOOT;
+	} else if (result != TPM_SUCCESS) {
+		VBDEBUG(("TPM: TlclStartup returned %08x\n", result));
+		return result;
+	}
 #else
-  RETURN_ON_FAILURE(TlclStartup());
+	RETURN_ON_FAILURE(TlclStartup());
 #endif
 
-  /* Some TPMs start the self test automatically at power on.  In that case we
+  /*
+   * Some TPMs start the self test automatically at power on.  In that case we
    * don't need to call ContinueSelfTest.  On some (other) TPMs,
    * ContinueSelfTest may block.  In that case, we definitely don't want to
    * call it here.  For TPMs in the intersection of these two sets, we're
@@ -346,225 +383,249 @@ uint32_t SetupTPM(int recovery_mode, int developer_mode,
 #ifdef TPM_BLOCKING_CONTINUESELFTEST
 #warning "lousy TPM!"
 #endif
-  RETURN_ON_FAILURE(TlclContinueSelfTest());
+	RETURN_ON_FAILURE(TlclContinueSelfTest());
 #endif
-  result = TlclAssertPhysicalPresence();
-  if (result != TPM_SUCCESS) {
-    /* It is possible that the TPM was delivered with the physical presence
-     * command disabled.  This tries enabling it, then tries asserting PP
-     * again.
-     */
-    RETURN_ON_FAILURE(TlclPhysicalPresenceCMDEnable());
-    RETURN_ON_FAILURE(TlclAssertPhysicalPresence());
-  }
-
-  /* Checks that the TPM is enabled and activated. */
-  RETURN_ON_FAILURE(TlclGetFlags(&disable, &deactivated, NULL));
-  if (disable || deactivated) {
-    VBDEBUG(("TPM: disabled (%d) or deactivated (%d).  Fixing...\n",
-             disable, deactivated));
-    RETURN_ON_FAILURE(TlclSetEnable());
-    RETURN_ON_FAILURE(TlclSetDeactivated(0));
-    VBDEBUG(("TPM: Must reboot to re-enable\n"));
-    return TPM_E_MUST_REBOOT;
-  }
-
-  /* Reads the firmware space. */
-  result = ReadSpaceFirmware(rsf);
-  if (TPM_E_BADINDEX == result) {
-    RollbackSpaceKernel rsk;
-
-    /* This is the first time we've run, and the TPM has not been
-     * initialized.  This initializes it. */
-    VBDEBUG(("TPM: Not initialized yet.\n"));
-    RETURN_ON_FAILURE(OneTimeInitializeTPM(rsf, &rsk));
-  } else if (TPM_SUCCESS != result) {
-    VBDEBUG(("TPM: Firmware space in a bad state; giving up.\n"));
-    return TPM_E_CORRUPTED_STATE;
-  }
-  VBDEBUG(("TPM: Firmware space sv%d f%x v%x\n",
-           rsf->struct_version, rsf->flags, rsf->fw_versions));
-  in_flags = rsf->flags;
-
-  /* If we've been asked to clear the virtual dev-mode flag, do so now */
-  if (disable_dev_request) {
-    rsf->flags &= ~FLAG_VIRTUAL_DEV_MODE_ON;
-    VBDEBUG(("TPM: Clearing virt dev-switch: f%x\n", rsf->flags));
-  }
-
-  /* The developer_mode value that's passed in is only set by a hardware
-   * dev-switch. We should OR it with the virtual switch, whether or not the
-   * virtual switch is used. If it's not used, it shouldn't change, so it
-   * doesn't matter. */
-  if (rsf->flags & FLAG_VIRTUAL_DEV_MODE_ON)
-    developer_mode = 1;
-
-  /* Clears ownership if developer flag has toggled, or if an owner-clear has
-   * been requested. */
-  if ((developer_mode ? FLAG_LAST_BOOT_DEVELOPER : 0) !=
-      (in_flags & FLAG_LAST_BOOT_DEVELOPER)) {
-    VBDEBUG(("TPM: Developer flag changed; clearing owner.\n"));
-    RETURN_ON_FAILURE(TPMClearAndReenable());
-  } else if (clear_tpm_owner_request) {
-    VBDEBUG(("TPM: Clearing owner as specifically requested.\n"));
-    RETURN_ON_FAILURE(TPMClearAndReenable());
-  }
-
-  if (developer_mode)
-    rsf->flags |= FLAG_LAST_BOOT_DEVELOPER;
-  else
-    rsf->flags &= ~FLAG_LAST_BOOT_DEVELOPER;
-
-
-  /* If firmware space is dirty, this flushes it back to the TPM */
-  if (rsf->flags != in_flags) {
-    VBDEBUG(("TPM: Updating firmware space.\n"));
-    RETURN_ON_FAILURE(WriteSpaceFirmware(rsf));
-  }
-
-  VBDEBUG(("TPM: SetupTPM() succeeded\n"));
-  return TPM_SUCCESS;
+	result = TlclAssertPhysicalPresence();
+	if (result != TPM_SUCCESS) {
+		/*
+		 * It is possible that the TPM was delivered with the physical
+		 * presence command disabled.  This tries enabling it, then
+		 * tries asserting PP again.
+		 */
+		RETURN_ON_FAILURE(TlclPhysicalPresenceCMDEnable());
+		RETURN_ON_FAILURE(TlclAssertPhysicalPresence());
+	}
+
+	/* Check that the TPM is enabled and activated. */
+	RETURN_ON_FAILURE(TlclGetFlags(&disable, &deactivated, NULL));
+	if (disable || deactivated) {
+		VBDEBUG(("TPM: disabled (%d) or deactivated (%d).  Fixing...\n",
+			 disable, deactivated));
+		RETURN_ON_FAILURE(TlclSetEnable());
+		RETURN_ON_FAILURE(TlclSetDeactivated(0));
+		VBDEBUG(("TPM: Must reboot to re-enable\n"));
+		return TPM_E_MUST_REBOOT;
+	}
+
+	/* Read the firmware space. */
+	result = ReadSpaceFirmware(rsf);
+	if (TPM_E_BADINDEX == result) {
+		RollbackSpaceKernel rsk;
+
+		/*
+		 * This is the first time we've run, and the TPM has not been
+		 * initialized.  Initialize it.
+		 */
+		VBDEBUG(("TPM: Not initialized yet.\n"));
+		RETURN_ON_FAILURE(OneTimeInitializeTPM(rsf, &rsk));
+	} else if (TPM_SUCCESS != result) {
+		VBDEBUG(("TPM: Firmware space in a bad state; giving up.\n"));
+		return TPM_E_CORRUPTED_STATE;
+	}
+	VBDEBUG(("TPM: Firmware space sv%d f%x v%x\n",
+		 rsf->struct_version, rsf->flags, rsf->fw_versions));
+	in_flags = rsf->flags;
+
+	/* If we've been asked to clear the virtual dev-mode flag, do so now */
+	if (disable_dev_request) {
+		rsf->flags &= ~FLAG_VIRTUAL_DEV_MODE_ON;
+		VBDEBUG(("TPM: Clearing virt dev-switch: f%x\n", rsf->flags));
+	}
+
+	/*
+	 * The developer_mode value that's passed in is only set by a hardware
+	 * dev-switch. We should OR it with the virtual switch, whether or not
+	 * the virtual switch is used. If it's not used, it shouldn't change,
+	 * so it doesn't matter.
+	 */
+	if (rsf->flags & FLAG_VIRTUAL_DEV_MODE_ON)
+		developer_mode = 1;
+
+	/*
+	 * Clear ownership if developer flag has toggled, or if an owner-clear
+	 * has been requested.
+	 */
+	if ((developer_mode ? FLAG_LAST_BOOT_DEVELOPER : 0) !=
+	    (in_flags & FLAG_LAST_BOOT_DEVELOPER)) {
+		VBDEBUG(("TPM: Developer flag changed; clearing owner.\n"));
+		RETURN_ON_FAILURE(TPMClearAndReenable());
+	} else if (clear_tpm_owner_request) {
+		VBDEBUG(("TPM: Clearing owner as specifically requested.\n"));
+		RETURN_ON_FAILURE(TPMClearAndReenable());
+	}
+
+	if (developer_mode)
+		rsf->flags |= FLAG_LAST_BOOT_DEVELOPER;
+	else
+		rsf->flags &= ~FLAG_LAST_BOOT_DEVELOPER;
+
+
+	/* If firmware space is dirty, flush it back to the TPM */
+	if (rsf->flags != in_flags) {
+		VBDEBUG(("TPM: Updating firmware space.\n"));
+		RETURN_ON_FAILURE(WriteSpaceFirmware(rsf));
+	}
+
+	VBDEBUG(("TPM: SetupTPM() succeeded\n"));
+	return TPM_SUCCESS;
 }
 
-/* disable MSVC warnings on unused arguments */
+/* Disable MSVC warnings on unused arguments */
 __pragma(warning (disable: 4100))
 
 
 #ifdef DISABLE_ROLLBACK_TPM
-
 /* Dummy implementations which don't support TPM rollback protection */
 
-uint32_t RollbackS3Resume(void) {
+uint32_t RollbackS3Resume(void)
+{
 #ifndef CHROMEOS_ENVIRONMENT
-  /* Initialize the TPM, but ignore return codes.  In ChromeOS
-   * environment, don't even talk to the TPM. */
-  TlclLibInit();
-  TlclResume();
+	/*
+	 * Initialize the TPM, but ignore return codes.  In ChromeOS
+	 * environment, don't even talk to the TPM.
+	 */
+	TlclLibInit();
+	TlclResume();
 #endif
-  return TPM_SUCCESS;
+	return TPM_SUCCESS;
 }
 
 uint32_t RollbackFirmwareSetup(int recovery_mode, int is_hw_dev,
                                int disable_dev_request,
                                int clear_tpm_owner_request,
-                               int *is_virt_dev, uint32_t *version) {
+                               int *is_virt_dev, uint32_t *version)
+{
 #ifndef CHROMEOS_ENVIRONMENT
-  /* Initialize the TPM, but ignores return codes.  In ChromeOS
-   * environment, don't even talk to the TPM. */
-  TlclLibInit();
-  TlclStartup();
-  TlclContinueSelfTest();
+	/*
+	 * Initialize the TPM, but ignores return codes.  In ChromeOS
+	 * environment, don't even talk to the TPM.
+	 */
+	TlclLibInit();
+	TlclStartup();
+	TlclContinueSelfTest();
 #endif
-  *version = 0;
-  return TPM_SUCCESS;
-}
-
-uint32_t RollbackFirmwareRead(uint32_t* version) {
-  *version = 0;
-  return TPM_SUCCESS;
+	*is_virt_dev = 0;
+	*version = 0;
+	return TPM_SUCCESS;
 }
 
-uint32_t RollbackFirmwareWrite(uint32_t version) {
-  return TPM_SUCCESS;
+uint32_t RollbackFirmwareWrite(uint32_t version)
+{
+	return TPM_SUCCESS;
 }
 
-uint32_t RollbackFirmwareLock(void) {
-  return TPM_SUCCESS;
+uint32_t RollbackFirmwareLock(void)
+{
+	return TPM_SUCCESS;
 }
 
-uint32_t RollbackKernelRead(uint32_t* version) {
-  *version = 0;
-  return TPM_SUCCESS;
+uint32_t RollbackKernelRead(uint32_t* version)
+{
+	*version = 0;
+	return TPM_SUCCESS;
 }
 
-uint32_t RollbackKernelWrite(uint32_t version) {
-  return TPM_SUCCESS;
+uint32_t RollbackKernelWrite(uint32_t version)
+{
+	return TPM_SUCCESS;
 }
 
-uint32_t RollbackKernelLock(void) {
-  return TPM_SUCCESS;
+uint32_t RollbackKernelLock(void)
+{
+	return TPM_SUCCESS;
 }
 
 #else
 
-uint32_t RollbackS3Resume(void) {
-  uint32_t result;
-  RETURN_ON_FAILURE(TlclLibInit());
-  result = TlclResume();
-  if (result == TPM_E_INVALID_POSTINIT) {
-    /* We're on a platform where the TPM maintains power in S3, so
-       it's already initialized. */
-    return TPM_SUCCESS;
-  }
-  return result;
+uint32_t RollbackS3Resume(void)
+{
+	uint32_t result;
+	RETURN_ON_FAILURE(TlclLibInit());
+	result = TlclResume();
+	if (result == TPM_E_INVALID_POSTINIT) {
+		/*
+		 * We're on a platform where the TPM maintains power in S3, so
+		 * it's already initialized.
+		 */
+		return TPM_SUCCESS;
+	}
+	return result;
 }
 
 uint32_t RollbackFirmwareSetup(int recovery_mode, int is_hw_dev,
                                int disable_dev_request,
                                int clear_tpm_owner_request,
-                               int *is_virt_dev, uint32_t *version) {
-  RollbackSpaceFirmware rsf;
-
-  /* Set version to 0 in case we fail */
-  *version = 0;
-
-  RETURN_ON_FAILURE(SetupTPM(recovery_mode, is_hw_dev, disable_dev_request,
-                             clear_tpm_owner_request, &rsf));
-  *version = rsf.fw_versions;
-  *is_virt_dev = (rsf.flags & FLAG_VIRTUAL_DEV_MODE_ON) ? 1 : 0;
-  VBDEBUG(("TPM: RollbackFirmwareSetup %x\n", (int)rsf.fw_versions));
-  return TPM_SUCCESS;
+                               int *is_virt_dev, uint32_t *version)
+{
+	RollbackSpaceFirmware rsf;
+
+	/* Set version to 0 in case we fail */
+	*version = 0;
+
+	RETURN_ON_FAILURE(SetupTPM(recovery_mode, is_hw_dev,
+				   disable_dev_request,
+				   clear_tpm_owner_request, &rsf));
+	*version = rsf.fw_versions;
+	*is_virt_dev = (rsf.flags & FLAG_VIRTUAL_DEV_MODE_ON) ? 1 : 0;
+	VBDEBUG(("TPM: RollbackFirmwareSetup %x\n", (int)rsf.fw_versions));
+	return TPM_SUCCESS;
 }
 
-uint32_t RollbackFirmwareWrite(uint32_t version) {
-  RollbackSpaceFirmware rsf;
+uint32_t RollbackFirmwareWrite(uint32_t version)
+{
+	RollbackSpaceFirmware rsf;
 
-  RETURN_ON_FAILURE(ReadSpaceFirmware(&rsf));
-  VBDEBUG(("TPM: RollbackFirmwareWrite %x --> %x\n", (int)rsf.fw_versions,
-           (int)version));
-  rsf.fw_versions = version;
-  return WriteSpaceFirmware(&rsf);
+	RETURN_ON_FAILURE(ReadSpaceFirmware(&rsf));
+	VBDEBUG(("TPM: RollbackFirmwareWrite %x --> %x\n", (int)rsf.fw_versions,
+		 (int)version));
+	rsf.fw_versions = version;
+	return WriteSpaceFirmware(&rsf);
 }
 
-uint32_t RollbackFirmwareLock(void) {
-  return TlclSetGlobalLock();
+uint32_t RollbackFirmwareLock(void)
+{
+	return TlclSetGlobalLock();
 }
 
-uint32_t RollbackKernelRead(uint32_t* version) {
-  RollbackSpaceKernel rsk;
-  uint32_t perms;
-
-  /* Read the kernel space and verify its permissions.  If the kernel
-   * space has the wrong permission, or it doesn't contain the right
-   * identifier, we give up.  This will need to be fixed by the
-   * recovery kernel.  We have to worry about this because at any time
-   * (even with PP turned off) the TPM owner can remove and redefine a
-   * PP-protected space (but not write to it). */
-  RETURN_ON_FAILURE(ReadSpaceKernel(&rsk));
-  RETURN_ON_FAILURE(TlclGetPermissions(KERNEL_NV_INDEX, &perms));
-  if (TPM_NV_PER_PPWRITE != perms || ROLLBACK_SPACE_KERNEL_UID != rsk.uid)
-    return TPM_E_CORRUPTED_STATE;
-
-  *version = rsk.kernel_versions;
-  VBDEBUG(("TPM: RollbackKernelRead %x\n", (int)rsk.kernel_versions));
-  return TPM_SUCCESS;
+uint32_t RollbackKernelRead(uint32_t* version)
+{
+	RollbackSpaceKernel rsk;
+	uint32_t perms;
+
+	/*
+	 * Read the kernel space and verify its permissions.  If the kernel
+	 * space has the wrong permission, or it doesn't contain the right
+	 * identifier, we give up.  This will need to be fixed by the
+	 * recovery kernel.  We have to worry about this because at any time
+	 * (even with PP turned off) the TPM owner can remove and redefine a
+	 * PP-protected space (but not write to it).
+	 */
+	RETURN_ON_FAILURE(ReadSpaceKernel(&rsk));
+	RETURN_ON_FAILURE(TlclGetPermissions(KERNEL_NV_INDEX, &perms));
+	if (TPM_NV_PER_PPWRITE != perms || ROLLBACK_SPACE_KERNEL_UID != rsk.uid)
+		return TPM_E_CORRUPTED_STATE;
+
+	*version = rsk.kernel_versions;
+	VBDEBUG(("TPM: RollbackKernelRead %x\n", (int)rsk.kernel_versions));
+	return TPM_SUCCESS;
 }
 
-uint32_t RollbackKernelWrite(uint32_t version) {
-  RollbackSpaceKernel rsk;
-  RETURN_ON_FAILURE(ReadSpaceKernel(&rsk));
-  VBDEBUG(("TPM: RollbackKernelWrite %x --> %x\n", (int)rsk.kernel_versions,
-           (int)version));
-  rsk.kernel_versions = version;
-  return WriteSpaceKernel(&rsk);
+uint32_t RollbackKernelWrite(uint32_t version)
+{
+	RollbackSpaceKernel rsk;
+	RETURN_ON_FAILURE(ReadSpaceKernel(&rsk));
+	VBDEBUG(("TPM: RollbackKernelWrite %x --> %x\n",
+		 (int)rsk.kernel_versions, (int)version));
+	rsk.kernel_versions = version;
+	return WriteSpaceKernel(&rsk);
 }
 
-uint32_t RollbackKernelLock(void) {
-  if (g_rollback_recovery_mode) {
-    return TPM_SUCCESS;
-  } else {
-    return TlclLockPhysicalPresence();
-  }
+uint32_t RollbackKernelLock(void)
+{
+	if (g_rollback_recovery_mode)
+		return TPM_SUCCESS;
+	else
+		return TlclLockPhysicalPresence();
 }
 
-#endif // DISABLE_ROLLBACK_TPM
+#endif /* DISABLE_ROLLBACK_TPM */
diff --git a/tests/rollback_index2_tests.c b/tests/rollback_index2_tests.c
index 4a12a6e2..b670812d 100644
--- a/tests/rollback_index2_tests.c
+++ b/tests/rollback_index2_tests.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2012 The Chromium OS Authors. All rights reserved.
+/* Copyright (c) 2013 The Chromium OS Authors. All rights reserved.
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  *
@@ -18,7 +18,8 @@
 #include "utility.h"
 #include "vboot_common.h"
 
-/* Buffer to hold accumulated list of calls to mocked Tlcl functions.
+/*
+ * Buffer to hold accumulated list of calls to mocked Tlcl functions.
  * Each function appends itself to the buffer and updates mock_cnext.
  *
  * Size of mock_calls[] should be big enough to handle all expected
@@ -28,13 +29,16 @@
  * making all the mock implementations bigger.  If this were code used
  * outside of unit tests we'd want to do that, but here if we did
  * overrun the buffer the worst that's likely to happen is we'll crash
- * the test, and crash = failure anyway. */
+ * the test, and crash = failure anyway.
+ */
 static char mock_calls[16384];
 static char *mock_cnext = mock_calls;
 
-/* Variables to support mocked error values from Tlcl functions.  Each
+/*
+ * Variables to support mocked error values from Tlcl functions.  Each
  * call, mock_count is incremented.  If mock_count==fail_at_count, return
- * fail_with_error instead of the normal return value. */
+ * fail_with_error instead of the normal return value.
+ */
 static int mock_count = 0;
 static int fail_at_count = 0;
 static uint32_t fail_with_error = TPM_SUCCESS;
@@ -44,7 +48,6 @@ static uint32_t fail_with_error = TPM_SUCCESS;
 static int noise_count = 0;             /* read/write attempt (zero-based) */
 static int noise_on[MAX_NOISE_COUNT];   /* calls to inject noise on */
 
-
 /* Params / backing store for mocked Tlcl functions. */
 static TPM_PERMANENT_FLAGS mock_pflags;
 static RollbackSpaceFirmware mock_rsf;
@@ -52,858 +55,937 @@ static RollbackSpaceKernel mock_rsk;
 static uint32_t mock_permissions;
 
 /* Reset the variables for the Tlcl mock functions. */
-static void ResetMocks(int fail_on_call, uint32_t fail_with_err) {
-  *mock_calls = 0;
-  mock_cnext = mock_calls;
-  mock_count = 0;
-  fail_at_count = fail_on_call;
-  fail_with_error = fail_with_err;
-  noise_count = 0;
-  Memset(&noise_on, 0, sizeof(noise_on));
-
-  Memset(&mock_pflags, 0, sizeof(mock_pflags));
-  Memset(&mock_rsf, 0, sizeof(mock_rsf));
-  Memset(&mock_rsk, 0, sizeof(mock_rsk));
-  mock_permissions = 0;
+static void ResetMocks(int fail_on_call, uint32_t fail_with_err)
+{
+	*mock_calls = 0;
+	mock_cnext = mock_calls;
+	mock_count = 0;
+	fail_at_count = fail_on_call;
+	fail_with_error = fail_with_err;
+	noise_count = 0;
+	Memset(&noise_on, 0, sizeof(noise_on));
+
+	Memset(&mock_pflags, 0, sizeof(mock_pflags));
+	Memset(&mock_rsf, 0, sizeof(mock_rsf));
+	Memset(&mock_rsk, 0, sizeof(mock_rsk));
+	mock_permissions = 0;
 }
 
 /****************************************************************************/
 /* Function to garble data on its way to or from the TPM */
-static void MaybeInjectNoise(void* data, uint32_t length) {
-  if (noise_count < MAX_NOISE_COUNT && noise_on[noise_count]) {
-    uint8_t *val = data;
-    val[length-1]++;
-  }
-  noise_count++;
+static void MaybeInjectNoise(void *data, uint32_t length)
+{
+	if (noise_count < MAX_NOISE_COUNT && noise_on[noise_count]) {
+		uint8_t *val = data;
+		val[length - 1]++;
+	}
+	noise_count++;
 }
 
 /****************************************************************************/
 /* Mocks for tlcl functions which log the calls made to mock_calls[]. */
 
-uint32_t TlclLibInit(void) {
-  mock_cnext += sprintf(mock_cnext, "TlclLibInit()\n");
-  return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
+uint32_t TlclLibInit(void)
+{
+	mock_cnext += sprintf(mock_cnext, "TlclLibInit()\n");
+	return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
 }
 
-uint32_t TlclStartup(void) {
-  mock_cnext += sprintf(mock_cnext, "TlclStartup()\n");
-  return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
+uint32_t TlclStartup(void)
+{
+	mock_cnext += sprintf(mock_cnext, "TlclStartup()\n");
+	return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
 }
 
-uint32_t TlclResume(void) {
-  mock_cnext += sprintf(mock_cnext, "TlclResume()\n");
-  return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
+uint32_t TlclResume(void)
+{
+	mock_cnext += sprintf(mock_cnext, "TlclResume()\n");
+	return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
 }
 
-uint32_t TlclForceClear(void) {
-  mock_cnext += sprintf(mock_cnext, "TlclForceClear()\n");
-  return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
+uint32_t TlclForceClear(void)
+{
+	mock_cnext += sprintf(mock_cnext, "TlclForceClear()\n");
+	return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
 }
 
-uint32_t TlclSetEnable(void) {
-  mock_cnext += sprintf(mock_cnext, "TlclSetEnable()\n");
-  return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
+uint32_t TlclSetEnable(void)
+{
+	mock_cnext += sprintf(mock_cnext, "TlclSetEnable()\n");
+	return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
 }
 
-uint32_t TlclSetDeactivated(uint8_t flag) {
-  mock_cnext += sprintf(mock_cnext, "TlclSetDeactivated(%d)\n", flag);
-  return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
+uint32_t TlclSetDeactivated(uint8_t flag)
+{
+	mock_cnext += sprintf(mock_cnext, "TlclSetDeactivated(%d)\n", flag);
+	return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
 }
 
-uint32_t TlclRead(uint32_t index, void* data, uint32_t length) {
-  mock_cnext += sprintf(mock_cnext, "TlclRead(0x%x, %d)\n", index, length);
-
-  if (FIRMWARE_NV_INDEX == index) {
-    TEST_EQ(length, sizeof(mock_rsf), "TlclRead rsf size");
-    Memcpy(data, &mock_rsf, length);
-    MaybeInjectNoise(data, length);
-  } else if (KERNEL_NV_INDEX == index) {
-    TEST_EQ(length, sizeof(mock_rsk), "TlclRead rsk size");
-    Memcpy(data, &mock_rsk, length);
-    MaybeInjectNoise(data, length);
-  } else {
-    Memset(data, 0, length);
-  }
-
-  return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
+uint32_t TlclRead(uint32_t index, void* data, uint32_t length)
+{
+	mock_cnext += sprintf(mock_cnext, "TlclRead(0x%x, %d)\n",
+			      index, length);
+
+	if (FIRMWARE_NV_INDEX == index) {
+		TEST_EQ(length, sizeof(mock_rsf), "TlclRead rsf size");
+		Memcpy(data, &mock_rsf, length);
+		MaybeInjectNoise(data, length);
+	} else if (KERNEL_NV_INDEX == index) {
+		TEST_EQ(length, sizeof(mock_rsk), "TlclRead rsk size");
+		Memcpy(data, &mock_rsk, length);
+		MaybeInjectNoise(data, length);
+	} else {
+		Memset(data, 0, length);
+	}
+
+	return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
 }
 
-uint32_t TlclWrite(uint32_t index, const void* data, uint32_t length) {
-  mock_cnext += sprintf(mock_cnext, "TlclWrite(0x%x, %d)\n", index, length);
-
-  if (FIRMWARE_NV_INDEX == index) {
-    TEST_EQ(length, sizeof(mock_rsf), "TlclWrite rsf size");
-    Memcpy(&mock_rsf, data, length);
-    MaybeInjectNoise(&mock_rsf, length);
-  } else if (KERNEL_NV_INDEX == index) {
-    TEST_EQ(length, sizeof(mock_rsk), "TlclWrite rsk size");
-    Memcpy(&mock_rsk, data, length);
-    MaybeInjectNoise(&mock_rsk, length);
-  }
-
-  return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
+uint32_t TlclWrite(uint32_t index, const void *data, uint32_t length)
+{
+	mock_cnext += sprintf(mock_cnext, "TlclWrite(0x%x, %d)\n",
+			      index, length);
+
+	if (FIRMWARE_NV_INDEX == index) {
+		TEST_EQ(length, sizeof(mock_rsf), "TlclWrite rsf size");
+		Memcpy(&mock_rsf, data, length);
+		MaybeInjectNoise(&mock_rsf, length);
+	} else if (KERNEL_NV_INDEX == index) {
+		TEST_EQ(length, sizeof(mock_rsk), "TlclWrite rsk size");
+		Memcpy(&mock_rsk, data, length);
+		MaybeInjectNoise(&mock_rsk, length);
+	}
+
+	return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
 }
 
-uint32_t TlclDefineSpace(uint32_t index, uint32_t perm, uint32_t size) {
-  mock_cnext += sprintf(mock_cnext, "TlclDefineSpace(0x%x, 0x%x, %d)\n",
-                   index, perm, size);
-  return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
+uint32_t TlclDefineSpace(uint32_t index, uint32_t perm, uint32_t size)
+{
+	mock_cnext += sprintf(mock_cnext, "TlclDefineSpace(0x%x, 0x%x, %d)\n",
+			      index, perm, size);
+	return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
 }
 
-uint32_t TlclSelfTestFull(void) {
-  mock_cnext += sprintf(mock_cnext, "TlclSelfTestFull()\n");
-  return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
+uint32_t TlclSelfTestFull(void)
+{
+	mock_cnext += sprintf(mock_cnext, "TlclSelfTestFull()\n");
+	return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
 }
 
-uint32_t TlclContinueSelfTest(void) {
-  mock_cnext += sprintf(mock_cnext, "TlclContinueSelfTest()\n");
-  return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
+uint32_t TlclContinueSelfTest(void)
+{
+	mock_cnext += sprintf(mock_cnext, "TlclContinueSelfTest()\n");
+	return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
 }
 
-uint32_t TlclGetPermanentFlags(TPM_PERMANENT_FLAGS* pflags) {
-  mock_cnext += sprintf(mock_cnext, "TlclGetPermanentFlags()\n");
-  Memcpy(pflags, &mock_pflags, sizeof(mock_pflags));
-  return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
+uint32_t TlclGetPermanentFlags(TPM_PERMANENT_FLAGS *pflags)
+{
+	mock_cnext += sprintf(mock_cnext, "TlclGetPermanentFlags()\n");
+	Memcpy(pflags, &mock_pflags, sizeof(mock_pflags));
+	return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
 }
 
 /* TlclGetFlags() doesn't need mocking; it calls TlclGetPermanentFlags() */
 
-uint32_t TlclAssertPhysicalPresence(void) {
-  mock_cnext += sprintf(mock_cnext, "TlclAssertPhysicalPresence()\n");
-  return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
+uint32_t TlclAssertPhysicalPresence(void)
+{
+	mock_cnext += sprintf(mock_cnext, "TlclAssertPhysicalPresence()\n");
+	return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
 }
 
-uint32_t TlclFinalizePhysicalPresence(void) {
-  mock_cnext += sprintf(mock_cnext, "TlclFinalizePhysicalPresence()\n");
-  mock_pflags.physicalPresenceLifetimeLock = 1;
-  return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
+uint32_t TlclFinalizePhysicalPresence(void)
+{
+	mock_cnext += sprintf(mock_cnext, "TlclFinalizePhysicalPresence()\n");
+	mock_pflags.physicalPresenceLifetimeLock = 1;
+	return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
 }
 
-uint32_t TlclPhysicalPresenceCMDEnable(void) {
-  mock_cnext += sprintf(mock_cnext, "TlclPhysicalPresenceCMDEnable()\n");
-  return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
+uint32_t TlclPhysicalPresenceCMDEnable(void)
+{
+	mock_cnext += sprintf(mock_cnext, "TlclPhysicalPresenceCMDEnable()\n");
+	return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
 }
 
-uint32_t TlclSetNvLocked(void) {
-  mock_cnext += sprintf(mock_cnext, "TlclSetNvLocked()\n");
-  mock_pflags.nvLocked = 1;
-  return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
+uint32_t TlclSetNvLocked(void)
+{
+	mock_cnext += sprintf(mock_cnext, "TlclSetNvLocked()\n");
+	mock_pflags.nvLocked = 1;
+	return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
 }
 
-uint32_t TlclSetGlobalLock(void) {
-  mock_cnext += sprintf(mock_cnext, "TlclSetGlobalLock()\n");
-  return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
+uint32_t TlclSetGlobalLock(void)
+{
+	mock_cnext += sprintf(mock_cnext, "TlclSetGlobalLock()\n");
+	return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
 }
 
-uint32_t TlclLockPhysicalPresence(void) {
-  mock_cnext += sprintf(mock_cnext, "TlclLockPhysicalPresence()\n");
-  return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
+uint32_t TlclLockPhysicalPresence(void)
+{
+	mock_cnext += sprintf(mock_cnext, "TlclLockPhysicalPresence()\n");
+	return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
 }
 
-uint32_t TlclGetPermissions(uint32_t index, uint32_t* permissions) {
-  mock_cnext += sprintf(mock_cnext, "TlclGetPermissions(0x%x)\n", index);
-  *permissions = mock_permissions;
-  return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
+uint32_t TlclGetPermissions(uint32_t index, uint32_t* permissions)
+{
+	mock_cnext += sprintf(mock_cnext, "TlclGetPermissions(0x%x)\n", index);
+	*permissions = mock_permissions;
+	return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
 }
 
-
 /****************************************************************************/
 /* Tests for CRC errors  */
 
-extern uint32_t ReadSpaceFirmware(RollbackSpaceFirmware* rsf);
-extern uint32_t WriteSpaceFirmware(RollbackSpaceFirmware* rsf);
-
-static void CrcTestFirmware(void) {
-  RollbackSpaceFirmware rsf;
-
-  /* noise on reading, shouldn't matter here because version == 0 */
-  ResetMocks(0, 0);
-  noise_on[0] = 1;
-  TEST_EQ(ReadSpaceFirmware(&rsf), 0, "ReadSpaceFirmware(), v0");
-  TEST_STR_EQ(mock_calls,
-              "TlclRead(0x1007, 10)\n",
-              "tlcl calls");
-
-  /* But if the version >= 2, it will try three times and fail because the CRC
-   * is no good. */
-  ResetMocks(0, 0);
-  mock_rsf.struct_version = 2;
-  TEST_EQ(ReadSpaceFirmware(&rsf), TPM_E_CORRUPTED_STATE,
-          "ReadSpaceFirmware(), v2, bad CRC");
-  TEST_STR_EQ(mock_calls,
-              "TlclRead(0x1007, 10)\n"
-              "TlclRead(0x1007, 10)\n"
-              "TlclRead(0x1007, 10)\n",
-              "tlcl calls");
-
-  /* OTOH, if the CRC is good and some noise happens, it should recover. */
-  ResetMocks(0, 0);
-  mock_rsf.struct_version = 2;
-  mock_rsf.crc8 = Crc8(&mock_rsf, offsetof(RollbackSpaceFirmware, crc8));
-  noise_on[0] = 1;
-  TEST_EQ(ReadSpaceFirmware(&rsf), 0, "ReadSpaceFirmware(), v2, good CRC");
-  TEST_STR_EQ(mock_calls,
-              "TlclRead(0x1007, 10)\n"
-              "TlclRead(0x1007, 10)\n",
-              "tlcl calls");
-
-  /* A write with version < 2 should convert to v2 and create the CRC */
-  ResetMocks(0, 0);
-  Memset(&rsf, 0, sizeof(rsf));
-  TEST_EQ(WriteSpaceFirmware(&rsf), 0, "WriteSpaceFirmware(), v0");
-  TEST_EQ(mock_rsf.struct_version, 2, "WriteSpaceFirmware(), check v2");
-  TEST_STR_EQ(mock_calls,
-              "TlclWrite(0x1007, 10)\n"
-              "TlclRead(0x1007, 10)\n",
-              "tlcl calls");
-
-  /* Same as above, but with some noise during the readback */
-  ResetMocks(0, 0);
-  Memset(&rsf, 0, sizeof(rsf));
-  noise_on[1] = 1;
-  noise_on[2] = 1;
-  TEST_EQ(WriteSpaceFirmware(&rsf), 0, "WriteSpaceFirmware(), read noise");
-  TEST_STR_EQ(mock_calls,
-              "TlclWrite(0x1007, 10)\n"
-              "TlclRead(0x1007, 10)\n"
-              "TlclRead(0x1007, 10)\n"
-              "TlclRead(0x1007, 10)\n",
-              "tlcl calls");
-
-  /* With noise during the write, we'll try the write again */
-  ResetMocks(0, 0);
-  Memset(&rsf, 0, sizeof(rsf));
-  noise_on[0] = 1;
-  TEST_EQ(WriteSpaceFirmware(&rsf), 0, "WriteSpaceFirmware(), write noise");
-  TEST_EQ(mock_rsf.struct_version, 2, "WriteSpaceFirmware(), check v2");
-  TEST_STR_EQ(mock_calls,
-              "TlclWrite(0x1007, 10)\n"
-              "TlclRead(0x1007, 10)\n"
-              "TlclRead(0x1007, 10)\n"
-              "TlclRead(0x1007, 10)\n"
-              "TlclWrite(0x1007, 10)\n"
-              "TlclRead(0x1007, 10)\n",
-              "tlcl calls");
-
-  /* Only if it just keeps on failing forever do we eventually give up */
-  ResetMocks(0, 0);
-  Memset(&rsf, 0, sizeof(rsf));
-  Memset(noise_on, 1, sizeof(noise_on));
-  TEST_EQ(WriteSpaceFirmware(&rsf), TPM_E_CORRUPTED_STATE,
-          "WriteSpaceFirmware(), always noise");
-  TEST_STR_EQ(mock_calls,
-              "TlclWrite(0x1007, 10)\n"
-              "TlclRead(0x1007, 10)\n"
-              "TlclRead(0x1007, 10)\n"
-              "TlclRead(0x1007, 10)\n"
-              "TlclWrite(0x1007, 10)\n"
-              "TlclRead(0x1007, 10)\n"
-              "TlclRead(0x1007, 10)\n"
-              "TlclRead(0x1007, 10)\n"
-              "TlclWrite(0x1007, 10)\n"
-              "TlclRead(0x1007, 10)\n"
-              "TlclRead(0x1007, 10)\n"
-              "TlclRead(0x1007, 10)\n",
-              "tlcl calls");
+extern uint32_t ReadSpaceFirmware(RollbackSpaceFirmware *rsf);
+extern uint32_t WriteSpaceFirmware(RollbackSpaceFirmware *rsf);
+
+static void CrcTestFirmware(void)
+{
+	RollbackSpaceFirmware rsf;
+
+	/* Noise on reading, shouldn't matter here because version == 0 */
+	ResetMocks(0, 0);
+	noise_on[0] = 1;
+	TEST_EQ(ReadSpaceFirmware(&rsf), 0, "ReadSpaceFirmware(), v0");
+	TEST_STR_EQ(mock_calls,
+		    "TlclRead(0x1007, 10)\n",
+		    "tlcl calls");
+
+	/*
+	 * But if the version >= 2, it will try three times and fail because
+	 * the CRC is no good.
+	 */
+	ResetMocks(0, 0);
+	mock_rsf.struct_version = 2;
+	TEST_EQ(ReadSpaceFirmware(&rsf), TPM_E_CORRUPTED_STATE,
+		"ReadSpaceFirmware(), v2, bad CRC");
+	TEST_STR_EQ(mock_calls,
+		    "TlclRead(0x1007, 10)\n"
+		    "TlclRead(0x1007, 10)\n"
+		    "TlclRead(0x1007, 10)\n",
+		    "tlcl calls");
+
+	/* If the CRC is good and some noise happens, it should recover. */
+	ResetMocks(0, 0);
+	mock_rsf.struct_version = 2;
+	mock_rsf.crc8 = Crc8(&mock_rsf, offsetof(RollbackSpaceFirmware, crc8));
+	noise_on[0] = 1;
+	TEST_EQ(ReadSpaceFirmware(&rsf), 0,
+		"ReadSpaceFirmware(), v2, good CRC");
+	TEST_STR_EQ(mock_calls,
+		    "TlclRead(0x1007, 10)\n"
+		    "TlclRead(0x1007, 10)\n",
+		    "tlcl calls");
+
+	/* A write with version < 2 should convert to v2 and create the CRC */
+	ResetMocks(0, 0);
+	Memset(&rsf, 0, sizeof(rsf));
+	TEST_EQ(WriteSpaceFirmware(&rsf), 0, "WriteSpaceFirmware(), v0");
+	TEST_EQ(mock_rsf.struct_version, 2, "WriteSpaceFirmware(), check v2");
+	TEST_STR_EQ(mock_calls,
+		    "TlclWrite(0x1007, 10)\n"
+		    "TlclRead(0x1007, 10)\n",
+		    "tlcl calls");
+
+	/* Same as above, but with some noise during the readback */
+	ResetMocks(0, 0);
+	Memset(&rsf, 0, sizeof(rsf));
+	noise_on[1] = 1;
+	noise_on[2] = 1;
+	TEST_EQ(WriteSpaceFirmware(&rsf), 0,
+		"WriteSpaceFirmware(), read noise");
+	TEST_STR_EQ(mock_calls,
+		    "TlclWrite(0x1007, 10)\n"
+		    "TlclRead(0x1007, 10)\n"
+		    "TlclRead(0x1007, 10)\n"
+		    "TlclRead(0x1007, 10)\n",
+		    "tlcl calls");
+
+	/* With noise during the write, we'll try the write again */
+	ResetMocks(0, 0);
+	Memset(&rsf, 0, sizeof(rsf));
+	noise_on[0] = 1;
+	TEST_EQ(WriteSpaceFirmware(&rsf), 0,
+		"WriteSpaceFirmware(), write noise");
+	TEST_EQ(mock_rsf.struct_version, 2, "WriteSpaceFirmware(), check v2");
+	TEST_STR_EQ(mock_calls,
+		    "TlclWrite(0x1007, 10)\n"
+		    "TlclRead(0x1007, 10)\n"
+		    "TlclRead(0x1007, 10)\n"
+		    "TlclRead(0x1007, 10)\n"
+		    "TlclWrite(0x1007, 10)\n"
+		    "TlclRead(0x1007, 10)\n",
+		    "tlcl calls");
+
+	/* Only if it just keeps on failing forever do we eventually give up */
+	ResetMocks(0, 0);
+	Memset(&rsf, 0, sizeof(rsf));
+	Memset(noise_on, 1, sizeof(noise_on));
+	TEST_EQ(WriteSpaceFirmware(&rsf), TPM_E_CORRUPTED_STATE,
+		"WriteSpaceFirmware(), always noise");
+	TEST_STR_EQ(mock_calls,
+		    "TlclWrite(0x1007, 10)\n"
+		    "TlclRead(0x1007, 10)\n"
+		    "TlclRead(0x1007, 10)\n"
+		    "TlclRead(0x1007, 10)\n"
+		    "TlclWrite(0x1007, 10)\n"
+		    "TlclRead(0x1007, 10)\n"
+		    "TlclRead(0x1007, 10)\n"
+		    "TlclRead(0x1007, 10)\n"
+		    "TlclWrite(0x1007, 10)\n"
+		    "TlclRead(0x1007, 10)\n"
+		    "TlclRead(0x1007, 10)\n"
+		    "TlclRead(0x1007, 10)\n",
+		    "tlcl calls");
 }
 
-extern uint32_t ReadSpaceKernel(RollbackSpaceKernel* rsk);
-extern uint32_t WriteSpaceKernel(RollbackSpaceKernel* rsk);
-
-static void CrcTestKernel(void) {
-  RollbackSpaceKernel rsk;
-
-  /* noise on reading, shouldn't matter here because version == 0 */
-  ResetMocks(0, 0);
-  noise_on[0] = 1;
-  TEST_EQ(ReadSpaceKernel(&rsk), 0, "ReadSpaceKernel(), v0");
-  TEST_STR_EQ(mock_calls,
-              "TlclRead(0x1008, 13)\n",
-              "tlcl calls");
-
-  /* But if the version >= 2, it will try three times and fail because the CRC
-   * is no good. */
-  ResetMocks(0, 0);
-  mock_rsk.struct_version = 2;
-  TEST_EQ(ReadSpaceKernel(&rsk), TPM_E_CORRUPTED_STATE,
-          "ReadSpaceKernel(), v2, bad CRC");
-  TEST_STR_EQ(mock_calls,
-              "TlclRead(0x1008, 13)\n"
-              "TlclRead(0x1008, 13)\n"
-              "TlclRead(0x1008, 13)\n",
-              "tlcl calls");
-
-  /* OTOH, if the CRC is good and some noise happens, it should recover. */
-  ResetMocks(0, 0);
-  mock_rsk.struct_version = 2;
-  mock_rsk.crc8 = Crc8(&mock_rsk, offsetof(RollbackSpaceKernel, crc8));
-  noise_on[0] = 1;
-  TEST_EQ(ReadSpaceKernel(&rsk), 0, "ReadSpaceKernel(), v2, good CRC");
-  TEST_STR_EQ(mock_calls,
-              "TlclRead(0x1008, 13)\n"
-              "TlclRead(0x1008, 13)\n",
-              "tlcl calls");
-
-  /* A write with version < 2 should convert to v2 and create the CRC */
-  ResetMocks(0, 0);
-  Memset(&rsk, 0, sizeof(rsk));
-  TEST_EQ(WriteSpaceKernel(&rsk), 0, "WriteSpaceKernel(), v0");
-  TEST_EQ(mock_rsk.struct_version, 2, "WriteSpaceKernel(), check v2");
-  TEST_STR_EQ(mock_calls,
-              "TlclWrite(0x1008, 13)\n"
-              "TlclRead(0x1008, 13)\n",
-              "tlcl calls");
-
-  /* Same as above, but with some noise during the readback */
-  ResetMocks(0, 0);
-  Memset(&rsk, 0, sizeof(rsk));
-  noise_on[1] = 1;
-  noise_on[2] = 1;
-  TEST_EQ(WriteSpaceKernel(&rsk), 0, "WriteSpaceKernel(), read noise");
-  TEST_STR_EQ(mock_calls,
-              "TlclWrite(0x1008, 13)\n"
-              "TlclRead(0x1008, 13)\n"
-              "TlclRead(0x1008, 13)\n"
-              "TlclRead(0x1008, 13)\n",
-              "tlcl calls");
-
-  /* With noise during the write, we'll try the write again */
-  ResetMocks(0, 0);
-  Memset(&rsk, 0, sizeof(rsk));
-  noise_on[0] = 1;
-  TEST_EQ(WriteSpaceKernel(&rsk), 0, "WriteSpaceKernel(), write noise");
-  TEST_EQ(mock_rsk.struct_version, 2, "WriteSpaceKernel(), check v2");
-  TEST_STR_EQ(mock_calls,
-              "TlclWrite(0x1008, 13)\n"
-              "TlclRead(0x1008, 13)\n"
-              "TlclRead(0x1008, 13)\n"
-              "TlclRead(0x1008, 13)\n"
-              "TlclWrite(0x1008, 13)\n"
-              "TlclRead(0x1008, 13)\n",
-              "tlcl calls");
-
-  /* Only if it just keeps on failing forever do we eventually give up */
-  ResetMocks(0, 0);
-  Memset(&rsk, 0, sizeof(rsk));
-  Memset(noise_on, 1, sizeof(noise_on));
-  TEST_EQ(WriteSpaceKernel(&rsk), TPM_E_CORRUPTED_STATE,
-          "WriteSpaceKernel(), always noise");
-  TEST_STR_EQ(mock_calls,
-              "TlclWrite(0x1008, 13)\n"
-              "TlclRead(0x1008, 13)\n"
-              "TlclRead(0x1008, 13)\n"
-              "TlclRead(0x1008, 13)\n"
-              "TlclWrite(0x1008, 13)\n"
-              "TlclRead(0x1008, 13)\n"
-              "TlclRead(0x1008, 13)\n"
-              "TlclRead(0x1008, 13)\n"
-              "TlclWrite(0x1008, 13)\n"
-              "TlclRead(0x1008, 13)\n"
-              "TlclRead(0x1008, 13)\n"
-              "TlclRead(0x1008, 13)\n",
-              "tlcl calls");
+extern uint32_t ReadSpaceKernel(RollbackSpaceKernel *rsk);
+extern uint32_t WriteSpaceKernel(RollbackSpaceKernel *rsk);
+
+static void CrcTestKernel(void)
+{
+	RollbackSpaceKernel rsk;
+
+	/* Noise on reading shouldn't matter here because version == 0 */
+	ResetMocks(0, 0);
+	noise_on[0] = 1;
+	TEST_EQ(ReadSpaceKernel(&rsk), 0, "ReadSpaceKernel(), v0");
+	TEST_STR_EQ(mock_calls,
+		    "TlclRead(0x1008, 13)\n",
+		    "tlcl calls");
+
+	/*
+	 * But if the version >= 2, it will try three times and fail because
+	 * the CRC is no good.
+	 */
+	ResetMocks(0, 0);
+	mock_rsk.struct_version = 2;
+	TEST_EQ(ReadSpaceKernel(&rsk), TPM_E_CORRUPTED_STATE,
+		"ReadSpaceKernel(), v2, bad CRC");
+	TEST_STR_EQ(mock_calls,
+		    "TlclRead(0x1008, 13)\n"
+		    "TlclRead(0x1008, 13)\n"
+		    "TlclRead(0x1008, 13)\n",
+		    "tlcl calls");
+
+	/* If the CRC is good and some noise happens, it should recover. */
+	ResetMocks(0, 0);
+	mock_rsk.struct_version = 2;
+	mock_rsk.crc8 = Crc8(&mock_rsk, offsetof(RollbackSpaceKernel, crc8));
+	noise_on[0] = 1;
+	TEST_EQ(ReadSpaceKernel(&rsk), 0, "ReadSpaceKernel(), v2, good CRC");
+	TEST_STR_EQ(mock_calls,
+		    "TlclRead(0x1008, 13)\n"
+		    "TlclRead(0x1008, 13)\n",
+		    "tlcl calls");
+
+	/* A write with version < 2 should convert to v2 and create the CRC */
+	ResetMocks(0, 0);
+	Memset(&rsk, 0, sizeof(rsk));
+	TEST_EQ(WriteSpaceKernel(&rsk), 0, "WriteSpaceKernel(), v0");
+	TEST_EQ(mock_rsk.struct_version, 2, "WriteSpaceKernel(), check v2");
+	TEST_STR_EQ(mock_calls,
+		    "TlclWrite(0x1008, 13)\n"
+		    "TlclRead(0x1008, 13)\n",
+		    "tlcl calls");
+
+	/* Same as above, but with some noise during the readback */
+	ResetMocks(0, 0);
+	Memset(&rsk, 0, sizeof(rsk));
+	noise_on[1] = 1;
+	noise_on[2] = 1;
+	TEST_EQ(WriteSpaceKernel(&rsk), 0, "WriteSpaceKernel(), read noise");
+	TEST_STR_EQ(mock_calls,
+		    "TlclWrite(0x1008, 13)\n"
+		    "TlclRead(0x1008, 13)\n"
+		    "TlclRead(0x1008, 13)\n"
+		    "TlclRead(0x1008, 13)\n",
+		    "tlcl calls");
+
+	/* With noise during the write, we'll try the write again */
+	ResetMocks(0, 0);
+	Memset(&rsk, 0, sizeof(rsk));
+	noise_on[0] = 1;
+	TEST_EQ(WriteSpaceKernel(&rsk), 0, "WriteSpaceKernel(), write noise");
+	TEST_EQ(mock_rsk.struct_version, 2, "WriteSpaceKernel(), check v2");
+	TEST_STR_EQ(mock_calls,
+		    "TlclWrite(0x1008, 13)\n"
+		    "TlclRead(0x1008, 13)\n"
+		    "TlclRead(0x1008, 13)\n"
+		    "TlclRead(0x1008, 13)\n"
+		    "TlclWrite(0x1008, 13)\n"
+		    "TlclRead(0x1008, 13)\n",
+		    "tlcl calls");
+
+	/* Only if it just keeps on failing forever do we eventually give up */
+	ResetMocks(0, 0);
+	Memset(&rsk, 0, sizeof(rsk));
+	Memset(noise_on, 1, sizeof(noise_on));
+	TEST_EQ(WriteSpaceKernel(&rsk), TPM_E_CORRUPTED_STATE,
+		"WriteSpaceKernel(), always noise");
+	TEST_STR_EQ(mock_calls,
+		    "TlclWrite(0x1008, 13)\n"
+		    "TlclRead(0x1008, 13)\n"
+		    "TlclRead(0x1008, 13)\n"
+		    "TlclRead(0x1008, 13)\n"
+		    "TlclWrite(0x1008, 13)\n"
+		    "TlclRead(0x1008, 13)\n"
+		    "TlclRead(0x1008, 13)\n"
+		    "TlclRead(0x1008, 13)\n"
+		    "TlclWrite(0x1008, 13)\n"
+		    "TlclRead(0x1008, 13)\n"
+		    "TlclRead(0x1008, 13)\n"
+		    "TlclRead(0x1008, 13)\n",
+		    "tlcl calls");
 }
 
 /****************************************************************************/
 /* Tests for misc helper functions */
 
-static void MiscTest(void) {
-  uint8_t buf[8];
-
-  ResetMocks(0, 0);
-  TEST_EQ(TPMClearAndReenable(), 0, "TPMClearAndReenable()");
-  TEST_STR_EQ(mock_calls,
-              "TlclForceClear()\n"
-              "TlclSetEnable()\n"
-              "TlclSetDeactivated(0)\n",
-              "tlcl calls");
-
-  ResetMocks(0, 0);
-  TEST_EQ(SafeWrite(0x123, buf, 8), 0, "SafeWrite()");
-  TEST_STR_EQ(mock_calls,
-              "TlclWrite(0x123, 8)\n",
-              "tlcl calls");
-
-  ResetMocks(1, TPM_E_BADINDEX);
-  TEST_EQ(SafeWrite(0x123, buf, 8), TPM_E_BADINDEX, "SafeWrite() bad");
-  TEST_STR_EQ(mock_calls,
-              "TlclWrite(0x123, 8)\n",
-              "tlcl calls");
-
-  ResetMocks(1, TPM_E_MAXNVWRITES);
-  TEST_EQ(SafeWrite(0x123, buf, 8), 0, "SafeWrite() retry max writes");
-  TEST_STR_EQ(mock_calls,
-              "TlclWrite(0x123, 8)\n"
-              "TlclForceClear()\n"
-              "TlclSetEnable()\n"
-              "TlclSetDeactivated(0)\n"
-              "TlclWrite(0x123, 8)\n",
-              "tlcl calls");
-
-  ResetMocks(0, 0);
-  TEST_EQ(SafeDefineSpace(0x123, 6, 8), 0, "SafeDefineSpace()");
-  TEST_STR_EQ(mock_calls,
-              "TlclDefineSpace(0x123, 0x6, 8)\n",
-              "tlcl calls");
-
-  ResetMocks(1, TPM_E_BADINDEX);
-  TEST_EQ(SafeDefineSpace(0x123, 6, 8), TPM_E_BADINDEX,
-          "SafeDefineSpace() bad");
-  TEST_STR_EQ(mock_calls,
-              "TlclDefineSpace(0x123, 0x6, 8)\n",
-              "tlcl calls");
-
-  ResetMocks(1, TPM_E_MAXNVWRITES);
-  TEST_EQ(SafeDefineSpace(0x123, 6, 8), 0,
-          "SafeDefineSpace() retry max writes");
-  TEST_STR_EQ(mock_calls,
-              "TlclDefineSpace(0x123, 0x6, 8)\n"
-              "TlclForceClear()\n"
-              "TlclSetEnable()\n"
-              "TlclSetDeactivated(0)\n"
-              "TlclDefineSpace(0x123, 0x6, 8)\n",
-              "tlcl calls");
+static void MiscTest(void)
+{
+	uint8_t buf[8];
+
+	ResetMocks(0, 0);
+	TEST_EQ(TPMClearAndReenable(), 0, "TPMClearAndReenable()");
+	TEST_STR_EQ(mock_calls,
+		    "TlclForceClear()\n"
+		    "TlclSetEnable()\n"
+		    "TlclSetDeactivated(0)\n",
+		    "tlcl calls");
+
+	ResetMocks(0, 0);
+	TEST_EQ(SafeWrite(0x123, buf, 8), 0, "SafeWrite()");
+	TEST_STR_EQ(mock_calls,
+		    "TlclWrite(0x123, 8)\n",
+		    "tlcl calls");
+
+	ResetMocks(1, TPM_E_BADINDEX);
+	TEST_EQ(SafeWrite(0x123, buf, 8), TPM_E_BADINDEX, "SafeWrite() bad");
+	TEST_STR_EQ(mock_calls,
+		    "TlclWrite(0x123, 8)\n",
+		    "tlcl calls");
+
+	ResetMocks(1, TPM_E_MAXNVWRITES);
+	TEST_EQ(SafeWrite(0x123, buf, 8), 0, "SafeWrite() retry max writes");
+	TEST_STR_EQ(mock_calls,
+		    "TlclWrite(0x123, 8)\n"
+		    "TlclForceClear()\n"
+		    "TlclSetEnable()\n"
+		    "TlclSetDeactivated(0)\n"
+		    "TlclWrite(0x123, 8)\n",
+		    "tlcl calls");
+
+	ResetMocks(0, 0);
+	TEST_EQ(SafeDefineSpace(0x123, 6, 8), 0, "SafeDefineSpace()");
+	TEST_STR_EQ(mock_calls,
+		    "TlclDefineSpace(0x123, 0x6, 8)\n",
+		    "tlcl calls");
+
+	ResetMocks(1, TPM_E_BADINDEX);
+	TEST_EQ(SafeDefineSpace(0x123, 6, 8), TPM_E_BADINDEX,
+		"SafeDefineSpace() bad");
+	TEST_STR_EQ(mock_calls,
+		    "TlclDefineSpace(0x123, 0x6, 8)\n",
+		    "tlcl calls");
+
+	ResetMocks(1, TPM_E_MAXNVWRITES);
+	TEST_EQ(SafeDefineSpace(0x123, 6, 8), 0,
+		"SafeDefineSpace() retry max writes");
+	TEST_STR_EQ(mock_calls,
+		    "TlclDefineSpace(0x123, 0x6, 8)\n"
+		    "TlclForceClear()\n"
+		    "TlclSetEnable()\n"
+		    "TlclSetDeactivated(0)\n"
+		    "TlclDefineSpace(0x123, 0x6, 8)\n",
+		    "tlcl calls");
 }
 
 /****************************************************************************/
 
 /* Tests for one-time initialization */
-static void OneTimeInitTest(void) {
-  RollbackSpaceFirmware rsf;
-  RollbackSpaceKernel rsk;
-
-  /* Complete initialization */
-  ResetMocks(0, 0);
-  TEST_EQ(OneTimeInitializeTPM(&rsf, &rsk), 0, "OneTimeInitializeTPM()");
-  TEST_STR_EQ(mock_calls,
-              "TlclSelfTestFull()\n"
-              "TlclGetPermanentFlags()\n"
-              "TlclFinalizePhysicalPresence()\n"
-              "TlclSetNvLocked()\n"
-              "TlclForceClear()\n"
-              "TlclSetEnable()\n"
-              "TlclSetDeactivated(0)\n"
-              /* kernel space */
-              "TlclDefineSpace(0x1008, 0x1, 13)\n"
-              "TlclWrite(0x1008, 13)\n"
-              "TlclRead(0x1008, 13)\n"
-              /* firmware space */
-              "TlclDefineSpace(0x1007, 0x8001, 10)\n"
-              "TlclWrite(0x1007, 10)\n"
-              "TlclRead(0x1007, 10)\n",
-              "tlcl calls");
-  TEST_EQ(mock_rsf.struct_version, ROLLBACK_SPACE_FIRMWARE_VERSION, "rsf ver");
-  TEST_EQ(mock_rsf.flags, 0, "rsf flags");
-  TEST_EQ(mock_rsf.fw_versions, 0, "rsf fw_versions");
-  TEST_EQ(mock_rsk.struct_version, ROLLBACK_SPACE_KERNEL_VERSION, "rsk ver");
-  TEST_EQ(mock_rsk.uid, ROLLBACK_SPACE_KERNEL_UID, "rsk uid");
-  TEST_EQ(mock_rsk.kernel_versions, 0, "rsk kernel_versions");
-
-  /* Physical presence already initialized */
-  ResetMocks(0, 0);
-  mock_pflags.physicalPresenceLifetimeLock = 1;
-  TEST_EQ(OneTimeInitializeTPM(&rsf, &rsk), 0, "OneTimeInitializeTPM()");
-  TEST_STR_EQ(mock_calls,
-              "TlclSelfTestFull()\n"
-              "TlclGetPermanentFlags()\n"
-              "TlclSetNvLocked()\n"
-              "TlclForceClear()\n"
-              "TlclSetEnable()\n"
-              "TlclSetDeactivated(0)\n"
-              /* kernel space */
-              "TlclDefineSpace(0x1008, 0x1, 13)\n"
-              "TlclWrite(0x1008, 13)\n"
-              "TlclRead(0x1008, 13)\n"
-              /* firmware space */
-              "TlclDefineSpace(0x1007, 0x8001, 10)\n"
-              "TlclWrite(0x1007, 10)\n"
-              "TlclRead(0x1007, 10)\n",
-              "tlcl calls");
-
-  /* NV locking already initialized */
-  ResetMocks(0, 0);
-  mock_pflags.nvLocked = 1;
-  TEST_EQ(OneTimeInitializeTPM(&rsf, &rsk), 0, "OneTimeInitializeTPM()");
-  TEST_STR_EQ(mock_calls,
-              "TlclSelfTestFull()\n"
-              "TlclGetPermanentFlags()\n"
-              "TlclFinalizePhysicalPresence()\n"
-              "TlclForceClear()\n"
-              "TlclSetEnable()\n"
-              "TlclSetDeactivated(0)\n"
-              /* kernel space */
-              "TlclDefineSpace(0x1008, 0x1, 13)\n"
-              "TlclWrite(0x1008, 13)\n"
-              "TlclRead(0x1008, 13)\n"
-              /* firmware space */
-              "TlclDefineSpace(0x1007, 0x8001, 10)\n"
-              "TlclWrite(0x1007, 10)\n"
-              "TlclRead(0x1007, 10)\n",
-              "tlcl calls");
-
-  /* Self test error */
-  ResetMocks(1, TPM_E_IOERROR);
-  TEST_EQ(OneTimeInitializeTPM(&rsf, &rsk), TPM_E_IOERROR,
-          "OneTimeInitializeTPM() selftest");
-  TEST_STR_EQ(mock_calls,
-              "TlclSelfTestFull()\n",
-              "tlcl calls");
+static void OneTimeInitTest(void)
+{
+	RollbackSpaceFirmware rsf;
+	RollbackSpaceKernel rsk;
+
+	/* Complete initialization */
+	ResetMocks(0, 0);
+	TEST_EQ(OneTimeInitializeTPM(&rsf, &rsk), 0, "OneTimeInitializeTPM()");
+	TEST_STR_EQ(mock_calls,
+		    "TlclSelfTestFull()\n"
+		    "TlclGetPermanentFlags()\n"
+		    "TlclFinalizePhysicalPresence()\n"
+		    "TlclSetNvLocked()\n"
+		    "TlclForceClear()\n"
+		    "TlclSetEnable()\n"
+		    "TlclSetDeactivated(0)\n"
+		    /* kernel space */
+		    "TlclDefineSpace(0x1008, 0x1, 13)\n"
+		    "TlclWrite(0x1008, 13)\n"
+		    "TlclRead(0x1008, 13)\n"
+		    /* firmware space */
+		    "TlclDefineSpace(0x1007, 0x8001, 10)\n"
+		    "TlclWrite(0x1007, 10)\n"
+		    "TlclRead(0x1007, 10)\n",
+		    "tlcl calls");
+	TEST_EQ(mock_rsf.struct_version, ROLLBACK_SPACE_FIRMWARE_VERSION,
+		"rsf ver");
+	TEST_EQ(mock_rsf.flags, 0, "rsf flags");
+	TEST_EQ(mock_rsf.fw_versions, 0, "rsf fw_versions");
+	TEST_EQ(mock_rsk.struct_version, ROLLBACK_SPACE_KERNEL_VERSION,
+		"rsk ver");
+	TEST_EQ(mock_rsk.uid, ROLLBACK_SPACE_KERNEL_UID, "rsk uid");
+	TEST_EQ(mock_rsk.kernel_versions, 0, "rsk kernel_versions");
+
+	/* Physical presence already initialized */
+	ResetMocks(0, 0);
+	mock_pflags.physicalPresenceLifetimeLock = 1;
+	TEST_EQ(OneTimeInitializeTPM(&rsf, &rsk), 0, "OneTimeInitializeTPM()");
+	TEST_STR_EQ(mock_calls,
+		    "TlclSelfTestFull()\n"
+		    "TlclGetPermanentFlags()\n"
+		    "TlclSetNvLocked()\n"
+		    "TlclForceClear()\n"
+		    "TlclSetEnable()\n"
+		    "TlclSetDeactivated(0)\n"
+		    /* kernel space */
+		    "TlclDefineSpace(0x1008, 0x1, 13)\n"
+		    "TlclWrite(0x1008, 13)\n"
+		    "TlclRead(0x1008, 13)\n"
+		    /* firmware space */
+		    "TlclDefineSpace(0x1007, 0x8001, 10)\n"
+		    "TlclWrite(0x1007, 10)\n"
+		    "TlclRead(0x1007, 10)\n",
+		    "tlcl calls");
+
+	/* NV locking already initialized */
+	ResetMocks(0, 0);
+	mock_pflags.nvLocked = 1;
+	TEST_EQ(OneTimeInitializeTPM(&rsf, &rsk), 0, "OneTimeInitializeTPM()");
+	TEST_STR_EQ(mock_calls,
+		    "TlclSelfTestFull()\n"
+		    "TlclGetPermanentFlags()\n"
+		    "TlclFinalizePhysicalPresence()\n"
+		    "TlclForceClear()\n"
+		    "TlclSetEnable()\n"
+		    "TlclSetDeactivated(0)\n"
+		    /* kernel space */
+		    "TlclDefineSpace(0x1008, 0x1, 13)\n"
+		    "TlclWrite(0x1008, 13)\n"
+		    "TlclRead(0x1008, 13)\n"
+		    /* firmware space */
+		    "TlclDefineSpace(0x1007, 0x8001, 10)\n"
+		    "TlclWrite(0x1007, 10)\n"
+		    "TlclRead(0x1007, 10)\n",
+		    "tlcl calls");
+
+	/* Self test error */
+	ResetMocks(1, TPM_E_IOERROR);
+	TEST_EQ(OneTimeInitializeTPM(&rsf, &rsk), TPM_E_IOERROR,
+		"OneTimeInitializeTPM() selftest");
+	TEST_STR_EQ(mock_calls,
+		    "TlclSelfTestFull()\n",
+		    "tlcl calls");
 }
 
 /****************************************************************************/
 /* Tests for TPM setup */
 
-static void SetupTpmTest(void) {
-  RollbackSpaceFirmware rsf;
-
-  /* Complete setup */
-  ResetMocks(0, 0);
-  TEST_EQ(SetupTPM(0, 0, 0, 0, &rsf), 0, "SetupTPM()");
-  TEST_STR_EQ(mock_calls,
-              "TlclLibInit()\n"
-              "TlclStartup()\n"
-              "TlclAssertPhysicalPresence()\n"
-              "TlclGetPermanentFlags()\n"
-              "TlclRead(0x1007, 10)\n",
-              "tlcl calls");
-
-  /* If TPM is disabled or deactivated, must enable it */
-  ResetMocks(0, 0);
-  mock_pflags.disable = 1;
-  TEST_EQ(SetupTPM(0, 0, 0, 0, &rsf), TPM_E_MUST_REBOOT, "SetupTPM() disabled");
-  TEST_STR_EQ(mock_calls,
-              "TlclLibInit()\n"
-              "TlclStartup()\n"
-              "TlclAssertPhysicalPresence()\n"
-              "TlclGetPermanentFlags()\n"
-              "TlclSetEnable()\n"
-              "TlclSetDeactivated(0)\n",
-              "tlcl calls");
-
-  ResetMocks(0, 0);
-  mock_pflags.deactivated = 1;
-  TEST_EQ(SetupTPM(0, 0, 0, 0, &rsf), TPM_E_MUST_REBOOT,
-          "SetupTPM() deactivated");
-  TEST_STR_EQ(mock_calls,
-              "TlclLibInit()\n"
-              "TlclStartup()\n"
-              "TlclAssertPhysicalPresence()\n"
-              "TlclGetPermanentFlags()\n"
-              "TlclSetEnable()\n"
-              "TlclSetDeactivated(0)\n",
-              "tlcl calls");
-
-  /* If physical presence command isn't enabled, should try to enable it */
-  ResetMocks(3, TPM_E_IOERROR);
-  TEST_EQ(SetupTPM(0, 0, 0, 0, &rsf), 0, "SetupTPM() pp cmd");
-  TEST_STR_EQ(mock_calls,
-              "TlclLibInit()\n"
-              "TlclStartup()\n"
-              "TlclAssertPhysicalPresence()\n"
-              "TlclPhysicalPresenceCMDEnable()\n"
-              "TlclAssertPhysicalPresence()\n"
-              "TlclGetPermanentFlags()\n"
-              "TlclRead(0x1007, 10)\n",
-              "tlcl calls");
-
-  /* If firmware space is missing, do one-time init */
-  ResetMocks(5, TPM_E_BADINDEX);
-  mock_pflags.physicalPresenceLifetimeLock = 1;
-  mock_pflags.nvLocked = 1;
-  TEST_EQ(SetupTPM(0, 0, 0, 0, &rsf), 0, "SetupTPM() no firmware space");
-  TEST_STR_EQ(mock_calls,
-              "TlclLibInit()\n"
-              "TlclStartup()\n"
-              "TlclAssertPhysicalPresence()\n"
-              "TlclGetPermanentFlags()\n"
-              "TlclRead(0x1007, 10)\n"
-              /* Calls from one-time init */
-              "TlclSelfTestFull()\n"
-              "TlclGetPermanentFlags()\n"
-              "TlclForceClear()\n"
-              "TlclSetEnable()\n"
-              "TlclSetDeactivated(0)\n"
-              "TlclDefineSpace(0x1008, 0x1, 13)\n"
-              "TlclWrite(0x1008, 13)\n"
-              "TlclRead(0x1008, 13)\n"
-              "TlclDefineSpace(0x1007, 0x8001, 10)\n"
-              "TlclWrite(0x1007, 10)\n"
-              "TlclRead(0x1007, 10)\n",
-              "tlcl calls");
-
-  /* Other firmware space error is passed through */
-  ResetMocks(5, TPM_E_IOERROR);
-  TEST_EQ(SetupTPM(0, 0, 0, 0, &rsf), TPM_E_CORRUPTED_STATE,
-          "SetupTPM() bad firmware space");
-  TEST_STR_EQ(mock_calls,
-              "TlclLibInit()\n"
-              "TlclStartup()\n"
-              "TlclAssertPhysicalPresence()\n"
-              "TlclGetPermanentFlags()\n"
-              "TlclRead(0x1007, 10)\n",
-              "tlcl calls");
-
-  /* If developer flag has toggled, clear ownership and write new flag */
-  ResetMocks(0, 0);
-  TEST_EQ(SetupTPM(0, 1, 0, 0, &rsf), 0, "SetupTPM() to dev");
-  TEST_STR_EQ(mock_calls,
-              "TlclLibInit()\n"
-              "TlclStartup()\n"
-              "TlclAssertPhysicalPresence()\n"
-              "TlclGetPermanentFlags()\n"
-              "TlclRead(0x1007, 10)\n"
-              "TlclForceClear()\n"
-              "TlclSetEnable()\n"
-              "TlclSetDeactivated(0)\n"
-              "TlclWrite(0x1007, 10)\n"
-              "TlclRead(0x1007, 10)\n",
-              "tlcl calls");
-  TEST_EQ(mock_rsf.flags, FLAG_LAST_BOOT_DEVELOPER, "fw space flags to dev 1");
-
-  ResetMocks(0, 0);
-  mock_rsf.flags = FLAG_LAST_BOOT_DEVELOPER;
-  TEST_EQ(SetupTPM(0, 0, 0, 0, &rsf), 0, "SetupTPM() from dev");
-  TEST_STR_EQ(mock_calls,
-              "TlclLibInit()\n"
-              "TlclStartup()\n"
-              "TlclAssertPhysicalPresence()\n"
-              "TlclGetPermanentFlags()\n"
-              "TlclRead(0x1007, 10)\n"
-              "TlclForceClear()\n"
-              "TlclSetEnable()\n"
-              "TlclSetDeactivated(0)\n"
-              "TlclWrite(0x1007, 10)\n"
-              "TlclRead(0x1007, 10)\n",
-              "tlcl calls");
-  TEST_EQ(mock_rsf.flags, 0, "fw space flags from dev 1");
-
-  /* If TPM clear request, clear ownership also */
-  ResetMocks(0, 0);
-  TEST_EQ(SetupTPM(0, 0, 0, 1, &rsf), 0, "SetupTPM() clear owner");
-  TEST_STR_EQ(mock_calls,
-              "TlclLibInit()\n"
-              "TlclStartup()\n"
-              "TlclAssertPhysicalPresence()\n"
-              "TlclGetPermanentFlags()\n"
-              "TlclRead(0x1007, 10)\n"
-              "TlclForceClear()\n"
-              "TlclSetEnable()\n"
-              "TlclSetDeactivated(0)\n",
-              "tlcl calls");
-
-  /* Note: SetupTPM() recovery_mode parameter sets a global flag in
-   * rollback_index.c; this is tested along with RollbackKernelLock() below. */
+static void SetupTpmTest(void)
+{
+	RollbackSpaceFirmware rsf;
+
+	/* Complete setup */
+	ResetMocks(0, 0);
+	TEST_EQ(SetupTPM(0, 0, 0, 0, &rsf), 0, "SetupTPM()");
+	TEST_STR_EQ(mock_calls,
+		    "TlclLibInit()\n"
+		    "TlclStartup()\n"
+		    "TlclAssertPhysicalPresence()\n"
+		    "TlclGetPermanentFlags()\n"
+		    "TlclRead(0x1007, 10)\n",
+		    "tlcl calls");
+
+	/* If TPM is disabled or deactivated, must enable it */
+	ResetMocks(0, 0);
+	mock_pflags.disable = 1;
+	TEST_EQ(SetupTPM(0, 0, 0, 0, &rsf), TPM_E_MUST_REBOOT,
+		"SetupTPM() disabled");
+	TEST_STR_EQ(mock_calls,
+		    "TlclLibInit()\n"
+		    "TlclStartup()\n"
+		    "TlclAssertPhysicalPresence()\n"
+		    "TlclGetPermanentFlags()\n"
+		    "TlclSetEnable()\n"
+		    "TlclSetDeactivated(0)\n",
+		    "tlcl calls");
+
+	ResetMocks(0, 0);
+	mock_pflags.deactivated = 1;
+	TEST_EQ(SetupTPM(0, 0, 0, 0, &rsf), TPM_E_MUST_REBOOT,
+		"SetupTPM() deactivated");
+	TEST_STR_EQ(mock_calls,
+		    "TlclLibInit()\n"
+		    "TlclStartup()\n"
+		    "TlclAssertPhysicalPresence()\n"
+		    "TlclGetPermanentFlags()\n"
+		    "TlclSetEnable()\n"
+		    "TlclSetDeactivated(0)\n",
+		    "tlcl calls");
+
+	/* If physical presence command isn't enabled, try to enable it */
+	ResetMocks(3, TPM_E_IOERROR);
+	TEST_EQ(SetupTPM(0, 0, 0, 0, &rsf), 0, "SetupTPM() pp cmd");
+	TEST_STR_EQ(mock_calls,
+		    "TlclLibInit()\n"
+		    "TlclStartup()\n"
+		    "TlclAssertPhysicalPresence()\n"
+		    "TlclPhysicalPresenceCMDEnable()\n"
+		    "TlclAssertPhysicalPresence()\n"
+		    "TlclGetPermanentFlags()\n"
+		    "TlclRead(0x1007, 10)\n",
+		    "tlcl calls");
+
+	/* If firmware space is missing, do one-time init */
+	ResetMocks(5, TPM_E_BADINDEX);
+	mock_pflags.physicalPresenceLifetimeLock = 1;
+	mock_pflags.nvLocked = 1;
+	TEST_EQ(SetupTPM(0, 0, 0, 0, &rsf), 0, "SetupTPM() no firmware space");
+	TEST_STR_EQ(mock_calls,
+		    "TlclLibInit()\n"
+		    "TlclStartup()\n"
+		    "TlclAssertPhysicalPresence()\n"
+		    "TlclGetPermanentFlags()\n"
+		    "TlclRead(0x1007, 10)\n"
+		    /* Calls from one-time init */
+		    "TlclSelfTestFull()\n"
+		    "TlclGetPermanentFlags()\n"
+		    "TlclForceClear()\n"
+		    "TlclSetEnable()\n"
+		    "TlclSetDeactivated(0)\n"
+		    "TlclDefineSpace(0x1008, 0x1, 13)\n"
+		    "TlclWrite(0x1008, 13)\n"
+		    "TlclRead(0x1008, 13)\n"
+		    "TlclDefineSpace(0x1007, 0x8001, 10)\n"
+		    "TlclWrite(0x1007, 10)\n"
+		    "TlclRead(0x1007, 10)\n",
+		    "tlcl calls");
+
+	/* Other firmware space error is passed through */
+	ResetMocks(5, TPM_E_IOERROR);
+	TEST_EQ(SetupTPM(0, 0, 0, 0, &rsf), TPM_E_CORRUPTED_STATE,
+		"SetupTPM() bad firmware space");
+	TEST_STR_EQ(mock_calls,
+		    "TlclLibInit()\n"
+		    "TlclStartup()\n"
+		    "TlclAssertPhysicalPresence()\n"
+		    "TlclGetPermanentFlags()\n"
+		    "TlclRead(0x1007, 10)\n",
+		    "tlcl calls");
+
+	/* If developer flag has toggled, clear ownership and write new flag */
+	ResetMocks(0, 0);
+	TEST_EQ(SetupTPM(0, 1, 0, 0, &rsf), 0, "SetupTPM() to dev");
+	TEST_STR_EQ(mock_calls,
+		    "TlclLibInit()\n"
+		    "TlclStartup()\n"
+		    "TlclAssertPhysicalPresence()\n"
+		    "TlclGetPermanentFlags()\n"
+		    "TlclRead(0x1007, 10)\n"
+		    "TlclForceClear()\n"
+		    "TlclSetEnable()\n"
+		    "TlclSetDeactivated(0)\n"
+		    "TlclWrite(0x1007, 10)\n"
+		    "TlclRead(0x1007, 10)\n",
+		    "tlcl calls");
+	TEST_EQ(mock_rsf.flags, FLAG_LAST_BOOT_DEVELOPER,
+		"fw space flags to dev 1");
+
+	ResetMocks(0, 0);
+	mock_rsf.flags = FLAG_LAST_BOOT_DEVELOPER;
+	TEST_EQ(SetupTPM(0, 0, 0, 0, &rsf), 0, "SetupTPM() from dev");
+	TEST_STR_EQ(mock_calls,
+		    "TlclLibInit()\n"
+		    "TlclStartup()\n"
+		    "TlclAssertPhysicalPresence()\n"
+		    "TlclGetPermanentFlags()\n"
+		    "TlclRead(0x1007, 10)\n"
+		    "TlclForceClear()\n"
+		    "TlclSetEnable()\n"
+		    "TlclSetDeactivated(0)\n"
+		    "TlclWrite(0x1007, 10)\n"
+		    "TlclRead(0x1007, 10)\n",
+		    "tlcl calls");
+	TEST_EQ(mock_rsf.flags, 0, "fw space flags from dev 1");
+
+	/* If TPM clear request, clear ownership also */
+	ResetMocks(0, 0);
+	TEST_EQ(SetupTPM(0, 0, 0, 1, &rsf), 0, "SetupTPM() clear owner");
+	TEST_STR_EQ(mock_calls,
+		    "TlclLibInit()\n"
+		    "TlclStartup()\n"
+		    "TlclAssertPhysicalPresence()\n"
+		    "TlclGetPermanentFlags()\n"
+		    "TlclRead(0x1007, 10)\n"
+		    "TlclForceClear()\n"
+		    "TlclSetEnable()\n"
+		    "TlclSetDeactivated(0)\n",
+		    "tlcl calls");
+
+	/* Handle request to clear virtual dev switch */
+	ResetMocks(0, 0);
+	mock_rsf.flags = FLAG_VIRTUAL_DEV_MODE_ON | FLAG_LAST_BOOT_DEVELOPER;
+	TEST_EQ(SetupTPM(0, 0, 1, 0, &rsf), 0, "SetupTPM() clear virtual dev");
+	TEST_EQ(mock_rsf.flags, 0, "Clear virtual dev");
+
+	/* If virtual dev switch is on, that should set last boot developer */
+	ResetMocks(0, 0);
+	mock_rsf.flags = FLAG_VIRTUAL_DEV_MODE_ON;
+	SetupTPM(0, 0, 0, 0, &rsf);
+	TEST_EQ(mock_rsf.flags,
+		FLAG_VIRTUAL_DEV_MODE_ON | FLAG_LAST_BOOT_DEVELOPER,
+		"virtual dev sets last boot");
+
+	/*
+	 * Note: SetupTPM() recovery_mode parameter sets a global flag in
+	 * rollback_index.c; this is tested along with RollbackKernelLock()
+	 * below.
+	 */
 }
 
 /****************************************************************************/
 /* Tests for RollbackFirmware() calls */
-static void RollbackFirmwareTest(void) {
-  uint32_t version;
-  int dev_mode;
-
-  /* Normal setup */
-  ResetMocks(0, 0);
-  dev_mode = 0;
-  version = 123;
-  mock_rsf.fw_versions = 0x12345678;
-  TEST_EQ(RollbackFirmwareSetup(0, 0, dev_mode, 0, &dev_mode, &version), 0,
-          "RollbackFirmwareSetup()");
-  TEST_STR_EQ(mock_calls,
-              "TlclLibInit()\n"
-              "TlclStartup()\n"
-              "TlclAssertPhysicalPresence()\n"
-              "TlclGetPermanentFlags()\n"
-              "TlclRead(0x1007, 10)\n",
-              "tlcl calls");
-  TEST_EQ(version, 0x12345678, "RollbackFirmwareSetup() version");
-
-  /* Error during setup should clear version */
-  ResetMocks(1, TPM_E_IOERROR);
-  dev_mode = 0;
-  version = 123;
-  mock_rsf.fw_versions = 0x12345678;
-  TEST_EQ(RollbackFirmwareSetup(0, 0, dev_mode, 0, &dev_mode, &version),
-          TPM_E_IOERROR,
-          "RollbackFirmwareSetup() error");
-  TEST_STR_EQ(mock_calls,
-              "TlclLibInit()\n",
-              "tlcl calls");
-  TEST_EQ(version, 0, "RollbackFirmwareSetup() version on error");
-
-  /* Developer mode flag gets passed properly */
-  ResetMocks(0, 0);
-  dev_mode = 1;
-  TEST_EQ(RollbackFirmwareSetup(0, dev_mode, 0, 0, &dev_mode, &version), 0,
-          "RollbackFirmwareSetup() to dev");
-  TEST_STR_EQ(mock_calls,
-              "TlclLibInit()\n"
-              "TlclStartup()\n"
-              "TlclAssertPhysicalPresence()\n"
-              "TlclGetPermanentFlags()\n"
-              "TlclRead(0x1007, 10)\n"
-              "TlclForceClear()\n"
-              "TlclSetEnable()\n"
-              "TlclSetDeactivated(0)\n"
-              "TlclWrite(0x1007, 10)\n"
-              "TlclRead(0x1007, 10)\n",
-              "tlcl calls");
-  TEST_EQ(mock_rsf.flags, FLAG_LAST_BOOT_DEVELOPER, "fw space flags to dev 2");
-
-  /* So does clear-TPM request */
-  ResetMocks(0, 0);
-  dev_mode = 0;
-  TEST_EQ(RollbackFirmwareSetup(0, dev_mode, 0, 1, &dev_mode, &version), 0,
-          "RollbackFirmwareSetup() clear owner");
-  TEST_STR_EQ(mock_calls,
-              "TlclLibInit()\n"
-              "TlclStartup()\n"
-              "TlclAssertPhysicalPresence()\n"
-              "TlclGetPermanentFlags()\n"
-              "TlclRead(0x1007, 10)\n"
-              "TlclForceClear()\n"
-              "TlclSetEnable()\n"
-              "TlclSetDeactivated(0)\n",
-              "tlcl calls");
-
-  /* Test write */
-  ResetMocks(0, 0);
-  TEST_EQ(RollbackFirmwareWrite(0xBEAD1234), 0, "RollbackFirmwareWrite()");
-  TEST_EQ(mock_rsf.fw_versions, 0xBEAD1234, "RollbackFirmwareWrite() version");
-  TEST_STR_EQ(mock_calls,
-              "TlclRead(0x1007, 10)\n"
-              "TlclWrite(0x1007, 10)\n"
-              "TlclRead(0x1007, 10)\n",
-              "tlcl calls");
-
-  ResetMocks(1, TPM_E_IOERROR);
-  TEST_EQ(RollbackFirmwareWrite(123), TPM_E_IOERROR,
-          "RollbackFirmwareWrite() error");
-
-  /* Test lock */
-  ResetMocks(0, 0);
-  TEST_EQ(RollbackFirmwareLock(), 0, "RollbackFirmwareLock()");
-  TEST_STR_EQ(mock_calls,
-              "TlclSetGlobalLock()\n",
-              "tlcl calls");
-
-  ResetMocks(1, TPM_E_IOERROR);
-  TEST_EQ(RollbackFirmwareLock(), TPM_E_IOERROR,
-          "RollbackFirmwareLock() error");
+
+static void RollbackFirmwareTest(void)
+{
+	uint32_t version;
+	int dev_mode;
+
+	/* Normal setup */
+	ResetMocks(0, 0);
+	dev_mode = 0;
+	version = 123;
+	mock_rsf.fw_versions = 0x12345678;
+	TEST_EQ(RollbackFirmwareSetup(0, 0, dev_mode, 0, &dev_mode, &version),
+		0, "RollbackFirmwareSetup()");
+	TEST_STR_EQ(mock_calls,
+		    "TlclLibInit()\n"
+		    "TlclStartup()\n"
+		    "TlclAssertPhysicalPresence()\n"
+		    "TlclGetPermanentFlags()\n"
+		    "TlclRead(0x1007, 10)\n",
+		    "tlcl calls");
+	TEST_EQ(version, 0x12345678, "RollbackFirmwareSetup() version");
+
+	/* Error during setup should clear version */
+	ResetMocks(1, TPM_E_IOERROR);
+	dev_mode = 0;
+	version = 123;
+	mock_rsf.fw_versions = 0x12345678;
+	TEST_EQ(RollbackFirmwareSetup(0, 0, dev_mode, 0, &dev_mode, &version),
+		TPM_E_IOERROR,
+		"RollbackFirmwareSetup() error");
+	TEST_STR_EQ(mock_calls,
+		    "TlclLibInit()\n",
+		    "tlcl calls");
+	TEST_EQ(version, 0, "RollbackFirmwareSetup() version on error");
+
+	/* Developer mode flag gets passed properly */
+	ResetMocks(0, 0);
+	dev_mode = 1;
+	TEST_EQ(RollbackFirmwareSetup(0, dev_mode, 0, 0, &dev_mode, &version),
+		0, "RollbackFirmwareSetup() to dev");
+	TEST_STR_EQ(mock_calls,
+		    "TlclLibInit()\n"
+		    "TlclStartup()\n"
+		    "TlclAssertPhysicalPresence()\n"
+		    "TlclGetPermanentFlags()\n"
+		    "TlclRead(0x1007, 10)\n"
+		    "TlclForceClear()\n"
+		    "TlclSetEnable()\n"
+		    "TlclSetDeactivated(0)\n"
+		    "TlclWrite(0x1007, 10)\n"
+		    "TlclRead(0x1007, 10)\n",
+		    "tlcl calls");
+	TEST_EQ(mock_rsf.flags, FLAG_LAST_BOOT_DEVELOPER,
+		"fw space flags to dev 2");
+
+	/* So does clear-TPM request */
+	ResetMocks(0, 0);
+	dev_mode = 0;
+	TEST_EQ(RollbackFirmwareSetup(0, dev_mode, 0, 1, &dev_mode, &version),
+		0, "RollbackFirmwareSetup() clear owner");
+	TEST_STR_EQ(mock_calls,
+		    "TlclLibInit()\n"
+		    "TlclStartup()\n"
+		    "TlclAssertPhysicalPresence()\n"
+		    "TlclGetPermanentFlags()\n"
+		    "TlclRead(0x1007, 10)\n"
+		    "TlclForceClear()\n"
+		    "TlclSetEnable()\n"
+		    "TlclSetDeactivated(0)\n",
+		    "tlcl calls");
+
+	/* Test write */
+	ResetMocks(0, 0);
+	TEST_EQ(RollbackFirmwareWrite(0xBEAD1234), 0,
+		"RollbackFirmwareWrite()");
+	TEST_EQ(mock_rsf.fw_versions, 0xBEAD1234,
+		"RollbackFirmwareWrite() version");
+	TEST_STR_EQ(mock_calls,
+		    "TlclRead(0x1007, 10)\n"
+		    "TlclWrite(0x1007, 10)\n"
+		    "TlclRead(0x1007, 10)\n",
+		    "tlcl calls");
+
+	ResetMocks(1, TPM_E_IOERROR);
+	TEST_EQ(RollbackFirmwareWrite(123), TPM_E_IOERROR,
+		"RollbackFirmwareWrite() error");
+
+	/* Test setting virtual dev mode */
+	ResetMocks(0, 0);
+	TEST_EQ(SetVirtualDevMode(1), 0, "SetVirtualDevMode(1)");
+	TEST_EQ(mock_rsf.flags, FLAG_VIRTUAL_DEV_MODE_ON, "Virtual dev on");
+	TEST_STR_EQ(mock_calls,
+		    "TlclRead(0x1007, 10)\n"
+		    "TlclWrite(0x1007, 10)\n"
+		    "TlclRead(0x1007, 10)\n",
+		    "tlcl calls");
+	ResetMocks(0, 0);
+	TEST_EQ(SetVirtualDevMode(0), 0, "SetVirtualDevMode(0)");
+	TEST_EQ(mock_rsf.flags, 0, "Virtual dev off");
+	TEST_STR_EQ(mock_calls,
+		    "TlclRead(0x1007, 10)\n"
+		    "TlclWrite(0x1007, 10)\n"
+		    "TlclRead(0x1007, 10)\n",
+		    "tlcl calls");
+
+	/* Test lock */
+	ResetMocks(0, 0);
+	TEST_EQ(RollbackFirmwareLock(), 0, "RollbackFirmwareLock()");
+	TEST_STR_EQ(mock_calls,
+		    "TlclSetGlobalLock()\n",
+		    "tlcl calls");
+
+	ResetMocks(1, TPM_E_IOERROR);
+	TEST_EQ(RollbackFirmwareLock(), TPM_E_IOERROR,
+		"RollbackFirmwareLock() error");
 }
 
 /****************************************************************************/
 /* Tests for RollbackKernel() calls */
 
-static void RollbackKernelTest(void) {
-  RollbackSpaceFirmware rsf;
-  uint32_t version = 0;
-
-  /* RollbackKernel*() functions use a global flag inside
-   * rollback_index.c based on recovery mode, which is set by
-   * SetupTPM().  Clear the flag for the first set of tests. */
-  TEST_EQ(SetupTPM(0, 0, 0, 0, &rsf), 0, "SetupTPM()");
-
-  /* Normal read */
-  ResetMocks(0, 0);
-  mock_rsk.uid = ROLLBACK_SPACE_KERNEL_UID;
-  mock_permissions = TPM_NV_PER_PPWRITE;
-  mock_rsk.kernel_versions = 0x87654321;
-  TEST_EQ(RollbackKernelRead(&version), 0, "RollbackKernelRead()");
-  TEST_STR_EQ(mock_calls,
-              "TlclRead(0x1008, 13)\n"
-              "TlclGetPermissions(0x1008)\n",
-              "tlcl calls");
-  TEST_EQ(version, 0x87654321, "RollbackKernelRead() version");
-
-  /* Read error */
-  ResetMocks(1, TPM_E_IOERROR);
-  TEST_EQ(RollbackKernelRead(&version), TPM_E_IOERROR,
-          "RollbackKernelRead() error");
-  TEST_STR_EQ(mock_calls,
-              "TlclRead(0x1008, 13)\n",
-              "tlcl calls");
-
-  /* Wrong permission or UID will return error */
-  ResetMocks(0, 0);
-  mock_rsk.uid = ROLLBACK_SPACE_KERNEL_UID + 1;
-  mock_permissions = TPM_NV_PER_PPWRITE;
-  TEST_EQ(RollbackKernelRead(&version), TPM_E_CORRUPTED_STATE,
-          "RollbackKernelRead() bad uid");
-
-  ResetMocks(0, 0);
-  mock_rsk.uid = ROLLBACK_SPACE_KERNEL_UID;
-  mock_permissions = TPM_NV_PER_PPWRITE + 1;
-  TEST_EQ(RollbackKernelRead(&version), TPM_E_CORRUPTED_STATE,
-          "RollbackKernelRead() bad permissions");
-
-  /* Test write */
-  ResetMocks(0, 0);
-  TEST_EQ(RollbackKernelWrite(0xBEAD4321), 0, "RollbackKernelWrite()");
-  TEST_EQ(mock_rsk.kernel_versions, 0xBEAD4321,
-          "RollbackKernelWrite() version");
-  TEST_STR_EQ(mock_calls,
-              "TlclRead(0x1008, 13)\n"
-              "TlclWrite(0x1008, 13)\n"
-              "TlclRead(0x1008, 13)\n",
-              "tlcl calls");
-
-  ResetMocks(1, TPM_E_IOERROR);
-  TEST_EQ(RollbackKernelWrite(123), TPM_E_IOERROR,
-          "RollbackKernelWrite() error");
-
-  /* Test lock (recovery off) */
-  ResetMocks(0, 0);
-  TEST_EQ(RollbackKernelLock(), 0, "RollbackKernelLock()");
-  TEST_STR_EQ(mock_calls,
-              "TlclLockPhysicalPresence()\n",
-              "tlcl calls");
-
-  ResetMocks(1, TPM_E_IOERROR);
-  TEST_EQ(RollbackKernelLock(), TPM_E_IOERROR, "RollbackKernelLock() error");
-
-  /* Test lock with recovery on; shouldn't lock PP */
-  SetupTPM(1, 0, 0, 0, &rsf);
-  ResetMocks(0, 0);
-  TEST_EQ(RollbackKernelLock(), 0, "RollbackKernelLock() in recovery");
-  TEST_STR_EQ(mock_calls, "", "no tlcl calls");
+static void RollbackKernelTest(void)
+{
+	RollbackSpaceFirmware rsf;
+	uint32_t version = 0;
+
+	/*
+	 * RollbackKernel*() functions use a global flag inside
+	 * rollback_index.c based on recovery mode, which is set by SetupTPM().
+	 * Clear the flag for the first set of tests.
+	 */
+	TEST_EQ(SetupTPM(0, 0, 0, 0, &rsf), 0, "SetupTPM()");
+
+	/* Normal read */
+	ResetMocks(0, 0);
+	mock_rsk.uid = ROLLBACK_SPACE_KERNEL_UID;
+	mock_permissions = TPM_NV_PER_PPWRITE;
+	mock_rsk.kernel_versions = 0x87654321;
+	TEST_EQ(RollbackKernelRead(&version), 0, "RollbackKernelRead()");
+	TEST_STR_EQ(mock_calls,
+		    "TlclRead(0x1008, 13)\n"
+		    "TlclGetPermissions(0x1008)\n",
+		    "tlcl calls");
+	TEST_EQ(version, 0x87654321, "RollbackKernelRead() version");
+
+	/* Read error */
+	ResetMocks(1, TPM_E_IOERROR);
+	TEST_EQ(RollbackKernelRead(&version), TPM_E_IOERROR,
+		"RollbackKernelRead() error");
+	TEST_STR_EQ(mock_calls,
+		    "TlclRead(0x1008, 13)\n",
+		    "tlcl calls");
+
+	/* Wrong permission or UID will return error */
+	ResetMocks(0, 0);
+	mock_rsk.uid = ROLLBACK_SPACE_KERNEL_UID + 1;
+	mock_permissions = TPM_NV_PER_PPWRITE;
+	TEST_EQ(RollbackKernelRead(&version), TPM_E_CORRUPTED_STATE,
+		"RollbackKernelRead() bad uid");
+
+	ResetMocks(0, 0);
+	mock_rsk.uid = ROLLBACK_SPACE_KERNEL_UID;
+	mock_permissions = TPM_NV_PER_PPWRITE + 1;
+	TEST_EQ(RollbackKernelRead(&version), TPM_E_CORRUPTED_STATE,
+		"RollbackKernelRead() bad permissions");
+
+	/* Test write */
+	ResetMocks(0, 0);
+	TEST_EQ(RollbackKernelWrite(0xBEAD4321), 0, "RollbackKernelWrite()");
+	TEST_EQ(mock_rsk.kernel_versions, 0xBEAD4321,
+		"RollbackKernelWrite() version");
+	TEST_STR_EQ(mock_calls,
+		    "TlclRead(0x1008, 13)\n"
+		    "TlclWrite(0x1008, 13)\n"
+		    "TlclRead(0x1008, 13)\n",
+		    "tlcl calls");
+
+	ResetMocks(1, TPM_E_IOERROR);
+	TEST_EQ(RollbackKernelWrite(123), TPM_E_IOERROR,
+		"RollbackKernelWrite() error");
+
+	/* Test lock (recovery off) */
+	ResetMocks(0, 0);
+	TEST_EQ(RollbackKernelLock(), 0, "RollbackKernelLock()");
+	TEST_STR_EQ(mock_calls,
+		    "TlclLockPhysicalPresence()\n",
+		    "tlcl calls");
+
+	ResetMocks(1, TPM_E_IOERROR);
+	TEST_EQ(RollbackKernelLock(), TPM_E_IOERROR,
+		"RollbackKernelLock() error");
+
+	/* Test lock with recovery on; shouldn't lock PP */
+	SetupTPM(1, 0, 0, 0, &rsf);
+	ResetMocks(0, 0);
+	TEST_EQ(RollbackKernelLock(), 0, "RollbackKernelLock() in recovery");
+	TEST_STR_EQ(mock_calls, "", "no tlcl calls");
 }
 
 /* Tests for RollbackS3Resume() */
-static void RollbackS3ResumeTest(void) {
-
-  ResetMocks(0, 0);
-  TEST_EQ(RollbackS3Resume(), 0, "RollbackS3Resume()");
-  TEST_STR_EQ(mock_calls,
-              "TlclLibInit()\n"
-              "TlclResume()\n",
-              "tlcl calls");
-
-  /* Should ignore postinit error */
-  ResetMocks(2, TPM_E_INVALID_POSTINIT);
-  TEST_EQ(RollbackS3Resume(), 0, "RollbackS3Resume() postinit");
-
-  /* Resume with other error */
-  ResetMocks(2, TPM_E_IOERROR);
-  TEST_EQ(RollbackS3Resume(), TPM_E_IOERROR, "RollbackS3Resume() other error");
+static void RollbackS3ResumeTest(void)
+{
+	ResetMocks(0, 0);
+	TEST_EQ(RollbackS3Resume(), 0, "RollbackS3Resume()");
+	TEST_STR_EQ(mock_calls,
+		    "TlclLibInit()\n"
+		    "TlclResume()\n",
+		    "tlcl calls");
+
+	/* Should ignore postinit error */
+	ResetMocks(2, TPM_E_INVALID_POSTINIT);
+	TEST_EQ(RollbackS3Resume(), 0, "RollbackS3Resume() postinit");
+
+	/* Resume with other error */
+	ResetMocks(2, TPM_E_IOERROR);
+	TEST_EQ(RollbackS3Resume(), TPM_E_IOERROR,
+		"RollbackS3Resume() other error");
 }
 
 /* disable MSVC warnings on unused arguments */
 __pragma(warning (disable: 4100))
 
-int main(int argc, char* argv[]) {
-  int error_code = 0;
-
-  CrcTestFirmware();
-  CrcTestKernel();
-  MiscTest();
-  OneTimeInitTest();
-  SetupTpmTest();
-  RollbackFirmwareTest();
-  RollbackKernelTest();
-  RollbackS3ResumeTest();
-
-  if (!gTestSuccess)
-    error_code = 255;
-
-  return error_code;
+int main(int argc, char* argv[])
+{
+	CrcTestFirmware();
+	CrcTestKernel();
+	MiscTest();
+	OneTimeInitTest();
+	SetupTpmTest();
+	RollbackFirmwareTest();
+	RollbackKernelTest();
+	RollbackS3ResumeTest();
+
+	return gTestSuccess ? 0 : 255;
 }
diff --git a/tests/rollback_index3_tests.c b/tests/rollback_index3_tests.c
new file mode 100644
index 00000000..ece8bc08
--- /dev/null
+++ b/tests/rollback_index3_tests.c
@@ -0,0 +1,45 @@
+/* Copyright (c) 2013 The Chromium OS Authors. All rights reserved.
+ * Use of this source code is governed by a BSD-style license that can be
+ * found in the LICENSE file.
+ *
+ * Tests for do-nothing rollback_index functions with disabled TPM
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#define _STUB_IMPLEMENTATION_  /* So we can use memset() ourselves */
+
+#include "rollback_index.h"
+#include "test_common.h"
+
+/* disable MSVC warnings on unused arguments */
+__pragma(warning (disable: 4100))
+
+int main(int argc, char* argv[])
+{
+	int is_virt_dev;
+	uint32_t version;
+
+	TEST_EQ(RollbackS3Resume(), 0, "RollbackS3Resume()");
+
+	is_virt_dev = 1;
+	version = 1;
+	TEST_EQ(RollbackFirmwareSetup(0, 0, 0, 0, &is_virt_dev, &version),
+		0, "RollbackFirmwareSetup()");
+	TEST_EQ(is_virt_dev, 0, "rfs is_virt_dev");
+	TEST_EQ(version, 0, "rfs version");
+
+	TEST_EQ(RollbackFirmwareWrite(0), 0, "RollbackFirmwareWrite()");
+	TEST_EQ(RollbackFirmwareLock(), 0, "RollbackFirmwareLock()");
+
+	version = 1;
+	TEST_EQ(RollbackKernelRead(&version), 0, "RollbackKernelRead()");
+	TEST_EQ(version, 0, "rkr version");
+
+	TEST_EQ(RollbackKernelWrite(0), 0, "RollbackKernelWrite()");
+	TEST_EQ(RollbackKernelLock(), 0, "RollbackKernelLock()");
+
+	return gTestSuccess ? 0 : 255;
+}