diff options
-rw-r--r-- | Makefile | 2 | ||||
-rw-r--r-- | firmware/lib/rollback_index.c | 893 | ||||
-rw-r--r-- | tests/rollback_index2_tests.c | 1630 | ||||
-rw-r--r-- | tests/rollback_index3_tests.c | 45 |
4 files changed, 1380 insertions, 1190 deletions
@@ -405,6 +405,7 @@ ALL_OBJS += ${TESTLIB_OBJS} TEST_NAMES = \ cgptlib_test \ rollback_index2_tests \ + rollback_index3_tests \ rsa_padding_test \ rsa_utility_tests \ rsa_verify_benchmark \ @@ -932,6 +933,7 @@ runtestscripts: test_setup genfuzztestcases .PHONY: runmisctests runmisctests: test_setup ${RUNTEST} ${BUILD_RUN}/tests/rollback_index2_tests + ${RUNTEST} ${BUILD_RUN}/tests/rollback_index3_tests ${RUNTEST} ${BUILD_RUN}/tests/rsa_utility_tests ${RUNTEST} ${BUILD_RUN}/tests/sha_tests ${RUNTEST} ${BUILD_RUN}/tests/stateful_util_tests diff --git a/firmware/lib/rollback_index.c b/firmware/lib/rollback_index.c index ee89d7e6..82323235 100644 --- a/firmware/lib/rollback_index.c +++ b/firmware/lib/rollback_index.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2012 The Chromium OS Authors. All rights reserved. +/* Copyright (c) 2013 The Chromium OS Authors. All rights reserved. * Use of this source code is governed by a BSD-style license that can be * found in the LICENSE file. * @@ -39,246 +39,281 @@ __pragma(warning (disable: 4127)) } while (0) -uint32_t TPMClearAndReenable(void) { - VBDEBUG(("TPM: Clear and re-enable\n")); - RETURN_ON_FAILURE(TlclForceClear()); - RETURN_ON_FAILURE(TlclSetEnable()); - RETURN_ON_FAILURE(TlclSetDeactivated(0)); +uint32_t TPMClearAndReenable(void) +{ + VBDEBUG(("TPM: Clear and re-enable\n")); + RETURN_ON_FAILURE(TlclForceClear()); + RETURN_ON_FAILURE(TlclSetEnable()); + RETURN_ON_FAILURE(TlclSetDeactivated(0)); - return TPM_SUCCESS; + return TPM_SUCCESS; } - -uint32_t SafeWrite(uint32_t index, const void* data, uint32_t length) { - uint32_t result = TlclWrite(index, data, length); - if (result == TPM_E_MAXNVWRITES) { - RETURN_ON_FAILURE(TPMClearAndReenable()); - return TlclWrite(index, data, length); - } else { - return result; - } +uint32_t SafeWrite(uint32_t index, const void *data, uint32_t length) +{ + uint32_t result = TlclWrite(index, data, length); + if (result == TPM_E_MAXNVWRITES) { + RETURN_ON_FAILURE(TPMClearAndReenable()); + return TlclWrite(index, data, length); + } else { + return result; + } } - -uint32_t SafeDefineSpace(uint32_t index, uint32_t perm, uint32_t size) { - uint32_t result = TlclDefineSpace(index, perm, size); - if (result == TPM_E_MAXNVWRITES) { - RETURN_ON_FAILURE(TPMClearAndReenable()); - return TlclDefineSpace(index, perm, size); - } else { - return result; - } +uint32_t SafeDefineSpace(uint32_t index, uint32_t perm, uint32_t size) +{ + uint32_t result = TlclDefineSpace(index, perm, size); + if (result == TPM_E_MAXNVWRITES) { + RETURN_ON_FAILURE(TPMClearAndReenable()); + return TlclDefineSpace(index, perm, size); + } else { + return result; + } } - /* Functions to read and write firmware and kernel spaces. */ -uint32_t ReadSpaceFirmware(RollbackSpaceFirmware* rsf) { - uint32_t r; - int attempts = 3; - - while (attempts--) { - r = TlclRead(FIRMWARE_NV_INDEX, rsf, sizeof(RollbackSpaceFirmware)); - if (r != TPM_SUCCESS) - return r; - - /* No CRC in this version, so we'll create one when we write it. Note that - * we're marking this as version 2, not ROLLBACK_SPACE_FIRMWARE_VERSION, - * because version 2 just added the CRC. Later versions will need to - * set default values for any extra fields explicitly (probably here). */ - if (rsf->struct_version < 2) { - rsf->struct_version = 2; /* Danger Will Robinson! Danger! */ - return TPM_SUCCESS; - } - - /* If the CRC is good, we're done. If it's bad, try a couple more times to - * see if it gets better before we give up. It could just be noise. */ - if (rsf->crc8 == Crc8(rsf, offsetof(RollbackSpaceFirmware, crc8))) - return TPM_SUCCESS; - - VBDEBUG(("TPM: %s() - bad CRC\n", __func__)); - } - - VBDEBUG(("TPM: %s() - too many bad CRCs, giving up\n", __func__)); - return TPM_E_CORRUPTED_STATE; +uint32_t ReadSpaceFirmware(RollbackSpaceFirmware *rsf) +{ + uint32_t r; + int attempts = 3; + + while (attempts--) { + r = TlclRead(FIRMWARE_NV_INDEX, rsf, + sizeof(RollbackSpaceFirmware)); + if (r != TPM_SUCCESS) + return r; + + /* + * No CRC in this version, so we'll create one when we write + * it. Note that we're marking this as version 2, not + * ROLLBACK_SPACE_FIRMWARE_VERSION, because version 2 just + * added the CRC. Later versions will need to set default + * values for any extra fields explicitly (probably here). + */ + if (rsf->struct_version < 2) { + /* Danger Will Robinson! Danger! */ + rsf->struct_version = 2; + return TPM_SUCCESS; + } + + /* + * If the CRC is good, we're done. If it's bad, try a couple + * more times to see if it gets better before we give up. It + * could just be noise. + */ + if (rsf->crc8 == Crc8(rsf, + offsetof(RollbackSpaceFirmware, crc8))) + return TPM_SUCCESS; + + VBDEBUG(("TPM: %s() - bad CRC\n", __func__)); + } + + VBDEBUG(("TPM: %s() - too many bad CRCs, giving up\n", __func__)); + return TPM_E_CORRUPTED_STATE; } -uint32_t WriteSpaceFirmware(RollbackSpaceFirmware* rsf) { - RollbackSpaceFirmware rsf2; - uint32_t r; - int attempts = 3; - - /* All writes should use struct_version 2 or greater. */ - if (rsf->struct_version < 2) - rsf->struct_version = 2; - rsf->crc8 = Crc8(rsf, offsetof(RollbackSpaceFirmware, crc8)); - - while (attempts--) { - r = SafeWrite(FIRMWARE_NV_INDEX, rsf, sizeof(RollbackSpaceFirmware)); - /* Can't write, not gonna try again */ - if (r != TPM_SUCCESS) - return r; - - /* Read it back to be sure it got the right values. */ - r = ReadSpaceFirmware(&rsf2); /* This checks the CRC */ - if (r == TPM_SUCCESS) - return r; - - VBDEBUG(("TPM: %s() - bad CRC\n", __func__)); - /* Try writing it again. Maybe it was garbled on the way out. */ - } - - VBDEBUG(("TPM: %s() - too many bad CRCs, giving up\n", __func__)); - return TPM_E_CORRUPTED_STATE; +uint32_t WriteSpaceFirmware(RollbackSpaceFirmware *rsf) +{ + RollbackSpaceFirmware rsf2; + uint32_t r; + int attempts = 3; + + /* All writes should use struct_version 2 or greater. */ + if (rsf->struct_version < 2) + rsf->struct_version = 2; + rsf->crc8 = Crc8(rsf, offsetof(RollbackSpaceFirmware, crc8)); + + while (attempts--) { + r = SafeWrite(FIRMWARE_NV_INDEX, rsf, + sizeof(RollbackSpaceFirmware)); + /* Can't write, not gonna try again */ + if (r != TPM_SUCCESS) + return r; + + /* Read it back to be sure it got the right values. */ + r = ReadSpaceFirmware(&rsf2); /* This checks the CRC */ + if (r == TPM_SUCCESS) + return r; + + VBDEBUG(("TPM: %s() - bad CRC\n", __func__)); + /* Try writing it again. Maybe it was garbled on the way out. */ + } + + VBDEBUG(("TPM: %s() - too many bad CRCs, giving up\n", __func__)); + return TPM_E_CORRUPTED_STATE; } -uint32_t SetVirtualDevMode(int val) { - RollbackSpaceFirmware rsf; - - VBDEBUG(("TPM: Entering %s()\n", __func__)); - if (TPM_SUCCESS != ReadSpaceFirmware(&rsf)) - return VBERROR_TPM_FIRMWARE_SETUP; - - VBDEBUG(("TPM: flags were 0x%02x\n", rsf.flags)); - if (val) - rsf.flags |= FLAG_VIRTUAL_DEV_MODE_ON; - else - rsf.flags &= ~FLAG_VIRTUAL_DEV_MODE_ON; - /* NOTE: This doesn't update the FLAG_LAST_BOOT_DEVELOPER bit */ - VBDEBUG(("TPM: flags are now 0x%02x\n", rsf.flags)); - - if (TPM_SUCCESS != WriteSpaceFirmware(&rsf)) - return VBERROR_TPM_SET_BOOT_MODE_STATE; - - VBDEBUG(("TPM: Leaving %s()\n", __func__)); - return VBERROR_SUCCESS; +uint32_t SetVirtualDevMode(int val) +{ + RollbackSpaceFirmware rsf; + + VBDEBUG(("TPM: Entering %s()\n", __func__)); + if (TPM_SUCCESS != ReadSpaceFirmware(&rsf)) + return VBERROR_TPM_FIRMWARE_SETUP; + + VBDEBUG(("TPM: flags were 0x%02x\n", rsf.flags)); + if (val) + rsf.flags |= FLAG_VIRTUAL_DEV_MODE_ON; + else + rsf.flags &= ~FLAG_VIRTUAL_DEV_MODE_ON; + /* + * NOTE: This doesn't update the FLAG_LAST_BOOT_DEVELOPER bit. That + * will be done by SetupTPM() on the next boot. + */ + VBDEBUG(("TPM: flags are now 0x%02x\n", rsf.flags)); + + if (TPM_SUCCESS != WriteSpaceFirmware(&rsf)) + return VBERROR_TPM_SET_BOOT_MODE_STATE; + + VBDEBUG(("TPM: Leaving %s()\n", __func__)); + return VBERROR_SUCCESS; } -uint32_t ReadSpaceKernel(RollbackSpaceKernel* rsk) { - uint32_t r; - int attempts = 3; - - while (attempts--) { - r = TlclRead(KERNEL_NV_INDEX, rsk, sizeof(RollbackSpaceKernel)); - if (r != TPM_SUCCESS) - return r; - - /* No CRC in this version, so we'll create one when we write it. Note that - * we're marking this as version 2, not ROLLBACK_SPACE_KERNEL_VERSION, - * because version 2 just added the CRC. Later versions will need to - * set default values for any extra fields explicitly (probably here). */ - if (rsk->struct_version < 2) { - rsk->struct_version = 2; /* Danger Will Robinson! Danger! */ - return TPM_SUCCESS; - } - - /* If the CRC is good, we're done. If it's bad, try a couple more times to - * see if it gets better before we give up. It could just be noise. */ - if (rsk->crc8 == Crc8(rsk, offsetof(RollbackSpaceKernel, crc8))) - return TPM_SUCCESS; - - VBDEBUG(("TPM: %s() - bad CRC\n", __func__)); - } - - VBDEBUG(("TPM: %s() - too many bad CRCs, giving up\n", __func__)); - return TPM_E_CORRUPTED_STATE; +uint32_t ReadSpaceKernel(RollbackSpaceKernel *rsk) +{ + uint32_t r; + int attempts = 3; + + while (attempts--) { + r = TlclRead(KERNEL_NV_INDEX, rsk, sizeof(RollbackSpaceKernel)); + if (r != TPM_SUCCESS) + return r; + + /* + * No CRC in this version, so we'll create one when we write + * it. Note that we're marking this as version 2, not + * ROLLBACK_SPACE_KERNEL_VERSION, because version 2 just added + * the CRC. Later versions will need to set default values for + * any extra fields explicitly (probably here). + */ + if (rsk->struct_version < 2) { + /* Danger Will Robinson! Danger! */ + rsk->struct_version = 2; + return TPM_SUCCESS; + } + + /* + * If the CRC is good, we're done. If it's bad, try a couple + * more times to see if it gets better before we give up. It + * could just be noise. + */ + if (rsk->crc8 == Crc8(rsk, offsetof(RollbackSpaceKernel, crc8))) + return TPM_SUCCESS; + + VBDEBUG(("TPM: %s() - bad CRC\n", __func__)); + } + + VBDEBUG(("TPM: %s() - too many bad CRCs, giving up\n", __func__)); + return TPM_E_CORRUPTED_STATE; } -uint32_t WriteSpaceKernel(RollbackSpaceKernel* rsk) { - RollbackSpaceKernel rsk2; - uint32_t r; - int attempts = 3; - - /* All writes should use struct_version 2 or greater. */ - if (rsk->struct_version < 2) - rsk->struct_version = 2; - rsk->crc8 = Crc8(rsk, offsetof(RollbackSpaceKernel, crc8)); - - while (attempts--) { - r = SafeWrite(KERNEL_NV_INDEX, rsk, sizeof(RollbackSpaceKernel)); - /* Can't write, not gonna try again */ - if (r != TPM_SUCCESS) - return r; - - /* Read it back to be sure it got the right values. */ - r = ReadSpaceKernel(&rsk2); /* This checks the CRC */ - if (r == TPM_SUCCESS) - return r; - - VBDEBUG(("TPM: %s() - bad CRC\n", __func__)); - /* Try writing it again. Maybe it was garbled on the way out. */ - } - - VBDEBUG(("TPM: %s() - too many bad CRCs, giving up\n", __func__)); - return TPM_E_CORRUPTED_STATE; +uint32_t WriteSpaceKernel(RollbackSpaceKernel *rsk) +{ + RollbackSpaceKernel rsk2; + uint32_t r; + int attempts = 3; + + /* All writes should use struct_version 2 or greater. */ + if (rsk->struct_version < 2) + rsk->struct_version = 2; + rsk->crc8 = Crc8(rsk, offsetof(RollbackSpaceKernel, crc8)); + + while (attempts--) { + r = SafeWrite(KERNEL_NV_INDEX, rsk, + sizeof(RollbackSpaceKernel)); + /* Can't write, not gonna try again */ + if (r != TPM_SUCCESS) + return r; + + /* Read it back to be sure it got the right values. */ + r = ReadSpaceKernel(&rsk2); /* This checks the CRC */ + if (r == TPM_SUCCESS) + return r; + + VBDEBUG(("TPM: %s() - bad CRC\n", __func__)); + /* Try writing it again. Maybe it was garbled on the way out. */ + } + + VBDEBUG(("TPM: %s() - too many bad CRCs, giving up\n", __func__)); + return TPM_E_CORRUPTED_STATE; } - -uint32_t OneTimeInitializeTPM(RollbackSpaceFirmware* rsf, - RollbackSpaceKernel* rsk) { - static const RollbackSpaceFirmware rsf_init = { - .struct_version = ROLLBACK_SPACE_FIRMWARE_VERSION, - }; - static const RollbackSpaceKernel rsk_init = { - .struct_version = ROLLBACK_SPACE_KERNEL_VERSION, - .uid = ROLLBACK_SPACE_KERNEL_UID, - }; - TPM_PERMANENT_FLAGS pflags; - uint32_t result; - - VBDEBUG(("TPM: One-time initialization\n")); - - /* Do a full test. This only happens the first time the device is turned on - * in the factory, so performance is not an issue. This is almost certainly - * not necessary, but it gives us more confidence about some code paths below - * that are difficult to test---specifically the ones that set lifetime - * flags, and are only executed once per physical TPM. */ - result = TlclSelfTestFull(); - if (result != TPM_SUCCESS) - return result; - - result = TlclGetPermanentFlags(&pflags); - if (result != TPM_SUCCESS) - return result; - - /* TPM may come from the factory without physical presence finalized. Fix - * if necessary. */ - VBDEBUG(("TPM: physicalPresenceLifetimeLock=%d\n", - pflags.physicalPresenceLifetimeLock)); - if (!pflags.physicalPresenceLifetimeLock) { - VBDEBUG(("TPM: Finalizing physical presence\n")); - RETURN_ON_FAILURE(TlclFinalizePhysicalPresence()); - } - - /* The TPM will not enforce the NV authorization restrictions until the - * execution of a TPM_NV_DefineSpace with the handle of TPM_NV_INDEX_LOCK. - * Here we create that space if it doesn't already exist. */ - VBDEBUG(("TPM: nvLocked=%d\n", pflags.nvLocked)); - if (!pflags.nvLocked) { - VBDEBUG(("TPM: Enabling NV locking\n")); - RETURN_ON_FAILURE(TlclSetNvLocked()); - } - - /* Clear TPM owner, in case the TPM is already owned for some reason. */ - VBDEBUG(("TPM: Clearing owner\n")); - RETURN_ON_FAILURE(TPMClearAndReenable()); - - /* Initializes the firmware and kernel spaces */ - Memcpy(rsf, &rsf_init, sizeof(RollbackSpaceFirmware)); - Memcpy(rsk, &rsk_init, sizeof(RollbackSpaceKernel)); - - /* Defines and sets firmware and kernel spaces */ - RETURN_ON_FAILURE(SafeDefineSpace(KERNEL_NV_INDEX, TPM_NV_PER_PPWRITE, - sizeof(RollbackSpaceKernel))); - RETURN_ON_FAILURE(WriteSpaceKernel(rsk)); - RETURN_ON_FAILURE(SafeDefineSpace(FIRMWARE_NV_INDEX, - TPM_NV_PER_GLOBALLOCK | TPM_NV_PER_PPWRITE, - sizeof(RollbackSpaceFirmware))); - RETURN_ON_FAILURE(WriteSpaceFirmware(rsf)); - return TPM_SUCCESS; +uint32_t OneTimeInitializeTPM(RollbackSpaceFirmware *rsf, + RollbackSpaceKernel *rsk) +{ + static const RollbackSpaceFirmware rsf_init = { + .struct_version = ROLLBACK_SPACE_FIRMWARE_VERSION, + }; + static const RollbackSpaceKernel rsk_init = { + .struct_version = ROLLBACK_SPACE_KERNEL_VERSION, + .uid = ROLLBACK_SPACE_KERNEL_UID, + }; + TPM_PERMANENT_FLAGS pflags; + uint32_t result; + + VBDEBUG(("TPM: One-time initialization\n")); + + /* + * Do a full test. This only happens the first time the device is + * turned on in the factory, so performance is not an issue. This is + * almost certainly not necessary, but it gives us more confidence + * about some code paths below that are difficult to + * test---specifically the ones that set lifetime flags, and are only + * executed once per physical TPM. + */ + result = TlclSelfTestFull(); + if (result != TPM_SUCCESS) + return result; + + result = TlclGetPermanentFlags(&pflags); + if (result != TPM_SUCCESS) + return result; + + /* + * TPM may come from the factory without physical presence finalized. + * Fix if necessary. + */ + VBDEBUG(("TPM: physicalPresenceLifetimeLock=%d\n", + pflags.physicalPresenceLifetimeLock)); + if (!pflags.physicalPresenceLifetimeLock) { + VBDEBUG(("TPM: Finalizing physical presence\n")); + RETURN_ON_FAILURE(TlclFinalizePhysicalPresence()); + } + + /* + * The TPM will not enforce the NV authorization restrictions until the + * execution of a TPM_NV_DefineSpace with the handle of + * TPM_NV_INDEX_LOCK. Here we create that space if it doesn't already + * exist. */ + VBDEBUG(("TPM: nvLocked=%d\n", pflags.nvLocked)); + if (!pflags.nvLocked) { + VBDEBUG(("TPM: Enabling NV locking\n")); + RETURN_ON_FAILURE(TlclSetNvLocked()); + } + + /* Clear TPM owner, in case the TPM is already owned for some reason. */ + VBDEBUG(("TPM: Clearing owner\n")); + RETURN_ON_FAILURE(TPMClearAndReenable()); + + /* Initializes the firmware and kernel spaces */ + Memcpy(rsf, &rsf_init, sizeof(RollbackSpaceFirmware)); + Memcpy(rsk, &rsk_init, sizeof(RollbackSpaceKernel)); + + /* Defines and sets firmware and kernel spaces */ + RETURN_ON_FAILURE(SafeDefineSpace(KERNEL_NV_INDEX, TPM_NV_PER_PPWRITE, + sizeof(RollbackSpaceKernel))); + RETURN_ON_FAILURE(WriteSpaceKernel(rsk)); + RETURN_ON_FAILURE(SafeDefineSpace( + FIRMWARE_NV_INDEX, + TPM_NV_PER_GLOBALLOCK | TPM_NV_PER_PPWRITE, + sizeof(RollbackSpaceFirmware))); + RETURN_ON_FAILURE(WriteSpaceFirmware(rsf)); + return TPM_SUCCESS; } -/* SetupTPM starts the TPM and establishes the root of trust for the +/* + * SetupTPM starts the TPM and establishes the root of trust for the * anti-rollback mechanism. SetupTPM can fail for three reasons. 1 A bug. 2 a * TPM hardware failure. 3 An unexpected TPM state due to some attack. In * general we cannot easily distinguish the kind of failure, so our strategy is @@ -299,38 +334,40 @@ uint32_t OneTimeInitializeTPM(RollbackSpaceFirmware* rsf, */ uint32_t SetupTPM(int recovery_mode, int developer_mode, int disable_dev_request, int clear_tpm_owner_request, - RollbackSpaceFirmware* rsf) { - - uint8_t in_flags; - uint8_t disable; - uint8_t deactivated; - uint32_t result; + RollbackSpaceFirmware* rsf) +{ + uint8_t in_flags; + uint8_t disable; + uint8_t deactivated; + uint32_t result; - VBDEBUG(("TPM: SetupTPM(r%d, d%d)\n", recovery_mode, developer_mode)); + VBDEBUG(("TPM: SetupTPM(r%d, d%d)\n", recovery_mode, developer_mode)); - if (recovery_mode) - g_rollback_recovery_mode = 1; /* Global variables are usable in - * recovery mode */ + /* Global variables are usable in recovery mode */ + if (recovery_mode) + g_rollback_recovery_mode = 1; - RETURN_ON_FAILURE(TlclLibInit()); + RETURN_ON_FAILURE(TlclLibInit()); #ifdef TEGRA_SOFT_REBOOT_WORKAROUND - result = TlclStartup(); - if (result == TPM_E_INVALID_POSTINIT) { - /* Some prototype hardware doesn't reset the TPM on a CPU reset. We do a - * hard reset to get around this. - */ - VBDEBUG(("TPM: soft reset detected\n", result)); - return TPM_E_MUST_REBOOT; - } else if (result != TPM_SUCCESS) { - VBDEBUG(("TPM: TlclStartup returned %08x\n", result)); - return result; - } + result = TlclStartup(); + if (result == TPM_E_INVALID_POSTINIT) { + /* + * Some prototype hardware doesn't reset the TPM on a CPU + * reset. We do a hard reset to get around this. + */ + VBDEBUG(("TPM: soft reset detected\n", result)); + return TPM_E_MUST_REBOOT; + } else if (result != TPM_SUCCESS) { + VBDEBUG(("TPM: TlclStartup returned %08x\n", result)); + return result; + } #else - RETURN_ON_FAILURE(TlclStartup()); + RETURN_ON_FAILURE(TlclStartup()); #endif - /* Some TPMs start the self test automatically at power on. In that case we + /* + * Some TPMs start the self test automatically at power on. In that case we * don't need to call ContinueSelfTest. On some (other) TPMs, * ContinueSelfTest may block. In that case, we definitely don't want to * call it here. For TPMs in the intersection of these two sets, we're @@ -346,225 +383,249 @@ uint32_t SetupTPM(int recovery_mode, int developer_mode, #ifdef TPM_BLOCKING_CONTINUESELFTEST #warning "lousy TPM!" #endif - RETURN_ON_FAILURE(TlclContinueSelfTest()); + RETURN_ON_FAILURE(TlclContinueSelfTest()); #endif - result = TlclAssertPhysicalPresence(); - if (result != TPM_SUCCESS) { - /* It is possible that the TPM was delivered with the physical presence - * command disabled. This tries enabling it, then tries asserting PP - * again. - */ - RETURN_ON_FAILURE(TlclPhysicalPresenceCMDEnable()); - RETURN_ON_FAILURE(TlclAssertPhysicalPresence()); - } - - /* Checks that the TPM is enabled and activated. */ - RETURN_ON_FAILURE(TlclGetFlags(&disable, &deactivated, NULL)); - if (disable || deactivated) { - VBDEBUG(("TPM: disabled (%d) or deactivated (%d). Fixing...\n", - disable, deactivated)); - RETURN_ON_FAILURE(TlclSetEnable()); - RETURN_ON_FAILURE(TlclSetDeactivated(0)); - VBDEBUG(("TPM: Must reboot to re-enable\n")); - return TPM_E_MUST_REBOOT; - } - - /* Reads the firmware space. */ - result = ReadSpaceFirmware(rsf); - if (TPM_E_BADINDEX == result) { - RollbackSpaceKernel rsk; - - /* This is the first time we've run, and the TPM has not been - * initialized. This initializes it. */ - VBDEBUG(("TPM: Not initialized yet.\n")); - RETURN_ON_FAILURE(OneTimeInitializeTPM(rsf, &rsk)); - } else if (TPM_SUCCESS != result) { - VBDEBUG(("TPM: Firmware space in a bad state; giving up.\n")); - return TPM_E_CORRUPTED_STATE; - } - VBDEBUG(("TPM: Firmware space sv%d f%x v%x\n", - rsf->struct_version, rsf->flags, rsf->fw_versions)); - in_flags = rsf->flags; - - /* If we've been asked to clear the virtual dev-mode flag, do so now */ - if (disable_dev_request) { - rsf->flags &= ~FLAG_VIRTUAL_DEV_MODE_ON; - VBDEBUG(("TPM: Clearing virt dev-switch: f%x\n", rsf->flags)); - } - - /* The developer_mode value that's passed in is only set by a hardware - * dev-switch. We should OR it with the virtual switch, whether or not the - * virtual switch is used. If it's not used, it shouldn't change, so it - * doesn't matter. */ - if (rsf->flags & FLAG_VIRTUAL_DEV_MODE_ON) - developer_mode = 1; - - /* Clears ownership if developer flag has toggled, or if an owner-clear has - * been requested. */ - if ((developer_mode ? FLAG_LAST_BOOT_DEVELOPER : 0) != - (in_flags & FLAG_LAST_BOOT_DEVELOPER)) { - VBDEBUG(("TPM: Developer flag changed; clearing owner.\n")); - RETURN_ON_FAILURE(TPMClearAndReenable()); - } else if (clear_tpm_owner_request) { - VBDEBUG(("TPM: Clearing owner as specifically requested.\n")); - RETURN_ON_FAILURE(TPMClearAndReenable()); - } - - if (developer_mode) - rsf->flags |= FLAG_LAST_BOOT_DEVELOPER; - else - rsf->flags &= ~FLAG_LAST_BOOT_DEVELOPER; - - - /* If firmware space is dirty, this flushes it back to the TPM */ - if (rsf->flags != in_flags) { - VBDEBUG(("TPM: Updating firmware space.\n")); - RETURN_ON_FAILURE(WriteSpaceFirmware(rsf)); - } - - VBDEBUG(("TPM: SetupTPM() succeeded\n")); - return TPM_SUCCESS; + result = TlclAssertPhysicalPresence(); + if (result != TPM_SUCCESS) { + /* + * It is possible that the TPM was delivered with the physical + * presence command disabled. This tries enabling it, then + * tries asserting PP again. + */ + RETURN_ON_FAILURE(TlclPhysicalPresenceCMDEnable()); + RETURN_ON_FAILURE(TlclAssertPhysicalPresence()); + } + + /* Check that the TPM is enabled and activated. */ + RETURN_ON_FAILURE(TlclGetFlags(&disable, &deactivated, NULL)); + if (disable || deactivated) { + VBDEBUG(("TPM: disabled (%d) or deactivated (%d). Fixing...\n", + disable, deactivated)); + RETURN_ON_FAILURE(TlclSetEnable()); + RETURN_ON_FAILURE(TlclSetDeactivated(0)); + VBDEBUG(("TPM: Must reboot to re-enable\n")); + return TPM_E_MUST_REBOOT; + } + + /* Read the firmware space. */ + result = ReadSpaceFirmware(rsf); + if (TPM_E_BADINDEX == result) { + RollbackSpaceKernel rsk; + + /* + * This is the first time we've run, and the TPM has not been + * initialized. Initialize it. + */ + VBDEBUG(("TPM: Not initialized yet.\n")); + RETURN_ON_FAILURE(OneTimeInitializeTPM(rsf, &rsk)); + } else if (TPM_SUCCESS != result) { + VBDEBUG(("TPM: Firmware space in a bad state; giving up.\n")); + return TPM_E_CORRUPTED_STATE; + } + VBDEBUG(("TPM: Firmware space sv%d f%x v%x\n", + rsf->struct_version, rsf->flags, rsf->fw_versions)); + in_flags = rsf->flags; + + /* If we've been asked to clear the virtual dev-mode flag, do so now */ + if (disable_dev_request) { + rsf->flags &= ~FLAG_VIRTUAL_DEV_MODE_ON; + VBDEBUG(("TPM: Clearing virt dev-switch: f%x\n", rsf->flags)); + } + + /* + * The developer_mode value that's passed in is only set by a hardware + * dev-switch. We should OR it with the virtual switch, whether or not + * the virtual switch is used. If it's not used, it shouldn't change, + * so it doesn't matter. + */ + if (rsf->flags & FLAG_VIRTUAL_DEV_MODE_ON) + developer_mode = 1; + + /* + * Clear ownership if developer flag has toggled, or if an owner-clear + * has been requested. + */ + if ((developer_mode ? FLAG_LAST_BOOT_DEVELOPER : 0) != + (in_flags & FLAG_LAST_BOOT_DEVELOPER)) { + VBDEBUG(("TPM: Developer flag changed; clearing owner.\n")); + RETURN_ON_FAILURE(TPMClearAndReenable()); + } else if (clear_tpm_owner_request) { + VBDEBUG(("TPM: Clearing owner as specifically requested.\n")); + RETURN_ON_FAILURE(TPMClearAndReenable()); + } + + if (developer_mode) + rsf->flags |= FLAG_LAST_BOOT_DEVELOPER; + else + rsf->flags &= ~FLAG_LAST_BOOT_DEVELOPER; + + + /* If firmware space is dirty, flush it back to the TPM */ + if (rsf->flags != in_flags) { + VBDEBUG(("TPM: Updating firmware space.\n")); + RETURN_ON_FAILURE(WriteSpaceFirmware(rsf)); + } + + VBDEBUG(("TPM: SetupTPM() succeeded\n")); + return TPM_SUCCESS; } -/* disable MSVC warnings on unused arguments */ +/* Disable MSVC warnings on unused arguments */ __pragma(warning (disable: 4100)) #ifdef DISABLE_ROLLBACK_TPM - /* Dummy implementations which don't support TPM rollback protection */ -uint32_t RollbackS3Resume(void) { +uint32_t RollbackS3Resume(void) +{ #ifndef CHROMEOS_ENVIRONMENT - /* Initialize the TPM, but ignore return codes. In ChromeOS - * environment, don't even talk to the TPM. */ - TlclLibInit(); - TlclResume(); + /* + * Initialize the TPM, but ignore return codes. In ChromeOS + * environment, don't even talk to the TPM. + */ + TlclLibInit(); + TlclResume(); #endif - return TPM_SUCCESS; + return TPM_SUCCESS; } uint32_t RollbackFirmwareSetup(int recovery_mode, int is_hw_dev, int disable_dev_request, int clear_tpm_owner_request, - int *is_virt_dev, uint32_t *version) { + int *is_virt_dev, uint32_t *version) +{ #ifndef CHROMEOS_ENVIRONMENT - /* Initialize the TPM, but ignores return codes. In ChromeOS - * environment, don't even talk to the TPM. */ - TlclLibInit(); - TlclStartup(); - TlclContinueSelfTest(); + /* + * Initialize the TPM, but ignores return codes. In ChromeOS + * environment, don't even talk to the TPM. + */ + TlclLibInit(); + TlclStartup(); + TlclContinueSelfTest(); #endif - *version = 0; - return TPM_SUCCESS; -} - -uint32_t RollbackFirmwareRead(uint32_t* version) { - *version = 0; - return TPM_SUCCESS; + *is_virt_dev = 0; + *version = 0; + return TPM_SUCCESS; } -uint32_t RollbackFirmwareWrite(uint32_t version) { - return TPM_SUCCESS; +uint32_t RollbackFirmwareWrite(uint32_t version) +{ + return TPM_SUCCESS; } -uint32_t RollbackFirmwareLock(void) { - return TPM_SUCCESS; +uint32_t RollbackFirmwareLock(void) +{ + return TPM_SUCCESS; } -uint32_t RollbackKernelRead(uint32_t* version) { - *version = 0; - return TPM_SUCCESS; +uint32_t RollbackKernelRead(uint32_t* version) +{ + *version = 0; + return TPM_SUCCESS; } -uint32_t RollbackKernelWrite(uint32_t version) { - return TPM_SUCCESS; +uint32_t RollbackKernelWrite(uint32_t version) +{ + return TPM_SUCCESS; } -uint32_t RollbackKernelLock(void) { - return TPM_SUCCESS; +uint32_t RollbackKernelLock(void) +{ + return TPM_SUCCESS; } #else -uint32_t RollbackS3Resume(void) { - uint32_t result; - RETURN_ON_FAILURE(TlclLibInit()); - result = TlclResume(); - if (result == TPM_E_INVALID_POSTINIT) { - /* We're on a platform where the TPM maintains power in S3, so - it's already initialized. */ - return TPM_SUCCESS; - } - return result; +uint32_t RollbackS3Resume(void) +{ + uint32_t result; + RETURN_ON_FAILURE(TlclLibInit()); + result = TlclResume(); + if (result == TPM_E_INVALID_POSTINIT) { + /* + * We're on a platform where the TPM maintains power in S3, so + * it's already initialized. + */ + return TPM_SUCCESS; + } + return result; } uint32_t RollbackFirmwareSetup(int recovery_mode, int is_hw_dev, int disable_dev_request, int clear_tpm_owner_request, - int *is_virt_dev, uint32_t *version) { - RollbackSpaceFirmware rsf; - - /* Set version to 0 in case we fail */ - *version = 0; - - RETURN_ON_FAILURE(SetupTPM(recovery_mode, is_hw_dev, disable_dev_request, - clear_tpm_owner_request, &rsf)); - *version = rsf.fw_versions; - *is_virt_dev = (rsf.flags & FLAG_VIRTUAL_DEV_MODE_ON) ? 1 : 0; - VBDEBUG(("TPM: RollbackFirmwareSetup %x\n", (int)rsf.fw_versions)); - return TPM_SUCCESS; + int *is_virt_dev, uint32_t *version) +{ + RollbackSpaceFirmware rsf; + + /* Set version to 0 in case we fail */ + *version = 0; + + RETURN_ON_FAILURE(SetupTPM(recovery_mode, is_hw_dev, + disable_dev_request, + clear_tpm_owner_request, &rsf)); + *version = rsf.fw_versions; + *is_virt_dev = (rsf.flags & FLAG_VIRTUAL_DEV_MODE_ON) ? 1 : 0; + VBDEBUG(("TPM: RollbackFirmwareSetup %x\n", (int)rsf.fw_versions)); + return TPM_SUCCESS; } -uint32_t RollbackFirmwareWrite(uint32_t version) { - RollbackSpaceFirmware rsf; +uint32_t RollbackFirmwareWrite(uint32_t version) +{ + RollbackSpaceFirmware rsf; - RETURN_ON_FAILURE(ReadSpaceFirmware(&rsf)); - VBDEBUG(("TPM: RollbackFirmwareWrite %x --> %x\n", (int)rsf.fw_versions, - (int)version)); - rsf.fw_versions = version; - return WriteSpaceFirmware(&rsf); + RETURN_ON_FAILURE(ReadSpaceFirmware(&rsf)); + VBDEBUG(("TPM: RollbackFirmwareWrite %x --> %x\n", (int)rsf.fw_versions, + (int)version)); + rsf.fw_versions = version; + return WriteSpaceFirmware(&rsf); } -uint32_t RollbackFirmwareLock(void) { - return TlclSetGlobalLock(); +uint32_t RollbackFirmwareLock(void) +{ + return TlclSetGlobalLock(); } -uint32_t RollbackKernelRead(uint32_t* version) { - RollbackSpaceKernel rsk; - uint32_t perms; - - /* Read the kernel space and verify its permissions. If the kernel - * space has the wrong permission, or it doesn't contain the right - * identifier, we give up. This will need to be fixed by the - * recovery kernel. We have to worry about this because at any time - * (even with PP turned off) the TPM owner can remove and redefine a - * PP-protected space (but not write to it). */ - RETURN_ON_FAILURE(ReadSpaceKernel(&rsk)); - RETURN_ON_FAILURE(TlclGetPermissions(KERNEL_NV_INDEX, &perms)); - if (TPM_NV_PER_PPWRITE != perms || ROLLBACK_SPACE_KERNEL_UID != rsk.uid) - return TPM_E_CORRUPTED_STATE; - - *version = rsk.kernel_versions; - VBDEBUG(("TPM: RollbackKernelRead %x\n", (int)rsk.kernel_versions)); - return TPM_SUCCESS; +uint32_t RollbackKernelRead(uint32_t* version) +{ + RollbackSpaceKernel rsk; + uint32_t perms; + + /* + * Read the kernel space and verify its permissions. If the kernel + * space has the wrong permission, or it doesn't contain the right + * identifier, we give up. This will need to be fixed by the + * recovery kernel. We have to worry about this because at any time + * (even with PP turned off) the TPM owner can remove and redefine a + * PP-protected space (but not write to it). + */ + RETURN_ON_FAILURE(ReadSpaceKernel(&rsk)); + RETURN_ON_FAILURE(TlclGetPermissions(KERNEL_NV_INDEX, &perms)); + if (TPM_NV_PER_PPWRITE != perms || ROLLBACK_SPACE_KERNEL_UID != rsk.uid) + return TPM_E_CORRUPTED_STATE; + + *version = rsk.kernel_versions; + VBDEBUG(("TPM: RollbackKernelRead %x\n", (int)rsk.kernel_versions)); + return TPM_SUCCESS; } -uint32_t RollbackKernelWrite(uint32_t version) { - RollbackSpaceKernel rsk; - RETURN_ON_FAILURE(ReadSpaceKernel(&rsk)); - VBDEBUG(("TPM: RollbackKernelWrite %x --> %x\n", (int)rsk.kernel_versions, - (int)version)); - rsk.kernel_versions = version; - return WriteSpaceKernel(&rsk); +uint32_t RollbackKernelWrite(uint32_t version) +{ + RollbackSpaceKernel rsk; + RETURN_ON_FAILURE(ReadSpaceKernel(&rsk)); + VBDEBUG(("TPM: RollbackKernelWrite %x --> %x\n", + (int)rsk.kernel_versions, (int)version)); + rsk.kernel_versions = version; + return WriteSpaceKernel(&rsk); } -uint32_t RollbackKernelLock(void) { - if (g_rollback_recovery_mode) { - return TPM_SUCCESS; - } else { - return TlclLockPhysicalPresence(); - } +uint32_t RollbackKernelLock(void) +{ + if (g_rollback_recovery_mode) + return TPM_SUCCESS; + else + return TlclLockPhysicalPresence(); } -#endif // DISABLE_ROLLBACK_TPM +#endif /* DISABLE_ROLLBACK_TPM */ diff --git a/tests/rollback_index2_tests.c b/tests/rollback_index2_tests.c index 4a12a6e2..b670812d 100644 --- a/tests/rollback_index2_tests.c +++ b/tests/rollback_index2_tests.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2012 The Chromium OS Authors. All rights reserved. +/* Copyright (c) 2013 The Chromium OS Authors. All rights reserved. * Use of this source code is governed by a BSD-style license that can be * found in the LICENSE file. * @@ -18,7 +18,8 @@ #include "utility.h" #include "vboot_common.h" -/* Buffer to hold accumulated list of calls to mocked Tlcl functions. +/* + * Buffer to hold accumulated list of calls to mocked Tlcl functions. * Each function appends itself to the buffer and updates mock_cnext. * * Size of mock_calls[] should be big enough to handle all expected @@ -28,13 +29,16 @@ * making all the mock implementations bigger. If this were code used * outside of unit tests we'd want to do that, but here if we did * overrun the buffer the worst that's likely to happen is we'll crash - * the test, and crash = failure anyway. */ + * the test, and crash = failure anyway. + */ static char mock_calls[16384]; static char *mock_cnext = mock_calls; -/* Variables to support mocked error values from Tlcl functions. Each +/* + * Variables to support mocked error values from Tlcl functions. Each * call, mock_count is incremented. If mock_count==fail_at_count, return - * fail_with_error instead of the normal return value. */ + * fail_with_error instead of the normal return value. + */ static int mock_count = 0; static int fail_at_count = 0; static uint32_t fail_with_error = TPM_SUCCESS; @@ -44,7 +48,6 @@ static uint32_t fail_with_error = TPM_SUCCESS; static int noise_count = 0; /* read/write attempt (zero-based) */ static int noise_on[MAX_NOISE_COUNT]; /* calls to inject noise on */ - /* Params / backing store for mocked Tlcl functions. */ static TPM_PERMANENT_FLAGS mock_pflags; static RollbackSpaceFirmware mock_rsf; @@ -52,858 +55,937 @@ static RollbackSpaceKernel mock_rsk; static uint32_t mock_permissions; /* Reset the variables for the Tlcl mock functions. */ -static void ResetMocks(int fail_on_call, uint32_t fail_with_err) { - *mock_calls = 0; - mock_cnext = mock_calls; - mock_count = 0; - fail_at_count = fail_on_call; - fail_with_error = fail_with_err; - noise_count = 0; - Memset(&noise_on, 0, sizeof(noise_on)); - - Memset(&mock_pflags, 0, sizeof(mock_pflags)); - Memset(&mock_rsf, 0, sizeof(mock_rsf)); - Memset(&mock_rsk, 0, sizeof(mock_rsk)); - mock_permissions = 0; +static void ResetMocks(int fail_on_call, uint32_t fail_with_err) +{ + *mock_calls = 0; + mock_cnext = mock_calls; + mock_count = 0; + fail_at_count = fail_on_call; + fail_with_error = fail_with_err; + noise_count = 0; + Memset(&noise_on, 0, sizeof(noise_on)); + + Memset(&mock_pflags, 0, sizeof(mock_pflags)); + Memset(&mock_rsf, 0, sizeof(mock_rsf)); + Memset(&mock_rsk, 0, sizeof(mock_rsk)); + mock_permissions = 0; } /****************************************************************************/ /* Function to garble data on its way to or from the TPM */ -static void MaybeInjectNoise(void* data, uint32_t length) { - if (noise_count < MAX_NOISE_COUNT && noise_on[noise_count]) { - uint8_t *val = data; - val[length-1]++; - } - noise_count++; +static void MaybeInjectNoise(void *data, uint32_t length) +{ + if (noise_count < MAX_NOISE_COUNT && noise_on[noise_count]) { + uint8_t *val = data; + val[length - 1]++; + } + noise_count++; } /****************************************************************************/ /* Mocks for tlcl functions which log the calls made to mock_calls[]. */ -uint32_t TlclLibInit(void) { - mock_cnext += sprintf(mock_cnext, "TlclLibInit()\n"); - return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS; +uint32_t TlclLibInit(void) +{ + mock_cnext += sprintf(mock_cnext, "TlclLibInit()\n"); + return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS; } -uint32_t TlclStartup(void) { - mock_cnext += sprintf(mock_cnext, "TlclStartup()\n"); - return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS; +uint32_t TlclStartup(void) +{ + mock_cnext += sprintf(mock_cnext, "TlclStartup()\n"); + return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS; } -uint32_t TlclResume(void) { - mock_cnext += sprintf(mock_cnext, "TlclResume()\n"); - return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS; +uint32_t TlclResume(void) +{ + mock_cnext += sprintf(mock_cnext, "TlclResume()\n"); + return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS; } -uint32_t TlclForceClear(void) { - mock_cnext += sprintf(mock_cnext, "TlclForceClear()\n"); - return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS; +uint32_t TlclForceClear(void) +{ + mock_cnext += sprintf(mock_cnext, "TlclForceClear()\n"); + return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS; } -uint32_t TlclSetEnable(void) { - mock_cnext += sprintf(mock_cnext, "TlclSetEnable()\n"); - return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS; +uint32_t TlclSetEnable(void) +{ + mock_cnext += sprintf(mock_cnext, "TlclSetEnable()\n"); + return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS; } -uint32_t TlclSetDeactivated(uint8_t flag) { - mock_cnext += sprintf(mock_cnext, "TlclSetDeactivated(%d)\n", flag); - return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS; +uint32_t TlclSetDeactivated(uint8_t flag) +{ + mock_cnext += sprintf(mock_cnext, "TlclSetDeactivated(%d)\n", flag); + return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS; } -uint32_t TlclRead(uint32_t index, void* data, uint32_t length) { - mock_cnext += sprintf(mock_cnext, "TlclRead(0x%x, %d)\n", index, length); - - if (FIRMWARE_NV_INDEX == index) { - TEST_EQ(length, sizeof(mock_rsf), "TlclRead rsf size"); - Memcpy(data, &mock_rsf, length); - MaybeInjectNoise(data, length); - } else if (KERNEL_NV_INDEX == index) { - TEST_EQ(length, sizeof(mock_rsk), "TlclRead rsk size"); - Memcpy(data, &mock_rsk, length); - MaybeInjectNoise(data, length); - } else { - Memset(data, 0, length); - } - - return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS; +uint32_t TlclRead(uint32_t index, void* data, uint32_t length) +{ + mock_cnext += sprintf(mock_cnext, "TlclRead(0x%x, %d)\n", + index, length); + + if (FIRMWARE_NV_INDEX == index) { + TEST_EQ(length, sizeof(mock_rsf), "TlclRead rsf size"); + Memcpy(data, &mock_rsf, length); + MaybeInjectNoise(data, length); + } else if (KERNEL_NV_INDEX == index) { + TEST_EQ(length, sizeof(mock_rsk), "TlclRead rsk size"); + Memcpy(data, &mock_rsk, length); + MaybeInjectNoise(data, length); + } else { + Memset(data, 0, length); + } + + return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS; } -uint32_t TlclWrite(uint32_t index, const void* data, uint32_t length) { - mock_cnext += sprintf(mock_cnext, "TlclWrite(0x%x, %d)\n", index, length); - - if (FIRMWARE_NV_INDEX == index) { - TEST_EQ(length, sizeof(mock_rsf), "TlclWrite rsf size"); - Memcpy(&mock_rsf, data, length); - MaybeInjectNoise(&mock_rsf, length); - } else if (KERNEL_NV_INDEX == index) { - TEST_EQ(length, sizeof(mock_rsk), "TlclWrite rsk size"); - Memcpy(&mock_rsk, data, length); - MaybeInjectNoise(&mock_rsk, length); - } - - return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS; +uint32_t TlclWrite(uint32_t index, const void *data, uint32_t length) +{ + mock_cnext += sprintf(mock_cnext, "TlclWrite(0x%x, %d)\n", + index, length); + + if (FIRMWARE_NV_INDEX == index) { + TEST_EQ(length, sizeof(mock_rsf), "TlclWrite rsf size"); + Memcpy(&mock_rsf, data, length); + MaybeInjectNoise(&mock_rsf, length); + } else if (KERNEL_NV_INDEX == index) { + TEST_EQ(length, sizeof(mock_rsk), "TlclWrite rsk size"); + Memcpy(&mock_rsk, data, length); + MaybeInjectNoise(&mock_rsk, length); + } + + return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS; } -uint32_t TlclDefineSpace(uint32_t index, uint32_t perm, uint32_t size) { - mock_cnext += sprintf(mock_cnext, "TlclDefineSpace(0x%x, 0x%x, %d)\n", - index, perm, size); - return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS; +uint32_t TlclDefineSpace(uint32_t index, uint32_t perm, uint32_t size) +{ + mock_cnext += sprintf(mock_cnext, "TlclDefineSpace(0x%x, 0x%x, %d)\n", + index, perm, size); + return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS; } -uint32_t TlclSelfTestFull(void) { - mock_cnext += sprintf(mock_cnext, "TlclSelfTestFull()\n"); - return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS; +uint32_t TlclSelfTestFull(void) +{ + mock_cnext += sprintf(mock_cnext, "TlclSelfTestFull()\n"); + return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS; } -uint32_t TlclContinueSelfTest(void) { - mock_cnext += sprintf(mock_cnext, "TlclContinueSelfTest()\n"); - return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS; +uint32_t TlclContinueSelfTest(void) +{ + mock_cnext += sprintf(mock_cnext, "TlclContinueSelfTest()\n"); + return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS; } -uint32_t TlclGetPermanentFlags(TPM_PERMANENT_FLAGS* pflags) { - mock_cnext += sprintf(mock_cnext, "TlclGetPermanentFlags()\n"); - Memcpy(pflags, &mock_pflags, sizeof(mock_pflags)); - return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS; +uint32_t TlclGetPermanentFlags(TPM_PERMANENT_FLAGS *pflags) +{ + mock_cnext += sprintf(mock_cnext, "TlclGetPermanentFlags()\n"); + Memcpy(pflags, &mock_pflags, sizeof(mock_pflags)); + return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS; } /* TlclGetFlags() doesn't need mocking; it calls TlclGetPermanentFlags() */ -uint32_t TlclAssertPhysicalPresence(void) { - mock_cnext += sprintf(mock_cnext, "TlclAssertPhysicalPresence()\n"); - return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS; +uint32_t TlclAssertPhysicalPresence(void) +{ + mock_cnext += sprintf(mock_cnext, "TlclAssertPhysicalPresence()\n"); + return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS; } -uint32_t TlclFinalizePhysicalPresence(void) { - mock_cnext += sprintf(mock_cnext, "TlclFinalizePhysicalPresence()\n"); - mock_pflags.physicalPresenceLifetimeLock = 1; - return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS; +uint32_t TlclFinalizePhysicalPresence(void) +{ + mock_cnext += sprintf(mock_cnext, "TlclFinalizePhysicalPresence()\n"); + mock_pflags.physicalPresenceLifetimeLock = 1; + return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS; } -uint32_t TlclPhysicalPresenceCMDEnable(void) { - mock_cnext += sprintf(mock_cnext, "TlclPhysicalPresenceCMDEnable()\n"); - return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS; +uint32_t TlclPhysicalPresenceCMDEnable(void) +{ + mock_cnext += sprintf(mock_cnext, "TlclPhysicalPresenceCMDEnable()\n"); + return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS; } -uint32_t TlclSetNvLocked(void) { - mock_cnext += sprintf(mock_cnext, "TlclSetNvLocked()\n"); - mock_pflags.nvLocked = 1; - return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS; +uint32_t TlclSetNvLocked(void) +{ + mock_cnext += sprintf(mock_cnext, "TlclSetNvLocked()\n"); + mock_pflags.nvLocked = 1; + return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS; } -uint32_t TlclSetGlobalLock(void) { - mock_cnext += sprintf(mock_cnext, "TlclSetGlobalLock()\n"); - return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS; +uint32_t TlclSetGlobalLock(void) +{ + mock_cnext += sprintf(mock_cnext, "TlclSetGlobalLock()\n"); + return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS; } -uint32_t TlclLockPhysicalPresence(void) { - mock_cnext += sprintf(mock_cnext, "TlclLockPhysicalPresence()\n"); - return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS; +uint32_t TlclLockPhysicalPresence(void) +{ + mock_cnext += sprintf(mock_cnext, "TlclLockPhysicalPresence()\n"); + return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS; } -uint32_t TlclGetPermissions(uint32_t index, uint32_t* permissions) { - mock_cnext += sprintf(mock_cnext, "TlclGetPermissions(0x%x)\n", index); - *permissions = mock_permissions; - return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS; +uint32_t TlclGetPermissions(uint32_t index, uint32_t* permissions) +{ + mock_cnext += sprintf(mock_cnext, "TlclGetPermissions(0x%x)\n", index); + *permissions = mock_permissions; + return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS; } - /****************************************************************************/ /* Tests for CRC errors */ -extern uint32_t ReadSpaceFirmware(RollbackSpaceFirmware* rsf); -extern uint32_t WriteSpaceFirmware(RollbackSpaceFirmware* rsf); - -static void CrcTestFirmware(void) { - RollbackSpaceFirmware rsf; - - /* noise on reading, shouldn't matter here because version == 0 */ - ResetMocks(0, 0); - noise_on[0] = 1; - TEST_EQ(ReadSpaceFirmware(&rsf), 0, "ReadSpaceFirmware(), v0"); - TEST_STR_EQ(mock_calls, - "TlclRead(0x1007, 10)\n", - "tlcl calls"); - - /* But if the version >= 2, it will try three times and fail because the CRC - * is no good. */ - ResetMocks(0, 0); - mock_rsf.struct_version = 2; - TEST_EQ(ReadSpaceFirmware(&rsf), TPM_E_CORRUPTED_STATE, - "ReadSpaceFirmware(), v2, bad CRC"); - TEST_STR_EQ(mock_calls, - "TlclRead(0x1007, 10)\n" - "TlclRead(0x1007, 10)\n" - "TlclRead(0x1007, 10)\n", - "tlcl calls"); - - /* OTOH, if the CRC is good and some noise happens, it should recover. */ - ResetMocks(0, 0); - mock_rsf.struct_version = 2; - mock_rsf.crc8 = Crc8(&mock_rsf, offsetof(RollbackSpaceFirmware, crc8)); - noise_on[0] = 1; - TEST_EQ(ReadSpaceFirmware(&rsf), 0, "ReadSpaceFirmware(), v2, good CRC"); - TEST_STR_EQ(mock_calls, - "TlclRead(0x1007, 10)\n" - "TlclRead(0x1007, 10)\n", - "tlcl calls"); - - /* A write with version < 2 should convert to v2 and create the CRC */ - ResetMocks(0, 0); - Memset(&rsf, 0, sizeof(rsf)); - TEST_EQ(WriteSpaceFirmware(&rsf), 0, "WriteSpaceFirmware(), v0"); - TEST_EQ(mock_rsf.struct_version, 2, "WriteSpaceFirmware(), check v2"); - TEST_STR_EQ(mock_calls, - "TlclWrite(0x1007, 10)\n" - "TlclRead(0x1007, 10)\n", - "tlcl calls"); - - /* Same as above, but with some noise during the readback */ - ResetMocks(0, 0); - Memset(&rsf, 0, sizeof(rsf)); - noise_on[1] = 1; - noise_on[2] = 1; - TEST_EQ(WriteSpaceFirmware(&rsf), 0, "WriteSpaceFirmware(), read noise"); - TEST_STR_EQ(mock_calls, - "TlclWrite(0x1007, 10)\n" - "TlclRead(0x1007, 10)\n" - "TlclRead(0x1007, 10)\n" - "TlclRead(0x1007, 10)\n", - "tlcl calls"); - - /* With noise during the write, we'll try the write again */ - ResetMocks(0, 0); - Memset(&rsf, 0, sizeof(rsf)); - noise_on[0] = 1; - TEST_EQ(WriteSpaceFirmware(&rsf), 0, "WriteSpaceFirmware(), write noise"); - TEST_EQ(mock_rsf.struct_version, 2, "WriteSpaceFirmware(), check v2"); - TEST_STR_EQ(mock_calls, - "TlclWrite(0x1007, 10)\n" - "TlclRead(0x1007, 10)\n" - "TlclRead(0x1007, 10)\n" - "TlclRead(0x1007, 10)\n" - "TlclWrite(0x1007, 10)\n" - "TlclRead(0x1007, 10)\n", - "tlcl calls"); - - /* Only if it just keeps on failing forever do we eventually give up */ - ResetMocks(0, 0); - Memset(&rsf, 0, sizeof(rsf)); - Memset(noise_on, 1, sizeof(noise_on)); - TEST_EQ(WriteSpaceFirmware(&rsf), TPM_E_CORRUPTED_STATE, - "WriteSpaceFirmware(), always noise"); - TEST_STR_EQ(mock_calls, - "TlclWrite(0x1007, 10)\n" - "TlclRead(0x1007, 10)\n" - "TlclRead(0x1007, 10)\n" - "TlclRead(0x1007, 10)\n" - "TlclWrite(0x1007, 10)\n" - "TlclRead(0x1007, 10)\n" - "TlclRead(0x1007, 10)\n" - "TlclRead(0x1007, 10)\n" - "TlclWrite(0x1007, 10)\n" - "TlclRead(0x1007, 10)\n" - "TlclRead(0x1007, 10)\n" - "TlclRead(0x1007, 10)\n", - "tlcl calls"); +extern uint32_t ReadSpaceFirmware(RollbackSpaceFirmware *rsf); +extern uint32_t WriteSpaceFirmware(RollbackSpaceFirmware *rsf); + +static void CrcTestFirmware(void) +{ + RollbackSpaceFirmware rsf; + + /* Noise on reading, shouldn't matter here because version == 0 */ + ResetMocks(0, 0); + noise_on[0] = 1; + TEST_EQ(ReadSpaceFirmware(&rsf), 0, "ReadSpaceFirmware(), v0"); + TEST_STR_EQ(mock_calls, + "TlclRead(0x1007, 10)\n", + "tlcl calls"); + + /* + * But if the version >= 2, it will try three times and fail because + * the CRC is no good. + */ + ResetMocks(0, 0); + mock_rsf.struct_version = 2; + TEST_EQ(ReadSpaceFirmware(&rsf), TPM_E_CORRUPTED_STATE, + "ReadSpaceFirmware(), v2, bad CRC"); + TEST_STR_EQ(mock_calls, + "TlclRead(0x1007, 10)\n" + "TlclRead(0x1007, 10)\n" + "TlclRead(0x1007, 10)\n", + "tlcl calls"); + + /* If the CRC is good and some noise happens, it should recover. */ + ResetMocks(0, 0); + mock_rsf.struct_version = 2; + mock_rsf.crc8 = Crc8(&mock_rsf, offsetof(RollbackSpaceFirmware, crc8)); + noise_on[0] = 1; + TEST_EQ(ReadSpaceFirmware(&rsf), 0, + "ReadSpaceFirmware(), v2, good CRC"); + TEST_STR_EQ(mock_calls, + "TlclRead(0x1007, 10)\n" + "TlclRead(0x1007, 10)\n", + "tlcl calls"); + + /* A write with version < 2 should convert to v2 and create the CRC */ + ResetMocks(0, 0); + Memset(&rsf, 0, sizeof(rsf)); + TEST_EQ(WriteSpaceFirmware(&rsf), 0, "WriteSpaceFirmware(), v0"); + TEST_EQ(mock_rsf.struct_version, 2, "WriteSpaceFirmware(), check v2"); + TEST_STR_EQ(mock_calls, + "TlclWrite(0x1007, 10)\n" + "TlclRead(0x1007, 10)\n", + "tlcl calls"); + + /* Same as above, but with some noise during the readback */ + ResetMocks(0, 0); + Memset(&rsf, 0, sizeof(rsf)); + noise_on[1] = 1; + noise_on[2] = 1; + TEST_EQ(WriteSpaceFirmware(&rsf), 0, + "WriteSpaceFirmware(), read noise"); + TEST_STR_EQ(mock_calls, + "TlclWrite(0x1007, 10)\n" + "TlclRead(0x1007, 10)\n" + "TlclRead(0x1007, 10)\n" + "TlclRead(0x1007, 10)\n", + "tlcl calls"); + + /* With noise during the write, we'll try the write again */ + ResetMocks(0, 0); + Memset(&rsf, 0, sizeof(rsf)); + noise_on[0] = 1; + TEST_EQ(WriteSpaceFirmware(&rsf), 0, + "WriteSpaceFirmware(), write noise"); + TEST_EQ(mock_rsf.struct_version, 2, "WriteSpaceFirmware(), check v2"); + TEST_STR_EQ(mock_calls, + "TlclWrite(0x1007, 10)\n" + "TlclRead(0x1007, 10)\n" + "TlclRead(0x1007, 10)\n" + "TlclRead(0x1007, 10)\n" + "TlclWrite(0x1007, 10)\n" + "TlclRead(0x1007, 10)\n", + "tlcl calls"); + + /* Only if it just keeps on failing forever do we eventually give up */ + ResetMocks(0, 0); + Memset(&rsf, 0, sizeof(rsf)); + Memset(noise_on, 1, sizeof(noise_on)); + TEST_EQ(WriteSpaceFirmware(&rsf), TPM_E_CORRUPTED_STATE, + "WriteSpaceFirmware(), always noise"); + TEST_STR_EQ(mock_calls, + "TlclWrite(0x1007, 10)\n" + "TlclRead(0x1007, 10)\n" + "TlclRead(0x1007, 10)\n" + "TlclRead(0x1007, 10)\n" + "TlclWrite(0x1007, 10)\n" + "TlclRead(0x1007, 10)\n" + "TlclRead(0x1007, 10)\n" + "TlclRead(0x1007, 10)\n" + "TlclWrite(0x1007, 10)\n" + "TlclRead(0x1007, 10)\n" + "TlclRead(0x1007, 10)\n" + "TlclRead(0x1007, 10)\n", + "tlcl calls"); } -extern uint32_t ReadSpaceKernel(RollbackSpaceKernel* rsk); -extern uint32_t WriteSpaceKernel(RollbackSpaceKernel* rsk); - -static void CrcTestKernel(void) { - RollbackSpaceKernel rsk; - - /* noise on reading, shouldn't matter here because version == 0 */ - ResetMocks(0, 0); - noise_on[0] = 1; - TEST_EQ(ReadSpaceKernel(&rsk), 0, "ReadSpaceKernel(), v0"); - TEST_STR_EQ(mock_calls, - "TlclRead(0x1008, 13)\n", - "tlcl calls"); - - /* But if the version >= 2, it will try three times and fail because the CRC - * is no good. */ - ResetMocks(0, 0); - mock_rsk.struct_version = 2; - TEST_EQ(ReadSpaceKernel(&rsk), TPM_E_CORRUPTED_STATE, - "ReadSpaceKernel(), v2, bad CRC"); - TEST_STR_EQ(mock_calls, - "TlclRead(0x1008, 13)\n" - "TlclRead(0x1008, 13)\n" - "TlclRead(0x1008, 13)\n", - "tlcl calls"); - - /* OTOH, if the CRC is good and some noise happens, it should recover. */ - ResetMocks(0, 0); - mock_rsk.struct_version = 2; - mock_rsk.crc8 = Crc8(&mock_rsk, offsetof(RollbackSpaceKernel, crc8)); - noise_on[0] = 1; - TEST_EQ(ReadSpaceKernel(&rsk), 0, "ReadSpaceKernel(), v2, good CRC"); - TEST_STR_EQ(mock_calls, - "TlclRead(0x1008, 13)\n" - "TlclRead(0x1008, 13)\n", - "tlcl calls"); - - /* A write with version < 2 should convert to v2 and create the CRC */ - ResetMocks(0, 0); - Memset(&rsk, 0, sizeof(rsk)); - TEST_EQ(WriteSpaceKernel(&rsk), 0, "WriteSpaceKernel(), v0"); - TEST_EQ(mock_rsk.struct_version, 2, "WriteSpaceKernel(), check v2"); - TEST_STR_EQ(mock_calls, - "TlclWrite(0x1008, 13)\n" - "TlclRead(0x1008, 13)\n", - "tlcl calls"); - - /* Same as above, but with some noise during the readback */ - ResetMocks(0, 0); - Memset(&rsk, 0, sizeof(rsk)); - noise_on[1] = 1; - noise_on[2] = 1; - TEST_EQ(WriteSpaceKernel(&rsk), 0, "WriteSpaceKernel(), read noise"); - TEST_STR_EQ(mock_calls, - "TlclWrite(0x1008, 13)\n" - "TlclRead(0x1008, 13)\n" - "TlclRead(0x1008, 13)\n" - "TlclRead(0x1008, 13)\n", - "tlcl calls"); - - /* With noise during the write, we'll try the write again */ - ResetMocks(0, 0); - Memset(&rsk, 0, sizeof(rsk)); - noise_on[0] = 1; - TEST_EQ(WriteSpaceKernel(&rsk), 0, "WriteSpaceKernel(), write noise"); - TEST_EQ(mock_rsk.struct_version, 2, "WriteSpaceKernel(), check v2"); - TEST_STR_EQ(mock_calls, - "TlclWrite(0x1008, 13)\n" - "TlclRead(0x1008, 13)\n" - "TlclRead(0x1008, 13)\n" - "TlclRead(0x1008, 13)\n" - "TlclWrite(0x1008, 13)\n" - "TlclRead(0x1008, 13)\n", - "tlcl calls"); - - /* Only if it just keeps on failing forever do we eventually give up */ - ResetMocks(0, 0); - Memset(&rsk, 0, sizeof(rsk)); - Memset(noise_on, 1, sizeof(noise_on)); - TEST_EQ(WriteSpaceKernel(&rsk), TPM_E_CORRUPTED_STATE, - "WriteSpaceKernel(), always noise"); - TEST_STR_EQ(mock_calls, - "TlclWrite(0x1008, 13)\n" - "TlclRead(0x1008, 13)\n" - "TlclRead(0x1008, 13)\n" - "TlclRead(0x1008, 13)\n" - "TlclWrite(0x1008, 13)\n" - "TlclRead(0x1008, 13)\n" - "TlclRead(0x1008, 13)\n" - "TlclRead(0x1008, 13)\n" - "TlclWrite(0x1008, 13)\n" - "TlclRead(0x1008, 13)\n" - "TlclRead(0x1008, 13)\n" - "TlclRead(0x1008, 13)\n", - "tlcl calls"); +extern uint32_t ReadSpaceKernel(RollbackSpaceKernel *rsk); +extern uint32_t WriteSpaceKernel(RollbackSpaceKernel *rsk); + +static void CrcTestKernel(void) +{ + RollbackSpaceKernel rsk; + + /* Noise on reading shouldn't matter here because version == 0 */ + ResetMocks(0, 0); + noise_on[0] = 1; + TEST_EQ(ReadSpaceKernel(&rsk), 0, "ReadSpaceKernel(), v0"); + TEST_STR_EQ(mock_calls, + "TlclRead(0x1008, 13)\n", + "tlcl calls"); + + /* + * But if the version >= 2, it will try three times and fail because + * the CRC is no good. + */ + ResetMocks(0, 0); + mock_rsk.struct_version = 2; + TEST_EQ(ReadSpaceKernel(&rsk), TPM_E_CORRUPTED_STATE, + "ReadSpaceKernel(), v2, bad CRC"); + TEST_STR_EQ(mock_calls, + "TlclRead(0x1008, 13)\n" + "TlclRead(0x1008, 13)\n" + "TlclRead(0x1008, 13)\n", + "tlcl calls"); + + /* If the CRC is good and some noise happens, it should recover. */ + ResetMocks(0, 0); + mock_rsk.struct_version = 2; + mock_rsk.crc8 = Crc8(&mock_rsk, offsetof(RollbackSpaceKernel, crc8)); + noise_on[0] = 1; + TEST_EQ(ReadSpaceKernel(&rsk), 0, "ReadSpaceKernel(), v2, good CRC"); + TEST_STR_EQ(mock_calls, + "TlclRead(0x1008, 13)\n" + "TlclRead(0x1008, 13)\n", + "tlcl calls"); + + /* A write with version < 2 should convert to v2 and create the CRC */ + ResetMocks(0, 0); + Memset(&rsk, 0, sizeof(rsk)); + TEST_EQ(WriteSpaceKernel(&rsk), 0, "WriteSpaceKernel(), v0"); + TEST_EQ(mock_rsk.struct_version, 2, "WriteSpaceKernel(), check v2"); + TEST_STR_EQ(mock_calls, + "TlclWrite(0x1008, 13)\n" + "TlclRead(0x1008, 13)\n", + "tlcl calls"); + + /* Same as above, but with some noise during the readback */ + ResetMocks(0, 0); + Memset(&rsk, 0, sizeof(rsk)); + noise_on[1] = 1; + noise_on[2] = 1; + TEST_EQ(WriteSpaceKernel(&rsk), 0, "WriteSpaceKernel(), read noise"); + TEST_STR_EQ(mock_calls, + "TlclWrite(0x1008, 13)\n" + "TlclRead(0x1008, 13)\n" + "TlclRead(0x1008, 13)\n" + "TlclRead(0x1008, 13)\n", + "tlcl calls"); + + /* With noise during the write, we'll try the write again */ + ResetMocks(0, 0); + Memset(&rsk, 0, sizeof(rsk)); + noise_on[0] = 1; + TEST_EQ(WriteSpaceKernel(&rsk), 0, "WriteSpaceKernel(), write noise"); + TEST_EQ(mock_rsk.struct_version, 2, "WriteSpaceKernel(), check v2"); + TEST_STR_EQ(mock_calls, + "TlclWrite(0x1008, 13)\n" + "TlclRead(0x1008, 13)\n" + "TlclRead(0x1008, 13)\n" + "TlclRead(0x1008, 13)\n" + "TlclWrite(0x1008, 13)\n" + "TlclRead(0x1008, 13)\n", + "tlcl calls"); + + /* Only if it just keeps on failing forever do we eventually give up */ + ResetMocks(0, 0); + Memset(&rsk, 0, sizeof(rsk)); + Memset(noise_on, 1, sizeof(noise_on)); + TEST_EQ(WriteSpaceKernel(&rsk), TPM_E_CORRUPTED_STATE, + "WriteSpaceKernel(), always noise"); + TEST_STR_EQ(mock_calls, + "TlclWrite(0x1008, 13)\n" + "TlclRead(0x1008, 13)\n" + "TlclRead(0x1008, 13)\n" + "TlclRead(0x1008, 13)\n" + "TlclWrite(0x1008, 13)\n" + "TlclRead(0x1008, 13)\n" + "TlclRead(0x1008, 13)\n" + "TlclRead(0x1008, 13)\n" + "TlclWrite(0x1008, 13)\n" + "TlclRead(0x1008, 13)\n" + "TlclRead(0x1008, 13)\n" + "TlclRead(0x1008, 13)\n", + "tlcl calls"); } /****************************************************************************/ /* Tests for misc helper functions */ -static void MiscTest(void) { - uint8_t buf[8]; - - ResetMocks(0, 0); - TEST_EQ(TPMClearAndReenable(), 0, "TPMClearAndReenable()"); - TEST_STR_EQ(mock_calls, - "TlclForceClear()\n" - "TlclSetEnable()\n" - "TlclSetDeactivated(0)\n", - "tlcl calls"); - - ResetMocks(0, 0); - TEST_EQ(SafeWrite(0x123, buf, 8), 0, "SafeWrite()"); - TEST_STR_EQ(mock_calls, - "TlclWrite(0x123, 8)\n", - "tlcl calls"); - - ResetMocks(1, TPM_E_BADINDEX); - TEST_EQ(SafeWrite(0x123, buf, 8), TPM_E_BADINDEX, "SafeWrite() bad"); - TEST_STR_EQ(mock_calls, - "TlclWrite(0x123, 8)\n", - "tlcl calls"); - - ResetMocks(1, TPM_E_MAXNVWRITES); - TEST_EQ(SafeWrite(0x123, buf, 8), 0, "SafeWrite() retry max writes"); - TEST_STR_EQ(mock_calls, - "TlclWrite(0x123, 8)\n" - "TlclForceClear()\n" - "TlclSetEnable()\n" - "TlclSetDeactivated(0)\n" - "TlclWrite(0x123, 8)\n", - "tlcl calls"); - - ResetMocks(0, 0); - TEST_EQ(SafeDefineSpace(0x123, 6, 8), 0, "SafeDefineSpace()"); - TEST_STR_EQ(mock_calls, - "TlclDefineSpace(0x123, 0x6, 8)\n", - "tlcl calls"); - - ResetMocks(1, TPM_E_BADINDEX); - TEST_EQ(SafeDefineSpace(0x123, 6, 8), TPM_E_BADINDEX, - "SafeDefineSpace() bad"); - TEST_STR_EQ(mock_calls, - "TlclDefineSpace(0x123, 0x6, 8)\n", - "tlcl calls"); - - ResetMocks(1, TPM_E_MAXNVWRITES); - TEST_EQ(SafeDefineSpace(0x123, 6, 8), 0, - "SafeDefineSpace() retry max writes"); - TEST_STR_EQ(mock_calls, - "TlclDefineSpace(0x123, 0x6, 8)\n" - "TlclForceClear()\n" - "TlclSetEnable()\n" - "TlclSetDeactivated(0)\n" - "TlclDefineSpace(0x123, 0x6, 8)\n", - "tlcl calls"); +static void MiscTest(void) +{ + uint8_t buf[8]; + + ResetMocks(0, 0); + TEST_EQ(TPMClearAndReenable(), 0, "TPMClearAndReenable()"); + TEST_STR_EQ(mock_calls, + "TlclForceClear()\n" + "TlclSetEnable()\n" + "TlclSetDeactivated(0)\n", + "tlcl calls"); + + ResetMocks(0, 0); + TEST_EQ(SafeWrite(0x123, buf, 8), 0, "SafeWrite()"); + TEST_STR_EQ(mock_calls, + "TlclWrite(0x123, 8)\n", + "tlcl calls"); + + ResetMocks(1, TPM_E_BADINDEX); + TEST_EQ(SafeWrite(0x123, buf, 8), TPM_E_BADINDEX, "SafeWrite() bad"); + TEST_STR_EQ(mock_calls, + "TlclWrite(0x123, 8)\n", + "tlcl calls"); + + ResetMocks(1, TPM_E_MAXNVWRITES); + TEST_EQ(SafeWrite(0x123, buf, 8), 0, "SafeWrite() retry max writes"); + TEST_STR_EQ(mock_calls, + "TlclWrite(0x123, 8)\n" + "TlclForceClear()\n" + "TlclSetEnable()\n" + "TlclSetDeactivated(0)\n" + "TlclWrite(0x123, 8)\n", + "tlcl calls"); + + ResetMocks(0, 0); + TEST_EQ(SafeDefineSpace(0x123, 6, 8), 0, "SafeDefineSpace()"); + TEST_STR_EQ(mock_calls, + "TlclDefineSpace(0x123, 0x6, 8)\n", + "tlcl calls"); + + ResetMocks(1, TPM_E_BADINDEX); + TEST_EQ(SafeDefineSpace(0x123, 6, 8), TPM_E_BADINDEX, + "SafeDefineSpace() bad"); + TEST_STR_EQ(mock_calls, + "TlclDefineSpace(0x123, 0x6, 8)\n", + "tlcl calls"); + + ResetMocks(1, TPM_E_MAXNVWRITES); + TEST_EQ(SafeDefineSpace(0x123, 6, 8), 0, + "SafeDefineSpace() retry max writes"); + TEST_STR_EQ(mock_calls, + "TlclDefineSpace(0x123, 0x6, 8)\n" + "TlclForceClear()\n" + "TlclSetEnable()\n" + "TlclSetDeactivated(0)\n" + "TlclDefineSpace(0x123, 0x6, 8)\n", + "tlcl calls"); } /****************************************************************************/ /* Tests for one-time initialization */ -static void OneTimeInitTest(void) { - RollbackSpaceFirmware rsf; - RollbackSpaceKernel rsk; - - /* Complete initialization */ - ResetMocks(0, 0); - TEST_EQ(OneTimeInitializeTPM(&rsf, &rsk), 0, "OneTimeInitializeTPM()"); - TEST_STR_EQ(mock_calls, - "TlclSelfTestFull()\n" - "TlclGetPermanentFlags()\n" - "TlclFinalizePhysicalPresence()\n" - "TlclSetNvLocked()\n" - "TlclForceClear()\n" - "TlclSetEnable()\n" - "TlclSetDeactivated(0)\n" - /* kernel space */ - "TlclDefineSpace(0x1008, 0x1, 13)\n" - "TlclWrite(0x1008, 13)\n" - "TlclRead(0x1008, 13)\n" - /* firmware space */ - "TlclDefineSpace(0x1007, 0x8001, 10)\n" - "TlclWrite(0x1007, 10)\n" - "TlclRead(0x1007, 10)\n", - "tlcl calls"); - TEST_EQ(mock_rsf.struct_version, ROLLBACK_SPACE_FIRMWARE_VERSION, "rsf ver"); - TEST_EQ(mock_rsf.flags, 0, "rsf flags"); - TEST_EQ(mock_rsf.fw_versions, 0, "rsf fw_versions"); - TEST_EQ(mock_rsk.struct_version, ROLLBACK_SPACE_KERNEL_VERSION, "rsk ver"); - TEST_EQ(mock_rsk.uid, ROLLBACK_SPACE_KERNEL_UID, "rsk uid"); - TEST_EQ(mock_rsk.kernel_versions, 0, "rsk kernel_versions"); - - /* Physical presence already initialized */ - ResetMocks(0, 0); - mock_pflags.physicalPresenceLifetimeLock = 1; - TEST_EQ(OneTimeInitializeTPM(&rsf, &rsk), 0, "OneTimeInitializeTPM()"); - TEST_STR_EQ(mock_calls, - "TlclSelfTestFull()\n" - "TlclGetPermanentFlags()\n" - "TlclSetNvLocked()\n" - "TlclForceClear()\n" - "TlclSetEnable()\n" - "TlclSetDeactivated(0)\n" - /* kernel space */ - "TlclDefineSpace(0x1008, 0x1, 13)\n" - "TlclWrite(0x1008, 13)\n" - "TlclRead(0x1008, 13)\n" - /* firmware space */ - "TlclDefineSpace(0x1007, 0x8001, 10)\n" - "TlclWrite(0x1007, 10)\n" - "TlclRead(0x1007, 10)\n", - "tlcl calls"); - - /* NV locking already initialized */ - ResetMocks(0, 0); - mock_pflags.nvLocked = 1; - TEST_EQ(OneTimeInitializeTPM(&rsf, &rsk), 0, "OneTimeInitializeTPM()"); - TEST_STR_EQ(mock_calls, - "TlclSelfTestFull()\n" - "TlclGetPermanentFlags()\n" - "TlclFinalizePhysicalPresence()\n" - "TlclForceClear()\n" - "TlclSetEnable()\n" - "TlclSetDeactivated(0)\n" - /* kernel space */ - "TlclDefineSpace(0x1008, 0x1, 13)\n" - "TlclWrite(0x1008, 13)\n" - "TlclRead(0x1008, 13)\n" - /* firmware space */ - "TlclDefineSpace(0x1007, 0x8001, 10)\n" - "TlclWrite(0x1007, 10)\n" - "TlclRead(0x1007, 10)\n", - "tlcl calls"); - - /* Self test error */ - ResetMocks(1, TPM_E_IOERROR); - TEST_EQ(OneTimeInitializeTPM(&rsf, &rsk), TPM_E_IOERROR, - "OneTimeInitializeTPM() selftest"); - TEST_STR_EQ(mock_calls, - "TlclSelfTestFull()\n", - "tlcl calls"); +static void OneTimeInitTest(void) +{ + RollbackSpaceFirmware rsf; + RollbackSpaceKernel rsk; + + /* Complete initialization */ + ResetMocks(0, 0); + TEST_EQ(OneTimeInitializeTPM(&rsf, &rsk), 0, "OneTimeInitializeTPM()"); + TEST_STR_EQ(mock_calls, + "TlclSelfTestFull()\n" + "TlclGetPermanentFlags()\n" + "TlclFinalizePhysicalPresence()\n" + "TlclSetNvLocked()\n" + "TlclForceClear()\n" + "TlclSetEnable()\n" + "TlclSetDeactivated(0)\n" + /* kernel space */ + "TlclDefineSpace(0x1008, 0x1, 13)\n" + "TlclWrite(0x1008, 13)\n" + "TlclRead(0x1008, 13)\n" + /* firmware space */ + "TlclDefineSpace(0x1007, 0x8001, 10)\n" + "TlclWrite(0x1007, 10)\n" + "TlclRead(0x1007, 10)\n", + "tlcl calls"); + TEST_EQ(mock_rsf.struct_version, ROLLBACK_SPACE_FIRMWARE_VERSION, + "rsf ver"); + TEST_EQ(mock_rsf.flags, 0, "rsf flags"); + TEST_EQ(mock_rsf.fw_versions, 0, "rsf fw_versions"); + TEST_EQ(mock_rsk.struct_version, ROLLBACK_SPACE_KERNEL_VERSION, + "rsk ver"); + TEST_EQ(mock_rsk.uid, ROLLBACK_SPACE_KERNEL_UID, "rsk uid"); + TEST_EQ(mock_rsk.kernel_versions, 0, "rsk kernel_versions"); + + /* Physical presence already initialized */ + ResetMocks(0, 0); + mock_pflags.physicalPresenceLifetimeLock = 1; + TEST_EQ(OneTimeInitializeTPM(&rsf, &rsk), 0, "OneTimeInitializeTPM()"); + TEST_STR_EQ(mock_calls, + "TlclSelfTestFull()\n" + "TlclGetPermanentFlags()\n" + "TlclSetNvLocked()\n" + "TlclForceClear()\n" + "TlclSetEnable()\n" + "TlclSetDeactivated(0)\n" + /* kernel space */ + "TlclDefineSpace(0x1008, 0x1, 13)\n" + "TlclWrite(0x1008, 13)\n" + "TlclRead(0x1008, 13)\n" + /* firmware space */ + "TlclDefineSpace(0x1007, 0x8001, 10)\n" + "TlclWrite(0x1007, 10)\n" + "TlclRead(0x1007, 10)\n", + "tlcl calls"); + + /* NV locking already initialized */ + ResetMocks(0, 0); + mock_pflags.nvLocked = 1; + TEST_EQ(OneTimeInitializeTPM(&rsf, &rsk), 0, "OneTimeInitializeTPM()"); + TEST_STR_EQ(mock_calls, + "TlclSelfTestFull()\n" + "TlclGetPermanentFlags()\n" + "TlclFinalizePhysicalPresence()\n" + "TlclForceClear()\n" + "TlclSetEnable()\n" + "TlclSetDeactivated(0)\n" + /* kernel space */ + "TlclDefineSpace(0x1008, 0x1, 13)\n" + "TlclWrite(0x1008, 13)\n" + "TlclRead(0x1008, 13)\n" + /* firmware space */ + "TlclDefineSpace(0x1007, 0x8001, 10)\n" + "TlclWrite(0x1007, 10)\n" + "TlclRead(0x1007, 10)\n", + "tlcl calls"); + + /* Self test error */ + ResetMocks(1, TPM_E_IOERROR); + TEST_EQ(OneTimeInitializeTPM(&rsf, &rsk), TPM_E_IOERROR, + "OneTimeInitializeTPM() selftest"); + TEST_STR_EQ(mock_calls, + "TlclSelfTestFull()\n", + "tlcl calls"); } /****************************************************************************/ /* Tests for TPM setup */ -static void SetupTpmTest(void) { - RollbackSpaceFirmware rsf; - - /* Complete setup */ - ResetMocks(0, 0); - TEST_EQ(SetupTPM(0, 0, 0, 0, &rsf), 0, "SetupTPM()"); - TEST_STR_EQ(mock_calls, - "TlclLibInit()\n" - "TlclStartup()\n" - "TlclAssertPhysicalPresence()\n" - "TlclGetPermanentFlags()\n" - "TlclRead(0x1007, 10)\n", - "tlcl calls"); - - /* If TPM is disabled or deactivated, must enable it */ - ResetMocks(0, 0); - mock_pflags.disable = 1; - TEST_EQ(SetupTPM(0, 0, 0, 0, &rsf), TPM_E_MUST_REBOOT, "SetupTPM() disabled"); - TEST_STR_EQ(mock_calls, - "TlclLibInit()\n" - "TlclStartup()\n" - "TlclAssertPhysicalPresence()\n" - "TlclGetPermanentFlags()\n" - "TlclSetEnable()\n" - "TlclSetDeactivated(0)\n", - "tlcl calls"); - - ResetMocks(0, 0); - mock_pflags.deactivated = 1; - TEST_EQ(SetupTPM(0, 0, 0, 0, &rsf), TPM_E_MUST_REBOOT, - "SetupTPM() deactivated"); - TEST_STR_EQ(mock_calls, - "TlclLibInit()\n" - "TlclStartup()\n" - "TlclAssertPhysicalPresence()\n" - "TlclGetPermanentFlags()\n" - "TlclSetEnable()\n" - "TlclSetDeactivated(0)\n", - "tlcl calls"); - - /* If physical presence command isn't enabled, should try to enable it */ - ResetMocks(3, TPM_E_IOERROR); - TEST_EQ(SetupTPM(0, 0, 0, 0, &rsf), 0, "SetupTPM() pp cmd"); - TEST_STR_EQ(mock_calls, - "TlclLibInit()\n" - "TlclStartup()\n" - "TlclAssertPhysicalPresence()\n" - "TlclPhysicalPresenceCMDEnable()\n" - "TlclAssertPhysicalPresence()\n" - "TlclGetPermanentFlags()\n" - "TlclRead(0x1007, 10)\n", - "tlcl calls"); - - /* If firmware space is missing, do one-time init */ - ResetMocks(5, TPM_E_BADINDEX); - mock_pflags.physicalPresenceLifetimeLock = 1; - mock_pflags.nvLocked = 1; - TEST_EQ(SetupTPM(0, 0, 0, 0, &rsf), 0, "SetupTPM() no firmware space"); - TEST_STR_EQ(mock_calls, - "TlclLibInit()\n" - "TlclStartup()\n" - "TlclAssertPhysicalPresence()\n" - "TlclGetPermanentFlags()\n" - "TlclRead(0x1007, 10)\n" - /* Calls from one-time init */ - "TlclSelfTestFull()\n" - "TlclGetPermanentFlags()\n" - "TlclForceClear()\n" - "TlclSetEnable()\n" - "TlclSetDeactivated(0)\n" - "TlclDefineSpace(0x1008, 0x1, 13)\n" - "TlclWrite(0x1008, 13)\n" - "TlclRead(0x1008, 13)\n" - "TlclDefineSpace(0x1007, 0x8001, 10)\n" - "TlclWrite(0x1007, 10)\n" - "TlclRead(0x1007, 10)\n", - "tlcl calls"); - - /* Other firmware space error is passed through */ - ResetMocks(5, TPM_E_IOERROR); - TEST_EQ(SetupTPM(0, 0, 0, 0, &rsf), TPM_E_CORRUPTED_STATE, - "SetupTPM() bad firmware space"); - TEST_STR_EQ(mock_calls, - "TlclLibInit()\n" - "TlclStartup()\n" - "TlclAssertPhysicalPresence()\n" - "TlclGetPermanentFlags()\n" - "TlclRead(0x1007, 10)\n", - "tlcl calls"); - - /* If developer flag has toggled, clear ownership and write new flag */ - ResetMocks(0, 0); - TEST_EQ(SetupTPM(0, 1, 0, 0, &rsf), 0, "SetupTPM() to dev"); - TEST_STR_EQ(mock_calls, - "TlclLibInit()\n" - "TlclStartup()\n" - "TlclAssertPhysicalPresence()\n" - "TlclGetPermanentFlags()\n" - "TlclRead(0x1007, 10)\n" - "TlclForceClear()\n" - "TlclSetEnable()\n" - "TlclSetDeactivated(0)\n" - "TlclWrite(0x1007, 10)\n" - "TlclRead(0x1007, 10)\n", - "tlcl calls"); - TEST_EQ(mock_rsf.flags, FLAG_LAST_BOOT_DEVELOPER, "fw space flags to dev 1"); - - ResetMocks(0, 0); - mock_rsf.flags = FLAG_LAST_BOOT_DEVELOPER; - TEST_EQ(SetupTPM(0, 0, 0, 0, &rsf), 0, "SetupTPM() from dev"); - TEST_STR_EQ(mock_calls, - "TlclLibInit()\n" - "TlclStartup()\n" - "TlclAssertPhysicalPresence()\n" - "TlclGetPermanentFlags()\n" - "TlclRead(0x1007, 10)\n" - "TlclForceClear()\n" - "TlclSetEnable()\n" - "TlclSetDeactivated(0)\n" - "TlclWrite(0x1007, 10)\n" - "TlclRead(0x1007, 10)\n", - "tlcl calls"); - TEST_EQ(mock_rsf.flags, 0, "fw space flags from dev 1"); - - /* If TPM clear request, clear ownership also */ - ResetMocks(0, 0); - TEST_EQ(SetupTPM(0, 0, 0, 1, &rsf), 0, "SetupTPM() clear owner"); - TEST_STR_EQ(mock_calls, - "TlclLibInit()\n" - "TlclStartup()\n" - "TlclAssertPhysicalPresence()\n" - "TlclGetPermanentFlags()\n" - "TlclRead(0x1007, 10)\n" - "TlclForceClear()\n" - "TlclSetEnable()\n" - "TlclSetDeactivated(0)\n", - "tlcl calls"); - - /* Note: SetupTPM() recovery_mode parameter sets a global flag in - * rollback_index.c; this is tested along with RollbackKernelLock() below. */ +static void SetupTpmTest(void) +{ + RollbackSpaceFirmware rsf; + + /* Complete setup */ + ResetMocks(0, 0); + TEST_EQ(SetupTPM(0, 0, 0, 0, &rsf), 0, "SetupTPM()"); + TEST_STR_EQ(mock_calls, + "TlclLibInit()\n" + "TlclStartup()\n" + "TlclAssertPhysicalPresence()\n" + "TlclGetPermanentFlags()\n" + "TlclRead(0x1007, 10)\n", + "tlcl calls"); + + /* If TPM is disabled or deactivated, must enable it */ + ResetMocks(0, 0); + mock_pflags.disable = 1; + TEST_EQ(SetupTPM(0, 0, 0, 0, &rsf), TPM_E_MUST_REBOOT, + "SetupTPM() disabled"); + TEST_STR_EQ(mock_calls, + "TlclLibInit()\n" + "TlclStartup()\n" + "TlclAssertPhysicalPresence()\n" + "TlclGetPermanentFlags()\n" + "TlclSetEnable()\n" + "TlclSetDeactivated(0)\n", + "tlcl calls"); + + ResetMocks(0, 0); + mock_pflags.deactivated = 1; + TEST_EQ(SetupTPM(0, 0, 0, 0, &rsf), TPM_E_MUST_REBOOT, + "SetupTPM() deactivated"); + TEST_STR_EQ(mock_calls, + "TlclLibInit()\n" + "TlclStartup()\n" + "TlclAssertPhysicalPresence()\n" + "TlclGetPermanentFlags()\n" + "TlclSetEnable()\n" + "TlclSetDeactivated(0)\n", + "tlcl calls"); + + /* If physical presence command isn't enabled, try to enable it */ + ResetMocks(3, TPM_E_IOERROR); + TEST_EQ(SetupTPM(0, 0, 0, 0, &rsf), 0, "SetupTPM() pp cmd"); + TEST_STR_EQ(mock_calls, + "TlclLibInit()\n" + "TlclStartup()\n" + "TlclAssertPhysicalPresence()\n" + "TlclPhysicalPresenceCMDEnable()\n" + "TlclAssertPhysicalPresence()\n" + "TlclGetPermanentFlags()\n" + "TlclRead(0x1007, 10)\n", + "tlcl calls"); + + /* If firmware space is missing, do one-time init */ + ResetMocks(5, TPM_E_BADINDEX); + mock_pflags.physicalPresenceLifetimeLock = 1; + mock_pflags.nvLocked = 1; + TEST_EQ(SetupTPM(0, 0, 0, 0, &rsf), 0, "SetupTPM() no firmware space"); + TEST_STR_EQ(mock_calls, + "TlclLibInit()\n" + "TlclStartup()\n" + "TlclAssertPhysicalPresence()\n" + "TlclGetPermanentFlags()\n" + "TlclRead(0x1007, 10)\n" + /* Calls from one-time init */ + "TlclSelfTestFull()\n" + "TlclGetPermanentFlags()\n" + "TlclForceClear()\n" + "TlclSetEnable()\n" + "TlclSetDeactivated(0)\n" + "TlclDefineSpace(0x1008, 0x1, 13)\n" + "TlclWrite(0x1008, 13)\n" + "TlclRead(0x1008, 13)\n" + "TlclDefineSpace(0x1007, 0x8001, 10)\n" + "TlclWrite(0x1007, 10)\n" + "TlclRead(0x1007, 10)\n", + "tlcl calls"); + + /* Other firmware space error is passed through */ + ResetMocks(5, TPM_E_IOERROR); + TEST_EQ(SetupTPM(0, 0, 0, 0, &rsf), TPM_E_CORRUPTED_STATE, + "SetupTPM() bad firmware space"); + TEST_STR_EQ(mock_calls, + "TlclLibInit()\n" + "TlclStartup()\n" + "TlclAssertPhysicalPresence()\n" + "TlclGetPermanentFlags()\n" + "TlclRead(0x1007, 10)\n", + "tlcl calls"); + + /* If developer flag has toggled, clear ownership and write new flag */ + ResetMocks(0, 0); + TEST_EQ(SetupTPM(0, 1, 0, 0, &rsf), 0, "SetupTPM() to dev"); + TEST_STR_EQ(mock_calls, + "TlclLibInit()\n" + "TlclStartup()\n" + "TlclAssertPhysicalPresence()\n" + "TlclGetPermanentFlags()\n" + "TlclRead(0x1007, 10)\n" + "TlclForceClear()\n" + "TlclSetEnable()\n" + "TlclSetDeactivated(0)\n" + "TlclWrite(0x1007, 10)\n" + "TlclRead(0x1007, 10)\n", + "tlcl calls"); + TEST_EQ(mock_rsf.flags, FLAG_LAST_BOOT_DEVELOPER, + "fw space flags to dev 1"); + + ResetMocks(0, 0); + mock_rsf.flags = FLAG_LAST_BOOT_DEVELOPER; + TEST_EQ(SetupTPM(0, 0, 0, 0, &rsf), 0, "SetupTPM() from dev"); + TEST_STR_EQ(mock_calls, + "TlclLibInit()\n" + "TlclStartup()\n" + "TlclAssertPhysicalPresence()\n" + "TlclGetPermanentFlags()\n" + "TlclRead(0x1007, 10)\n" + "TlclForceClear()\n" + "TlclSetEnable()\n" + "TlclSetDeactivated(0)\n" + "TlclWrite(0x1007, 10)\n" + "TlclRead(0x1007, 10)\n", + "tlcl calls"); + TEST_EQ(mock_rsf.flags, 0, "fw space flags from dev 1"); + + /* If TPM clear request, clear ownership also */ + ResetMocks(0, 0); + TEST_EQ(SetupTPM(0, 0, 0, 1, &rsf), 0, "SetupTPM() clear owner"); + TEST_STR_EQ(mock_calls, + "TlclLibInit()\n" + "TlclStartup()\n" + "TlclAssertPhysicalPresence()\n" + "TlclGetPermanentFlags()\n" + "TlclRead(0x1007, 10)\n" + "TlclForceClear()\n" + "TlclSetEnable()\n" + "TlclSetDeactivated(0)\n", + "tlcl calls"); + + /* Handle request to clear virtual dev switch */ + ResetMocks(0, 0); + mock_rsf.flags = FLAG_VIRTUAL_DEV_MODE_ON | FLAG_LAST_BOOT_DEVELOPER; + TEST_EQ(SetupTPM(0, 0, 1, 0, &rsf), 0, "SetupTPM() clear virtual dev"); + TEST_EQ(mock_rsf.flags, 0, "Clear virtual dev"); + + /* If virtual dev switch is on, that should set last boot developer */ + ResetMocks(0, 0); + mock_rsf.flags = FLAG_VIRTUAL_DEV_MODE_ON; + SetupTPM(0, 0, 0, 0, &rsf); + TEST_EQ(mock_rsf.flags, + FLAG_VIRTUAL_DEV_MODE_ON | FLAG_LAST_BOOT_DEVELOPER, + "virtual dev sets last boot"); + + /* + * Note: SetupTPM() recovery_mode parameter sets a global flag in + * rollback_index.c; this is tested along with RollbackKernelLock() + * below. + */ } /****************************************************************************/ /* Tests for RollbackFirmware() calls */ -static void RollbackFirmwareTest(void) { - uint32_t version; - int dev_mode; - - /* Normal setup */ - ResetMocks(0, 0); - dev_mode = 0; - version = 123; - mock_rsf.fw_versions = 0x12345678; - TEST_EQ(RollbackFirmwareSetup(0, 0, dev_mode, 0, &dev_mode, &version), 0, - "RollbackFirmwareSetup()"); - TEST_STR_EQ(mock_calls, - "TlclLibInit()\n" - "TlclStartup()\n" - "TlclAssertPhysicalPresence()\n" - "TlclGetPermanentFlags()\n" - "TlclRead(0x1007, 10)\n", - "tlcl calls"); - TEST_EQ(version, 0x12345678, "RollbackFirmwareSetup() version"); - - /* Error during setup should clear version */ - ResetMocks(1, TPM_E_IOERROR); - dev_mode = 0; - version = 123; - mock_rsf.fw_versions = 0x12345678; - TEST_EQ(RollbackFirmwareSetup(0, 0, dev_mode, 0, &dev_mode, &version), - TPM_E_IOERROR, - "RollbackFirmwareSetup() error"); - TEST_STR_EQ(mock_calls, - "TlclLibInit()\n", - "tlcl calls"); - TEST_EQ(version, 0, "RollbackFirmwareSetup() version on error"); - - /* Developer mode flag gets passed properly */ - ResetMocks(0, 0); - dev_mode = 1; - TEST_EQ(RollbackFirmwareSetup(0, dev_mode, 0, 0, &dev_mode, &version), 0, - "RollbackFirmwareSetup() to dev"); - TEST_STR_EQ(mock_calls, - "TlclLibInit()\n" - "TlclStartup()\n" - "TlclAssertPhysicalPresence()\n" - "TlclGetPermanentFlags()\n" - "TlclRead(0x1007, 10)\n" - "TlclForceClear()\n" - "TlclSetEnable()\n" - "TlclSetDeactivated(0)\n" - "TlclWrite(0x1007, 10)\n" - "TlclRead(0x1007, 10)\n", - "tlcl calls"); - TEST_EQ(mock_rsf.flags, FLAG_LAST_BOOT_DEVELOPER, "fw space flags to dev 2"); - - /* So does clear-TPM request */ - ResetMocks(0, 0); - dev_mode = 0; - TEST_EQ(RollbackFirmwareSetup(0, dev_mode, 0, 1, &dev_mode, &version), 0, - "RollbackFirmwareSetup() clear owner"); - TEST_STR_EQ(mock_calls, - "TlclLibInit()\n" - "TlclStartup()\n" - "TlclAssertPhysicalPresence()\n" - "TlclGetPermanentFlags()\n" - "TlclRead(0x1007, 10)\n" - "TlclForceClear()\n" - "TlclSetEnable()\n" - "TlclSetDeactivated(0)\n", - "tlcl calls"); - - /* Test write */ - ResetMocks(0, 0); - TEST_EQ(RollbackFirmwareWrite(0xBEAD1234), 0, "RollbackFirmwareWrite()"); - TEST_EQ(mock_rsf.fw_versions, 0xBEAD1234, "RollbackFirmwareWrite() version"); - TEST_STR_EQ(mock_calls, - "TlclRead(0x1007, 10)\n" - "TlclWrite(0x1007, 10)\n" - "TlclRead(0x1007, 10)\n", - "tlcl calls"); - - ResetMocks(1, TPM_E_IOERROR); - TEST_EQ(RollbackFirmwareWrite(123), TPM_E_IOERROR, - "RollbackFirmwareWrite() error"); - - /* Test lock */ - ResetMocks(0, 0); - TEST_EQ(RollbackFirmwareLock(), 0, "RollbackFirmwareLock()"); - TEST_STR_EQ(mock_calls, - "TlclSetGlobalLock()\n", - "tlcl calls"); - - ResetMocks(1, TPM_E_IOERROR); - TEST_EQ(RollbackFirmwareLock(), TPM_E_IOERROR, - "RollbackFirmwareLock() error"); + +static void RollbackFirmwareTest(void) +{ + uint32_t version; + int dev_mode; + + /* Normal setup */ + ResetMocks(0, 0); + dev_mode = 0; + version = 123; + mock_rsf.fw_versions = 0x12345678; + TEST_EQ(RollbackFirmwareSetup(0, 0, dev_mode, 0, &dev_mode, &version), + 0, "RollbackFirmwareSetup()"); + TEST_STR_EQ(mock_calls, + "TlclLibInit()\n" + "TlclStartup()\n" + "TlclAssertPhysicalPresence()\n" + "TlclGetPermanentFlags()\n" + "TlclRead(0x1007, 10)\n", + "tlcl calls"); + TEST_EQ(version, 0x12345678, "RollbackFirmwareSetup() version"); + + /* Error during setup should clear version */ + ResetMocks(1, TPM_E_IOERROR); + dev_mode = 0; + version = 123; + mock_rsf.fw_versions = 0x12345678; + TEST_EQ(RollbackFirmwareSetup(0, 0, dev_mode, 0, &dev_mode, &version), + TPM_E_IOERROR, + "RollbackFirmwareSetup() error"); + TEST_STR_EQ(mock_calls, + "TlclLibInit()\n", + "tlcl calls"); + TEST_EQ(version, 0, "RollbackFirmwareSetup() version on error"); + + /* Developer mode flag gets passed properly */ + ResetMocks(0, 0); + dev_mode = 1; + TEST_EQ(RollbackFirmwareSetup(0, dev_mode, 0, 0, &dev_mode, &version), + 0, "RollbackFirmwareSetup() to dev"); + TEST_STR_EQ(mock_calls, + "TlclLibInit()\n" + "TlclStartup()\n" + "TlclAssertPhysicalPresence()\n" + "TlclGetPermanentFlags()\n" + "TlclRead(0x1007, 10)\n" + "TlclForceClear()\n" + "TlclSetEnable()\n" + "TlclSetDeactivated(0)\n" + "TlclWrite(0x1007, 10)\n" + "TlclRead(0x1007, 10)\n", + "tlcl calls"); + TEST_EQ(mock_rsf.flags, FLAG_LAST_BOOT_DEVELOPER, + "fw space flags to dev 2"); + + /* So does clear-TPM request */ + ResetMocks(0, 0); + dev_mode = 0; + TEST_EQ(RollbackFirmwareSetup(0, dev_mode, 0, 1, &dev_mode, &version), + 0, "RollbackFirmwareSetup() clear owner"); + TEST_STR_EQ(mock_calls, + "TlclLibInit()\n" + "TlclStartup()\n" + "TlclAssertPhysicalPresence()\n" + "TlclGetPermanentFlags()\n" + "TlclRead(0x1007, 10)\n" + "TlclForceClear()\n" + "TlclSetEnable()\n" + "TlclSetDeactivated(0)\n", + "tlcl calls"); + + /* Test write */ + ResetMocks(0, 0); + TEST_EQ(RollbackFirmwareWrite(0xBEAD1234), 0, + "RollbackFirmwareWrite()"); + TEST_EQ(mock_rsf.fw_versions, 0xBEAD1234, + "RollbackFirmwareWrite() version"); + TEST_STR_EQ(mock_calls, + "TlclRead(0x1007, 10)\n" + "TlclWrite(0x1007, 10)\n" + "TlclRead(0x1007, 10)\n", + "tlcl calls"); + + ResetMocks(1, TPM_E_IOERROR); + TEST_EQ(RollbackFirmwareWrite(123), TPM_E_IOERROR, + "RollbackFirmwareWrite() error"); + + /* Test setting virtual dev mode */ + ResetMocks(0, 0); + TEST_EQ(SetVirtualDevMode(1), 0, "SetVirtualDevMode(1)"); + TEST_EQ(mock_rsf.flags, FLAG_VIRTUAL_DEV_MODE_ON, "Virtual dev on"); + TEST_STR_EQ(mock_calls, + "TlclRead(0x1007, 10)\n" + "TlclWrite(0x1007, 10)\n" + "TlclRead(0x1007, 10)\n", + "tlcl calls"); + ResetMocks(0, 0); + TEST_EQ(SetVirtualDevMode(0), 0, "SetVirtualDevMode(0)"); + TEST_EQ(mock_rsf.flags, 0, "Virtual dev off"); + TEST_STR_EQ(mock_calls, + "TlclRead(0x1007, 10)\n" + "TlclWrite(0x1007, 10)\n" + "TlclRead(0x1007, 10)\n", + "tlcl calls"); + + /* Test lock */ + ResetMocks(0, 0); + TEST_EQ(RollbackFirmwareLock(), 0, "RollbackFirmwareLock()"); + TEST_STR_EQ(mock_calls, + "TlclSetGlobalLock()\n", + "tlcl calls"); + + ResetMocks(1, TPM_E_IOERROR); + TEST_EQ(RollbackFirmwareLock(), TPM_E_IOERROR, + "RollbackFirmwareLock() error"); } /****************************************************************************/ /* Tests for RollbackKernel() calls */ -static void RollbackKernelTest(void) { - RollbackSpaceFirmware rsf; - uint32_t version = 0; - - /* RollbackKernel*() functions use a global flag inside - * rollback_index.c based on recovery mode, which is set by - * SetupTPM(). Clear the flag for the first set of tests. */ - TEST_EQ(SetupTPM(0, 0, 0, 0, &rsf), 0, "SetupTPM()"); - - /* Normal read */ - ResetMocks(0, 0); - mock_rsk.uid = ROLLBACK_SPACE_KERNEL_UID; - mock_permissions = TPM_NV_PER_PPWRITE; - mock_rsk.kernel_versions = 0x87654321; - TEST_EQ(RollbackKernelRead(&version), 0, "RollbackKernelRead()"); - TEST_STR_EQ(mock_calls, - "TlclRead(0x1008, 13)\n" - "TlclGetPermissions(0x1008)\n", - "tlcl calls"); - TEST_EQ(version, 0x87654321, "RollbackKernelRead() version"); - - /* Read error */ - ResetMocks(1, TPM_E_IOERROR); - TEST_EQ(RollbackKernelRead(&version), TPM_E_IOERROR, - "RollbackKernelRead() error"); - TEST_STR_EQ(mock_calls, - "TlclRead(0x1008, 13)\n", - "tlcl calls"); - - /* Wrong permission or UID will return error */ - ResetMocks(0, 0); - mock_rsk.uid = ROLLBACK_SPACE_KERNEL_UID + 1; - mock_permissions = TPM_NV_PER_PPWRITE; - TEST_EQ(RollbackKernelRead(&version), TPM_E_CORRUPTED_STATE, - "RollbackKernelRead() bad uid"); - - ResetMocks(0, 0); - mock_rsk.uid = ROLLBACK_SPACE_KERNEL_UID; - mock_permissions = TPM_NV_PER_PPWRITE + 1; - TEST_EQ(RollbackKernelRead(&version), TPM_E_CORRUPTED_STATE, - "RollbackKernelRead() bad permissions"); - - /* Test write */ - ResetMocks(0, 0); - TEST_EQ(RollbackKernelWrite(0xBEAD4321), 0, "RollbackKernelWrite()"); - TEST_EQ(mock_rsk.kernel_versions, 0xBEAD4321, - "RollbackKernelWrite() version"); - TEST_STR_EQ(mock_calls, - "TlclRead(0x1008, 13)\n" - "TlclWrite(0x1008, 13)\n" - "TlclRead(0x1008, 13)\n", - "tlcl calls"); - - ResetMocks(1, TPM_E_IOERROR); - TEST_EQ(RollbackKernelWrite(123), TPM_E_IOERROR, - "RollbackKernelWrite() error"); - - /* Test lock (recovery off) */ - ResetMocks(0, 0); - TEST_EQ(RollbackKernelLock(), 0, "RollbackKernelLock()"); - TEST_STR_EQ(mock_calls, - "TlclLockPhysicalPresence()\n", - "tlcl calls"); - - ResetMocks(1, TPM_E_IOERROR); - TEST_EQ(RollbackKernelLock(), TPM_E_IOERROR, "RollbackKernelLock() error"); - - /* Test lock with recovery on; shouldn't lock PP */ - SetupTPM(1, 0, 0, 0, &rsf); - ResetMocks(0, 0); - TEST_EQ(RollbackKernelLock(), 0, "RollbackKernelLock() in recovery"); - TEST_STR_EQ(mock_calls, "", "no tlcl calls"); +static void RollbackKernelTest(void) +{ + RollbackSpaceFirmware rsf; + uint32_t version = 0; + + /* + * RollbackKernel*() functions use a global flag inside + * rollback_index.c based on recovery mode, which is set by SetupTPM(). + * Clear the flag for the first set of tests. + */ + TEST_EQ(SetupTPM(0, 0, 0, 0, &rsf), 0, "SetupTPM()"); + + /* Normal read */ + ResetMocks(0, 0); + mock_rsk.uid = ROLLBACK_SPACE_KERNEL_UID; + mock_permissions = TPM_NV_PER_PPWRITE; + mock_rsk.kernel_versions = 0x87654321; + TEST_EQ(RollbackKernelRead(&version), 0, "RollbackKernelRead()"); + TEST_STR_EQ(mock_calls, + "TlclRead(0x1008, 13)\n" + "TlclGetPermissions(0x1008)\n", + "tlcl calls"); + TEST_EQ(version, 0x87654321, "RollbackKernelRead() version"); + + /* Read error */ + ResetMocks(1, TPM_E_IOERROR); + TEST_EQ(RollbackKernelRead(&version), TPM_E_IOERROR, + "RollbackKernelRead() error"); + TEST_STR_EQ(mock_calls, + "TlclRead(0x1008, 13)\n", + "tlcl calls"); + + /* Wrong permission or UID will return error */ + ResetMocks(0, 0); + mock_rsk.uid = ROLLBACK_SPACE_KERNEL_UID + 1; + mock_permissions = TPM_NV_PER_PPWRITE; + TEST_EQ(RollbackKernelRead(&version), TPM_E_CORRUPTED_STATE, + "RollbackKernelRead() bad uid"); + + ResetMocks(0, 0); + mock_rsk.uid = ROLLBACK_SPACE_KERNEL_UID; + mock_permissions = TPM_NV_PER_PPWRITE + 1; + TEST_EQ(RollbackKernelRead(&version), TPM_E_CORRUPTED_STATE, + "RollbackKernelRead() bad permissions"); + + /* Test write */ + ResetMocks(0, 0); + TEST_EQ(RollbackKernelWrite(0xBEAD4321), 0, "RollbackKernelWrite()"); + TEST_EQ(mock_rsk.kernel_versions, 0xBEAD4321, + "RollbackKernelWrite() version"); + TEST_STR_EQ(mock_calls, + "TlclRead(0x1008, 13)\n" + "TlclWrite(0x1008, 13)\n" + "TlclRead(0x1008, 13)\n", + "tlcl calls"); + + ResetMocks(1, TPM_E_IOERROR); + TEST_EQ(RollbackKernelWrite(123), TPM_E_IOERROR, + "RollbackKernelWrite() error"); + + /* Test lock (recovery off) */ + ResetMocks(0, 0); + TEST_EQ(RollbackKernelLock(), 0, "RollbackKernelLock()"); + TEST_STR_EQ(mock_calls, + "TlclLockPhysicalPresence()\n", + "tlcl calls"); + + ResetMocks(1, TPM_E_IOERROR); + TEST_EQ(RollbackKernelLock(), TPM_E_IOERROR, + "RollbackKernelLock() error"); + + /* Test lock with recovery on; shouldn't lock PP */ + SetupTPM(1, 0, 0, 0, &rsf); + ResetMocks(0, 0); + TEST_EQ(RollbackKernelLock(), 0, "RollbackKernelLock() in recovery"); + TEST_STR_EQ(mock_calls, "", "no tlcl calls"); } /* Tests for RollbackS3Resume() */ -static void RollbackS3ResumeTest(void) { - - ResetMocks(0, 0); - TEST_EQ(RollbackS3Resume(), 0, "RollbackS3Resume()"); - TEST_STR_EQ(mock_calls, - "TlclLibInit()\n" - "TlclResume()\n", - "tlcl calls"); - - /* Should ignore postinit error */ - ResetMocks(2, TPM_E_INVALID_POSTINIT); - TEST_EQ(RollbackS3Resume(), 0, "RollbackS3Resume() postinit"); - - /* Resume with other error */ - ResetMocks(2, TPM_E_IOERROR); - TEST_EQ(RollbackS3Resume(), TPM_E_IOERROR, "RollbackS3Resume() other error"); +static void RollbackS3ResumeTest(void) +{ + ResetMocks(0, 0); + TEST_EQ(RollbackS3Resume(), 0, "RollbackS3Resume()"); + TEST_STR_EQ(mock_calls, + "TlclLibInit()\n" + "TlclResume()\n", + "tlcl calls"); + + /* Should ignore postinit error */ + ResetMocks(2, TPM_E_INVALID_POSTINIT); + TEST_EQ(RollbackS3Resume(), 0, "RollbackS3Resume() postinit"); + + /* Resume with other error */ + ResetMocks(2, TPM_E_IOERROR); + TEST_EQ(RollbackS3Resume(), TPM_E_IOERROR, + "RollbackS3Resume() other error"); } /* disable MSVC warnings on unused arguments */ __pragma(warning (disable: 4100)) -int main(int argc, char* argv[]) { - int error_code = 0; - - CrcTestFirmware(); - CrcTestKernel(); - MiscTest(); - OneTimeInitTest(); - SetupTpmTest(); - RollbackFirmwareTest(); - RollbackKernelTest(); - RollbackS3ResumeTest(); - - if (!gTestSuccess) - error_code = 255; - - return error_code; +int main(int argc, char* argv[]) +{ + CrcTestFirmware(); + CrcTestKernel(); + MiscTest(); + OneTimeInitTest(); + SetupTpmTest(); + RollbackFirmwareTest(); + RollbackKernelTest(); + RollbackS3ResumeTest(); + + return gTestSuccess ? 0 : 255; } diff --git a/tests/rollback_index3_tests.c b/tests/rollback_index3_tests.c new file mode 100644 index 00000000..ece8bc08 --- /dev/null +++ b/tests/rollback_index3_tests.c @@ -0,0 +1,45 @@ +/* Copyright (c) 2013 The Chromium OS Authors. All rights reserved. + * Use of this source code is governed by a BSD-style license that can be + * found in the LICENSE file. + * + * Tests for do-nothing rollback_index functions with disabled TPM + */ + +#include <stdio.h> +#include <stdlib.h> +#include <string.h> + +#define _STUB_IMPLEMENTATION_ /* So we can use memset() ourselves */ + +#include "rollback_index.h" +#include "test_common.h" + +/* disable MSVC warnings on unused arguments */ +__pragma(warning (disable: 4100)) + +int main(int argc, char* argv[]) +{ + int is_virt_dev; + uint32_t version; + + TEST_EQ(RollbackS3Resume(), 0, "RollbackS3Resume()"); + + is_virt_dev = 1; + version = 1; + TEST_EQ(RollbackFirmwareSetup(0, 0, 0, 0, &is_virt_dev, &version), + 0, "RollbackFirmwareSetup()"); + TEST_EQ(is_virt_dev, 0, "rfs is_virt_dev"); + TEST_EQ(version, 0, "rfs version"); + + TEST_EQ(RollbackFirmwareWrite(0), 0, "RollbackFirmwareWrite()"); + TEST_EQ(RollbackFirmwareLock(), 0, "RollbackFirmwareLock()"); + + version = 1; + TEST_EQ(RollbackKernelRead(&version), 0, "RollbackKernelRead()"); + TEST_EQ(version, 0, "rkr version"); + + TEST_EQ(RollbackKernelWrite(0), 0, "RollbackKernelWrite()"); + TEST_EQ(RollbackKernelLock(), 0, "RollbackKernelLock()"); + + return gTestSuccess ? 0 : 255; +} |