scottk/OpenCellular
1
0
Fork 0
mirror of https://github.com/Telecominfraproject/OpenCellular.git synced 2025-12-02 22:23:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

Improve coverage of rollback_index.c

Browse Source 
BUG=chromium-os:38139
BRANCH=none
TEST=make runtests

Change-Id: I21b62b5dd3fc6037f54f7c3bac768c2b67a4c12d
Signed-off-by: Randall Spangler <rspangler@chromium.org>
Reviewed-on: https://gerrit.chromium.org/gerrit/41859
Reviewed-by: Bill Richardson <wfrichar@chromium.org>
This commit is contained in:
Randall Spangler
2013-01-23 13:04:05 -08:00
committed by ChromeBot
parent 6dbf9d9160
commit a3eac79f50
4 changed files with 1281 additions and 1091 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
Makefile
View File

@@ -405,6 +405,7 @@ ALL_OBJS += ${TESTLIB_OBJS}
TEST_NAMES = \ TEST_NAMES = \
cgptlib_test \ cgptlib_test \
rollback_index2_tests \ rollback_index2_tests \
rollback_index3_tests \
rsa_padding_test \ rsa_padding_test \
rsa_utility_tests \ rsa_utility_tests \
rsa_verify_benchmark \ rsa_verify_benchmark \
@@ -932,6 +933,7 @@ runtestscripts: test_setup genfuzztestcases
.PHONY: runmisctests .PHONY: runmisctests
runmisctests: test_setup runmisctests: test_setup
${RUNTEST} ${BUILD_RUN}/tests/rollback_index2_tests ${RUNTEST} ${BUILD_RUN}/tests/rollback_index2_tests
${RUNTEST} ${BUILD_RUN}/tests/rollback_index3_tests
${RUNTEST} ${BUILD_RUN}/tests/rsa_utility_tests ${RUNTEST} ${BUILD_RUN}/tests/rsa_utility_tests
${RUNTEST} ${BUILD_RUN}/tests/sha_tests ${RUNTEST} ${BUILD_RUN}/tests/sha_tests
${RUNTEST} ${BUILD_RUN}/tests/stateful_util_tests ${RUNTEST} ${BUILD_RUN}/tests/stateful_util_tests

279
firmware/lib/rollback_index.c
View File

@@ -1,4 +1,4 @@
/* Copyright (c) 2012 The Chromium OS Authors. All rights reserved. /* Copyright (c) 2013 The Chromium OS Authors. All rights reserved.
* Use of this source code is governed by a BSD-style license that can be * Use of this source code is governed by a BSD-style license that can be
* found in the LICENSE file. * found in the LICENSE file.
* *
@@ -39,7 +39,8 @@ __pragma(warning (disable: 4127))
} while (0) } while (0)
uint32_t TPMClearAndReenable(void) { uint32_t TPMClearAndReenable(void)
{
VBDEBUG(("TPM: Clear and re-enable\n")); VBDEBUG(("TPM: Clear and re-enable\n"));
RETURN_ON_FAILURE(TlclForceClear()); RETURN_ON_FAILURE(TlclForceClear());
RETURN_ON_FAILURE(TlclSetEnable()); RETURN_ON_FAILURE(TlclSetEnable());
@@ -48,8 +49,8 @@ uint32_t TPMClearAndReenable(void) {
return TPM_SUCCESS; return TPM_SUCCESS;
} }
uint32_t SafeWrite(uint32_t index, const void *data, uint32_t length)
uint32_t SafeWrite(uint32_t index, const void* data, uint32_t length) { {
uint32_t result = TlclWrite(index, data, length); uint32_t result = TlclWrite(index, data, length);
if (result == TPM_E_MAXNVWRITES) { if (result == TPM_E_MAXNVWRITES) {
RETURN_ON_FAILURE(TPMClearAndReenable()); RETURN_ON_FAILURE(TPMClearAndReenable());
@@ -59,8 +60,8 @@ uint32_t SafeWrite(uint32_t index, const void* data, uint32_t length) {
} }
} }
uint32_t SafeDefineSpace(uint32_t index, uint32_t perm, uint32_t size)
uint32_t SafeDefineSpace(uint32_t index, uint32_t perm, uint32_t size) { {
uint32_t result = TlclDefineSpace(index, perm, size); uint32_t result = TlclDefineSpace(index, perm, size);
if (result == TPM_E_MAXNVWRITES) { if (result == TPM_E_MAXNVWRITES) {
RETURN_ON_FAILURE(TPMClearAndReenable()); RETURN_ON_FAILURE(TPMClearAndReenable());
@@ -70,29 +71,38 @@ uint32_t SafeDefineSpace(uint32_t index, uint32_t perm, uint32_t size) {
} }
} }
/* Functions to read and write firmware and kernel spaces. */ /* Functions to read and write firmware and kernel spaces. */
uint32_t ReadSpaceFirmware(RollbackSpaceFirmware* rsf) { uint32_t ReadSpaceFirmware(RollbackSpaceFirmware *rsf)
{
uint32_t r; uint32_t r;
int attempts = 3; int attempts = 3;
while (attempts--) { while (attempts--) {
r = TlclRead(FIRMWARE_NV_INDEX, rsf, sizeof(RollbackSpaceFirmware)); r = TlclRead(FIRMWARE_NV_INDEX, rsf,
sizeof(RollbackSpaceFirmware));
if (r != TPM_SUCCESS) if (r != TPM_SUCCESS)
return r; return r;
/* No CRC in this version, so we'll create one when we write it. Note that /*
* we're marking this as version 2, not ROLLBACK_SPACE_FIRMWARE_VERSION, * No CRC in this version, so we'll create one when we write
* because version 2 just added the CRC. Later versions will need to * it. Note that we're marking this as version 2, not
* set default values for any extra fields explicitly (probably here). */ * ROLLBACK_SPACE_FIRMWARE_VERSION, because version 2 just
* added the CRC. Later versions will need to set default
* values for any extra fields explicitly (probably here).
*/
if (rsf->struct_version < 2) { if (rsf->struct_version < 2) {
rsf->struct_version = 2; /* Danger Will Robinson! Danger! */ /* Danger Will Robinson! Danger! */
rsf->struct_version = 2;
return TPM_SUCCESS; return TPM_SUCCESS;
} }
/* If the CRC is good, we're done. If it's bad, try a couple more times to /*
* see if it gets better before we give up. It could just be noise. */ * If the CRC is good, we're done. If it's bad, try a couple
if (rsf->crc8 == Crc8(rsf, offsetof(RollbackSpaceFirmware, crc8))) * more times to see if it gets better before we give up. It
* could just be noise.
*/
if (rsf->crc8 == Crc8(rsf,
offsetof(RollbackSpaceFirmware, crc8)))
return TPM_SUCCESS; return TPM_SUCCESS;
VBDEBUG(("TPM: %s() - bad CRC\n", __func__)); VBDEBUG(("TPM: %s() - bad CRC\n", __func__));
@@ -102,7 +112,8 @@ uint32_t ReadSpaceFirmware(RollbackSpaceFirmware* rsf) {
return TPM_E_CORRUPTED_STATE; return TPM_E_CORRUPTED_STATE;
} }
uint32_t WriteSpaceFirmware(RollbackSpaceFirmware* rsf) { uint32_t WriteSpaceFirmware(RollbackSpaceFirmware *rsf)
{
RollbackSpaceFirmware rsf2; RollbackSpaceFirmware rsf2;
uint32_t r; uint32_t r;
int attempts = 3; int attempts = 3;
@@ -113,7 +124,8 @@ uint32_t WriteSpaceFirmware(RollbackSpaceFirmware* rsf) {
rsf->crc8 = Crc8(rsf, offsetof(RollbackSpaceFirmware, crc8)); rsf->crc8 = Crc8(rsf, offsetof(RollbackSpaceFirmware, crc8));
while (attempts--) { while (attempts--) {
r = SafeWrite(FIRMWARE_NV_INDEX, rsf, sizeof(RollbackSpaceFirmware)); r = SafeWrite(FIRMWARE_NV_INDEX, rsf,
sizeof(RollbackSpaceFirmware));
/* Can't write, not gonna try again */ /* Can't write, not gonna try again */
if (r != TPM_SUCCESS) if (r != TPM_SUCCESS)
return r; return r;
@@ -131,7 +143,8 @@ uint32_t WriteSpaceFirmware(RollbackSpaceFirmware* rsf) {
return TPM_E_CORRUPTED_STATE; return TPM_E_CORRUPTED_STATE;
} }
uint32_t SetVirtualDevMode(int val) { uint32_t SetVirtualDevMode(int val)
{
RollbackSpaceFirmware rsf; RollbackSpaceFirmware rsf;
VBDEBUG(("TPM: Entering %s()\n", __func__)); VBDEBUG(("TPM: Entering %s()\n", __func__));
@@ -143,7 +156,10 @@ uint32_t SetVirtualDevMode(int val) {
rsf.flags |= FLAG_VIRTUAL_DEV_MODE_ON; rsf.flags |= FLAG_VIRTUAL_DEV_MODE_ON;
else else
rsf.flags &= ~FLAG_VIRTUAL_DEV_MODE_ON; rsf.flags &= ~FLAG_VIRTUAL_DEV_MODE_ON;
/* NOTE: This doesn't update the FLAG_LAST_BOOT_DEVELOPER bit */ /*
* NOTE: This doesn't update the FLAG_LAST_BOOT_DEVELOPER bit. That
* will be done by SetupTPM() on the next boot.
*/
VBDEBUG(("TPM: flags are now 0x%02x\n", rsf.flags)); VBDEBUG(("TPM: flags are now 0x%02x\n", rsf.flags));
if (TPM_SUCCESS != WriteSpaceFirmware(&rsf)) if (TPM_SUCCESS != WriteSpaceFirmware(&rsf))
@@ -153,7 +169,8 @@ uint32_t SetVirtualDevMode(int val) {
return VBERROR_SUCCESS; return VBERROR_SUCCESS;
} }
uint32_t ReadSpaceKernel(RollbackSpaceKernel* rsk) { uint32_t ReadSpaceKernel(RollbackSpaceKernel *rsk)
{
uint32_t r; uint32_t r;
int attempts = 3; int attempts = 3;
@@ -162,17 +179,24 @@ uint32_t ReadSpaceKernel(RollbackSpaceKernel* rsk) {
if (r != TPM_SUCCESS) if (r != TPM_SUCCESS)
return r; return r;
/* No CRC in this version, so we'll create one when we write it. Note that /*
* we're marking this as version 2, not ROLLBACK_SPACE_KERNEL_VERSION, * No CRC in this version, so we'll create one when we write
* because version 2 just added the CRC. Later versions will need to * it. Note that we're marking this as version 2, not
* set default values for any extra fields explicitly (probably here). */ * ROLLBACK_SPACE_KERNEL_VERSION, because version 2 just added
* the CRC. Later versions will need to set default values for
* any extra fields explicitly (probably here).
*/
if (rsk->struct_version < 2) { if (rsk->struct_version < 2) {
rsk->struct_version = 2; /* Danger Will Robinson! Danger! */ /* Danger Will Robinson! Danger! */
rsk->struct_version = 2;
return TPM_SUCCESS; return TPM_SUCCESS;
} }
/* If the CRC is good, we're done. If it's bad, try a couple more times to /*
* see if it gets better before we give up. It could just be noise. */ * If the CRC is good, we're done. If it's bad, try a couple
* more times to see if it gets better before we give up. It
* could just be noise.
*/
if (rsk->crc8 == Crc8(rsk, offsetof(RollbackSpaceKernel, crc8))) if (rsk->crc8 == Crc8(rsk, offsetof(RollbackSpaceKernel, crc8)))
return TPM_SUCCESS; return TPM_SUCCESS;
@@ -183,7 +207,8 @@ uint32_t ReadSpaceKernel(RollbackSpaceKernel* rsk) {
return TPM_E_CORRUPTED_STATE; return TPM_E_CORRUPTED_STATE;
} }
uint32_t WriteSpaceKernel(RollbackSpaceKernel* rsk) { uint32_t WriteSpaceKernel(RollbackSpaceKernel *rsk)
{
RollbackSpaceKernel rsk2; RollbackSpaceKernel rsk2;
uint32_t r; uint32_t r;
int attempts = 3; int attempts = 3;
@@ -194,7 +219,8 @@ uint32_t WriteSpaceKernel(RollbackSpaceKernel* rsk) {
rsk->crc8 = Crc8(rsk, offsetof(RollbackSpaceKernel, crc8)); rsk->crc8 = Crc8(rsk, offsetof(RollbackSpaceKernel, crc8));
while (attempts--) { while (attempts--) {
r = SafeWrite(KERNEL_NV_INDEX, rsk, sizeof(RollbackSpaceKernel)); r = SafeWrite(KERNEL_NV_INDEX, rsk,
sizeof(RollbackSpaceKernel));
/* Can't write, not gonna try again */ /* Can't write, not gonna try again */
if (r != TPM_SUCCESS) if (r != TPM_SUCCESS)
return r; return r;
@@ -212,9 +238,9 @@ uint32_t WriteSpaceKernel(RollbackSpaceKernel* rsk) {
return TPM_E_CORRUPTED_STATE; return TPM_E_CORRUPTED_STATE;
} }
uint32_t OneTimeInitializeTPM(RollbackSpaceFirmware *rsf,
uint32_t OneTimeInitializeTPM(RollbackSpaceFirmware* rsf, RollbackSpaceKernel *rsk)
RollbackSpaceKernel* rsk) { {
static const RollbackSpaceFirmware rsf_init = { static const RollbackSpaceFirmware rsf_init = {
.struct_version = ROLLBACK_SPACE_FIRMWARE_VERSION, .struct_version = ROLLBACK_SPACE_FIRMWARE_VERSION,
}; };
@@ -227,11 +253,14 @@ uint32_t OneTimeInitializeTPM(RollbackSpaceFirmware* rsf,
VBDEBUG(("TPM: One-time initialization\n")); VBDEBUG(("TPM: One-time initialization\n"));
/* Do a full test. This only happens the first time the device is turned on /*
* in the factory, so performance is not an issue. This is almost certainly * Do a full test. This only happens the first time the device is
* not necessary, but it gives us more confidence about some code paths below * turned on in the factory, so performance is not an issue. This is
* that are difficult to test---specifically the ones that set lifetime * almost certainly not necessary, but it gives us more confidence
* flags, and are only executed once per physical TPM. */ * about some code paths below that are difficult to
* test---specifically the ones that set lifetime flags, and are only
* executed once per physical TPM.
*/
result = TlclSelfTestFull(); result = TlclSelfTestFull();
if (result != TPM_SUCCESS) if (result != TPM_SUCCESS)
return result; return result;
@@ -240,8 +269,10 @@ uint32_t OneTimeInitializeTPM(RollbackSpaceFirmware* rsf,
if (result != TPM_SUCCESS) if (result != TPM_SUCCESS)
return result; return result;
/* TPM may come from the factory without physical presence finalized. Fix /*
* if necessary. */ * TPM may come from the factory without physical presence finalized.
* Fix if necessary.
*/
VBDEBUG(("TPM: physicalPresenceLifetimeLock=%d\n", VBDEBUG(("TPM: physicalPresenceLifetimeLock=%d\n",
pflags.physicalPresenceLifetimeLock)); pflags.physicalPresenceLifetimeLock));
if (!pflags.physicalPresenceLifetimeLock) { if (!pflags.physicalPresenceLifetimeLock) {
@@ -249,9 +280,11 @@ uint32_t OneTimeInitializeTPM(RollbackSpaceFirmware* rsf,
RETURN_ON_FAILURE(TlclFinalizePhysicalPresence()); RETURN_ON_FAILURE(TlclFinalizePhysicalPresence());
} }
/* The TPM will not enforce the NV authorization restrictions until the /*
* execution of a TPM_NV_DefineSpace with the handle of TPM_NV_INDEX_LOCK. * The TPM will not enforce the NV authorization restrictions until the
* Here we create that space if it doesn't already exist. */ * execution of a TPM_NV_DefineSpace with the handle of
* TPM_NV_INDEX_LOCK. Here we create that space if it doesn't already
* exist. */
VBDEBUG(("TPM: nvLocked=%d\n", pflags.nvLocked)); VBDEBUG(("TPM: nvLocked=%d\n", pflags.nvLocked));
if (!pflags.nvLocked) { if (!pflags.nvLocked) {
VBDEBUG(("TPM: Enabling NV locking\n")); VBDEBUG(("TPM: Enabling NV locking\n"));
@@ -270,7 +303,8 @@ uint32_t OneTimeInitializeTPM(RollbackSpaceFirmware* rsf,
RETURN_ON_FAILURE(SafeDefineSpace(KERNEL_NV_INDEX, TPM_NV_PER_PPWRITE, RETURN_ON_FAILURE(SafeDefineSpace(KERNEL_NV_INDEX, TPM_NV_PER_PPWRITE,
sizeof(RollbackSpaceKernel))); sizeof(RollbackSpaceKernel)));
RETURN_ON_FAILURE(WriteSpaceKernel(rsk)); RETURN_ON_FAILURE(WriteSpaceKernel(rsk));
RETURN_ON_FAILURE(SafeDefineSpace(FIRMWARE_NV_INDEX, RETURN_ON_FAILURE(SafeDefineSpace(
FIRMWARE_NV_INDEX,
TPM_NV_PER_GLOBALLOCK | TPM_NV_PER_PPWRITE, TPM_NV_PER_GLOBALLOCK | TPM_NV_PER_PPWRITE,
sizeof(RollbackSpaceFirmware))); sizeof(RollbackSpaceFirmware)));
RETURN_ON_FAILURE(WriteSpaceFirmware(rsf)); RETURN_ON_FAILURE(WriteSpaceFirmware(rsf));
@@ -278,7 +312,8 @@ uint32_t OneTimeInitializeTPM(RollbackSpaceFirmware* rsf,
} }
/* SetupTPM starts the TPM and establishes the root of trust for the /*
* SetupTPM starts the TPM and establishes the root of trust for the
* anti-rollback mechanism. SetupTPM can fail for three reasons. 1 A bug. 2 a * anti-rollback mechanism. SetupTPM can fail for three reasons. 1 A bug. 2 a
* TPM hardware failure. 3 An unexpected TPM state due to some attack. In * TPM hardware failure. 3 An unexpected TPM state due to some attack. In
* general we cannot easily distinguish the kind of failure, so our strategy is * general we cannot easily distinguish the kind of failure, so our strategy is
@@ -299,8 +334,8 @@ uint32_t OneTimeInitializeTPM(RollbackSpaceFirmware* rsf,
*/ */
uint32_t SetupTPM(int recovery_mode, int developer_mode, uint32_t SetupTPM(int recovery_mode, int developer_mode,
int disable_dev_request, int clear_tpm_owner_request, int disable_dev_request, int clear_tpm_owner_request,
RollbackSpaceFirmware* rsf) { RollbackSpaceFirmware* rsf)
{
uint8_t in_flags; uint8_t in_flags;
uint8_t disable; uint8_t disable;
uint8_t deactivated; uint8_t deactivated;
@@ -308,17 +343,18 @@ uint32_t SetupTPM(int recovery_mode, int developer_mode,
VBDEBUG(("TPM: SetupTPM(r%d, d%d)\n", recovery_mode, developer_mode)); VBDEBUG(("TPM: SetupTPM(r%d, d%d)\n", recovery_mode, developer_mode));
/* Global variables are usable in recovery mode */
if (recovery_mode) if (recovery_mode)
g_rollback_recovery_mode = 1; /* Global variables are usable in g_rollback_recovery_mode = 1;
* recovery mode */
RETURN_ON_FAILURE(TlclLibInit()); RETURN_ON_FAILURE(TlclLibInit());
#ifdef TEGRA_SOFT_REBOOT_WORKAROUND #ifdef TEGRA_SOFT_REBOOT_WORKAROUND
result = TlclStartup(); result = TlclStartup();
if (result == TPM_E_INVALID_POSTINIT) { if (result == TPM_E_INVALID_POSTINIT) {
/* Some prototype hardware doesn't reset the TPM on a CPU reset. We do a /*
* hard reset to get around this. * Some prototype hardware doesn't reset the TPM on a CPU
* reset. We do a hard reset to get around this.
*/ */
VBDEBUG(("TPM: soft reset detected\n", result)); VBDEBUG(("TPM: soft reset detected\n", result));
return TPM_E_MUST_REBOOT; return TPM_E_MUST_REBOOT;
@@ -330,7 +366,8 @@ uint32_t SetupTPM(int recovery_mode, int developer_mode,
RETURN_ON_FAILURE(TlclStartup()); RETURN_ON_FAILURE(TlclStartup());
#endif #endif
/* Some TPMs start the self test automatically at power on. In that case we /*
* Some TPMs start the self test automatically at power on. In that case we
* don't need to call ContinueSelfTest. On some (other) TPMs, * don't need to call ContinueSelfTest. On some (other) TPMs,
* ContinueSelfTest may block. In that case, we definitely don't want to * ContinueSelfTest may block. In that case, we definitely don't want to
* call it here. For TPMs in the intersection of these two sets, we're * call it here. For TPMs in the intersection of these two sets, we're
@@ -350,15 +387,16 @@ uint32_t SetupTPM(int recovery_mode, int developer_mode,
#endif #endif
result = TlclAssertPhysicalPresence(); result = TlclAssertPhysicalPresence();
if (result != TPM_SUCCESS) { if (result != TPM_SUCCESS) {
/* It is possible that the TPM was delivered with the physical presence /*
* command disabled. This tries enabling it, then tries asserting PP * It is possible that the TPM was delivered with the physical
* again. * presence command disabled. This tries enabling it, then
* tries asserting PP again.
*/ */
RETURN_ON_FAILURE(TlclPhysicalPresenceCMDEnable()); RETURN_ON_FAILURE(TlclPhysicalPresenceCMDEnable());
RETURN_ON_FAILURE(TlclAssertPhysicalPresence()); RETURN_ON_FAILURE(TlclAssertPhysicalPresence());
} }
/* Checks that the TPM is enabled and activated. */ /* Check that the TPM is enabled and activated. */
RETURN_ON_FAILURE(TlclGetFlags(&disable, &deactivated, NULL)); RETURN_ON_FAILURE(TlclGetFlags(&disable, &deactivated, NULL));
if (disable || deactivated) { if (disable || deactivated) {
VBDEBUG(("TPM: disabled (%d) or deactivated (%d). Fixing...\n", VBDEBUG(("TPM: disabled (%d) or deactivated (%d). Fixing...\n",
@@ -369,13 +407,15 @@ uint32_t SetupTPM(int recovery_mode, int developer_mode,
return TPM_E_MUST_REBOOT; return TPM_E_MUST_REBOOT;
} }
/* Reads the firmware space. */ /* Read the firmware space. */
result = ReadSpaceFirmware(rsf); result = ReadSpaceFirmware(rsf);
if (TPM_E_BADINDEX == result) { if (TPM_E_BADINDEX == result) {
RollbackSpaceKernel rsk; RollbackSpaceKernel rsk;
/* This is the first time we've run, and the TPM has not been /*
* initialized. This initializes it. */ * This is the first time we've run, and the TPM has not been
* initialized. Initialize it.
*/
VBDEBUG(("TPM: Not initialized yet.\n")); VBDEBUG(("TPM: Not initialized yet.\n"));
RETURN_ON_FAILURE(OneTimeInitializeTPM(rsf, &rsk)); RETURN_ON_FAILURE(OneTimeInitializeTPM(rsf, &rsk));
} else if (TPM_SUCCESS != result) { } else if (TPM_SUCCESS != result) {
@@ -392,15 +432,19 @@ uint32_t SetupTPM(int recovery_mode, int developer_mode,
VBDEBUG(("TPM: Clearing virt dev-switch: f%x\n", rsf->flags)); VBDEBUG(("TPM: Clearing virt dev-switch: f%x\n", rsf->flags));
} }
/* The developer_mode value that's passed in is only set by a hardware /*
* dev-switch. We should OR it with the virtual switch, whether or not the * The developer_mode value that's passed in is only set by a hardware
* virtual switch is used. If it's not used, it shouldn't change, so it * dev-switch. We should OR it with the virtual switch, whether or not
* doesn't matter. */ * the virtual switch is used. If it's not used, it shouldn't change,
* so it doesn't matter.
*/
if (rsf->flags & FLAG_VIRTUAL_DEV_MODE_ON) if (rsf->flags & FLAG_VIRTUAL_DEV_MODE_ON)
developer_mode = 1; developer_mode = 1;
/* Clears ownership if developer flag has toggled, or if an owner-clear has /*
* been requested. */ * Clear ownership if developer flag has toggled, or if an owner-clear
* has been requested.
*/
if ((developer_mode ? FLAG_LAST_BOOT_DEVELOPER : 0) != if ((developer_mode ? FLAG_LAST_BOOT_DEVELOPER : 0) !=
(in_flags & FLAG_LAST_BOOT_DEVELOPER)) { (in_flags & FLAG_LAST_BOOT_DEVELOPER)) {
VBDEBUG(("TPM: Developer flag changed; clearing owner.\n")); VBDEBUG(("TPM: Developer flag changed; clearing owner.\n"));
@@ -416,7 +460,7 @@ uint32_t SetupTPM(int recovery_mode, int developer_mode,
rsf->flags &= ~FLAG_LAST_BOOT_DEVELOPER; rsf->flags &= ~FLAG_LAST_BOOT_DEVELOPER;
/* If firmware space is dirty, this flushes it back to the TPM */ /* If firmware space is dirty, flush it back to the TPM */
if (rsf->flags != in_flags) { if (rsf->flags != in_flags) {
VBDEBUG(("TPM: Updating firmware space.\n")); VBDEBUG(("TPM: Updating firmware space.\n"));
RETURN_ON_FAILURE(WriteSpaceFirmware(rsf)); RETURN_ON_FAILURE(WriteSpaceFirmware(rsf));
@@ -426,18 +470,20 @@ uint32_t SetupTPM(int recovery_mode, int developer_mode,
return TPM_SUCCESS; return TPM_SUCCESS;
} }
/* disable MSVC warnings on unused arguments */ /* Disable MSVC warnings on unused arguments */
__pragma(warning (disable: 4100)) __pragma(warning (disable: 4100))
#ifdef DISABLE_ROLLBACK_TPM #ifdef DISABLE_ROLLBACK_TPM
/* Dummy implementations which don't support TPM rollback protection */ /* Dummy implementations which don't support TPM rollback protection */
uint32_t RollbackS3Resume(void) { uint32_t RollbackS3Resume(void)
{
#ifndef CHROMEOS_ENVIRONMENT #ifndef CHROMEOS_ENVIRONMENT
/* Initialize the TPM, but ignore return codes. In ChromeOS /*
* environment, don't even talk to the TPM. */ * Initialize the TPM, but ignore return codes. In ChromeOS
* environment, don't even talk to the TPM.
*/
TlclLibInit(); TlclLibInit();
TlclResume(); TlclResume();
#endif #endif
@@ -447,53 +493,60 @@ uint32_t RollbackS3Resume(void) {
uint32_t RollbackFirmwareSetup(int recovery_mode, int is_hw_dev, uint32_t RollbackFirmwareSetup(int recovery_mode, int is_hw_dev,
int disable_dev_request, int disable_dev_request,
int clear_tpm_owner_request, int clear_tpm_owner_request,
int *is_virt_dev, uint32_t *version) { int *is_virt_dev, uint32_t *version)
{
#ifndef CHROMEOS_ENVIRONMENT #ifndef CHROMEOS_ENVIRONMENT
/* Initialize the TPM, but ignores return codes. In ChromeOS /*
* environment, don't even talk to the TPM. */ * Initialize the TPM, but ignores return codes. In ChromeOS
* environment, don't even talk to the TPM.
*/
TlclLibInit(); TlclLibInit();
TlclStartup(); TlclStartup();
TlclContinueSelfTest(); TlclContinueSelfTest();
#endif #endif
*is_virt_dev = 0;
*version = 0; *version = 0;
return TPM_SUCCESS; return TPM_SUCCESS;
} }
uint32_t RollbackFirmwareRead(uint32_t* version) { uint32_t RollbackFirmwareWrite(uint32_t version)
{
return TPM_SUCCESS;
}
uint32_t RollbackFirmwareLock(void)
{
return TPM_SUCCESS;
}
uint32_t RollbackKernelRead(uint32_t* version)
{
*version = 0; *version = 0;
return TPM_SUCCESS; return TPM_SUCCESS;
} }
uint32_t RollbackFirmwareWrite(uint32_t version) { uint32_t RollbackKernelWrite(uint32_t version)
{
return TPM_SUCCESS; return TPM_SUCCESS;
} }
uint32_t RollbackFirmwareLock(void) { uint32_t RollbackKernelLock(void)
return TPM_SUCCESS; {
}
uint32_t RollbackKernelRead(uint32_t* version) {
*version = 0;
return TPM_SUCCESS;
}
uint32_t RollbackKernelWrite(uint32_t version) {
return TPM_SUCCESS;
}
uint32_t RollbackKernelLock(void) {
return TPM_SUCCESS; return TPM_SUCCESS;
} }
#else #else
uint32_t RollbackS3Resume(void) { uint32_t RollbackS3Resume(void)
{
uint32_t result; uint32_t result;
RETURN_ON_FAILURE(TlclLibInit()); RETURN_ON_FAILURE(TlclLibInit());
result = TlclResume(); result = TlclResume();
if (result == TPM_E_INVALID_POSTINIT) { if (result == TPM_E_INVALID_POSTINIT) {
/* We're on a platform where the TPM maintains power in S3, so /*
it's already initialized. */ * We're on a platform where the TPM maintains power in S3, so
* it's already initialized.
*/
return TPM_SUCCESS; return TPM_SUCCESS;
} }
return result; return result;
@@ -502,13 +555,15 @@ uint32_t RollbackS3Resume(void) {
uint32_t RollbackFirmwareSetup(int recovery_mode, int is_hw_dev, uint32_t RollbackFirmwareSetup(int recovery_mode, int is_hw_dev,
int disable_dev_request, int disable_dev_request,
int clear_tpm_owner_request, int clear_tpm_owner_request,
int *is_virt_dev, uint32_t *version) { int *is_virt_dev, uint32_t *version)
{
RollbackSpaceFirmware rsf; RollbackSpaceFirmware rsf;
/* Set version to 0 in case we fail */ /* Set version to 0 in case we fail */
*version = 0; *version = 0;
RETURN_ON_FAILURE(SetupTPM(recovery_mode, is_hw_dev, disable_dev_request, RETURN_ON_FAILURE(SetupTPM(recovery_mode, is_hw_dev,
disable_dev_request,
clear_tpm_owner_request, &rsf)); clear_tpm_owner_request, &rsf));
*version = rsf.fw_versions; *version = rsf.fw_versions;
*is_virt_dev = (rsf.flags & FLAG_VIRTUAL_DEV_MODE_ON) ? 1 : 0; *is_virt_dev = (rsf.flags & FLAG_VIRTUAL_DEV_MODE_ON) ? 1 : 0;
@@ -516,7 +571,8 @@ uint32_t RollbackFirmwareSetup(int recovery_mode, int is_hw_dev,
return TPM_SUCCESS; return TPM_SUCCESS;
} }
uint32_t RollbackFirmwareWrite(uint32_t version) { uint32_t RollbackFirmwareWrite(uint32_t version)
{
RollbackSpaceFirmware rsf; RollbackSpaceFirmware rsf;
RETURN_ON_FAILURE(ReadSpaceFirmware(&rsf)); RETURN_ON_FAILURE(ReadSpaceFirmware(&rsf));
@@ -526,20 +582,24 @@ uint32_t RollbackFirmwareWrite(uint32_t version) {
return WriteSpaceFirmware(&rsf); return WriteSpaceFirmware(&rsf);
} }
uint32_t RollbackFirmwareLock(void) { uint32_t RollbackFirmwareLock(void)
{
return TlclSetGlobalLock(); return TlclSetGlobalLock();
} }
uint32_t RollbackKernelRead(uint32_t* version) { uint32_t RollbackKernelRead(uint32_t* version)
{
RollbackSpaceKernel rsk; RollbackSpaceKernel rsk;
uint32_t perms; uint32_t perms;
/* Read the kernel space and verify its permissions. If the kernel /*
* Read the kernel space and verify its permissions. If the kernel
* space has the wrong permission, or it doesn't contain the right * space has the wrong permission, or it doesn't contain the right
* identifier, we give up. This will need to be fixed by the * identifier, we give up. This will need to be fixed by the
* recovery kernel. We have to worry about this because at any time * recovery kernel. We have to worry about this because at any time
* (even with PP turned off) the TPM owner can remove and redefine a * (even with PP turned off) the TPM owner can remove and redefine a
* PP-protected space (but not write to it). */ * PP-protected space (but not write to it).
*/
RETURN_ON_FAILURE(ReadSpaceKernel(&rsk)); RETURN_ON_FAILURE(ReadSpaceKernel(&rsk));
RETURN_ON_FAILURE(TlclGetPermissions(KERNEL_NV_INDEX, &perms)); RETURN_ON_FAILURE(TlclGetPermissions(KERNEL_NV_INDEX, &perms));
if (TPM_NV_PER_PPWRITE != perms || ROLLBACK_SPACE_KERNEL_UID != rsk.uid) if (TPM_NV_PER_PPWRITE != perms || ROLLBACK_SPACE_KERNEL_UID != rsk.uid)
@@ -550,21 +610,22 @@ uint32_t RollbackKernelRead(uint32_t* version) {
return TPM_SUCCESS; return TPM_SUCCESS;
} }
uint32_t RollbackKernelWrite(uint32_t version) { uint32_t RollbackKernelWrite(uint32_t version)
{
RollbackSpaceKernel rsk; RollbackSpaceKernel rsk;
RETURN_ON_FAILURE(ReadSpaceKernel(&rsk)); RETURN_ON_FAILURE(ReadSpaceKernel(&rsk));
VBDEBUG(("TPM: RollbackKernelWrite %x --> %x\n", (int)rsk.kernel_versions, VBDEBUG(("TPM: RollbackKernelWrite %x --> %x\n",
(int)version)); (int)rsk.kernel_versions, (int)version));
rsk.kernel_versions = version; rsk.kernel_versions = version;
return WriteSpaceKernel(&rsk); return WriteSpaceKernel(&rsk);
} }
uint32_t RollbackKernelLock(void) { uint32_t RollbackKernelLock(void)
if (g_rollback_recovery_mode) { {
if (g_rollback_recovery_mode)
return TPM_SUCCESS; return TPM_SUCCESS;
} else { else
return TlclLockPhysicalPresence(); return TlclLockPhysicalPresence();
}
} }
#endif // DISABLE_ROLLBACK_TPM #endif /* DISABLE_ROLLBACK_TPM */

248
tests/rollback_index2_tests.c
View File

@@ -1,4 +1,4 @@
/* Copyright (c) 2012 The Chromium OS Authors. All rights reserved. /* Copyright (c) 2013 The Chromium OS Authors. All rights reserved.
* Use of this source code is governed by a BSD-style license that can be * Use of this source code is governed by a BSD-style license that can be
* found in the LICENSE file. * found in the LICENSE file.
* *
@@ -18,7 +18,8 @@
#include "utility.h" #include "utility.h"
#include "vboot_common.h" #include "vboot_common.h"
/* Buffer to hold accumulated list of calls to mocked Tlcl functions. /*
* Buffer to hold accumulated list of calls to mocked Tlcl functions.
* Each function appends itself to the buffer and updates mock_cnext. * Each function appends itself to the buffer and updates mock_cnext.
* *
* Size of mock_calls[] should be big enough to handle all expected * Size of mock_calls[] should be big enough to handle all expected
@@ -28,13 +29,16 @@
* making all the mock implementations bigger. If this were code used * making all the mock implementations bigger. If this were code used
* outside of unit tests we'd want to do that, but here if we did * outside of unit tests we'd want to do that, but here if we did
* overrun the buffer the worst that's likely to happen is we'll crash * overrun the buffer the worst that's likely to happen is we'll crash
* the test, and crash = failure anyway. */ * the test, and crash = failure anyway.
*/
static char mock_calls[16384]; static char mock_calls[16384];
static char *mock_cnext = mock_calls; static char *mock_cnext = mock_calls;
/* Variables to support mocked error values from Tlcl functions. Each /*
* Variables to support mocked error values from Tlcl functions. Each
* call, mock_count is incremented. If mock_count==fail_at_count, return * call, mock_count is incremented. If mock_count==fail_at_count, return
* fail_with_error instead of the normal return value. */ * fail_with_error instead of the normal return value.
*/
static int mock_count = 0; static int mock_count = 0;
static int fail_at_count = 0; static int fail_at_count = 0;
static uint32_t fail_with_error = TPM_SUCCESS; static uint32_t fail_with_error = TPM_SUCCESS;
@@ -44,7 +48,6 @@ static uint32_t fail_with_error = TPM_SUCCESS;
static int noise_count = 0; /* read/write attempt (zero-based) */ static int noise_count = 0; /* read/write attempt (zero-based) */
static int noise_on[MAX_NOISE_COUNT]; /* calls to inject noise on */ static int noise_on[MAX_NOISE_COUNT]; /* calls to inject noise on */
/* Params / backing store for mocked Tlcl functions. */ /* Params / backing store for mocked Tlcl functions. */
static TPM_PERMANENT_FLAGS mock_pflags; static TPM_PERMANENT_FLAGS mock_pflags;
static RollbackSpaceFirmware mock_rsf; static RollbackSpaceFirmware mock_rsf;
@@ -52,7 +55,8 @@ static RollbackSpaceKernel mock_rsk;
static uint32_t mock_permissions; static uint32_t mock_permissions;
/* Reset the variables for the Tlcl mock functions. */ /* Reset the variables for the Tlcl mock functions. */
static void ResetMocks(int fail_on_call, uint32_t fail_with_err) { static void ResetMocks(int fail_on_call, uint32_t fail_with_err)
{
*mock_calls = 0; *mock_calls = 0;
mock_cnext = mock_calls; mock_cnext = mock_calls;
mock_count = 0; mock_count = 0;
@@ -69,10 +73,11 @@ static void ResetMocks(int fail_on_call, uint32_t fail_with_err) {
/****************************************************************************/ /****************************************************************************/
/* Function to garble data on its way to or from the TPM */ /* Function to garble data on its way to or from the TPM */
static void MaybeInjectNoise(void* data, uint32_t length) { static void MaybeInjectNoise(void *data, uint32_t length)
{
if (noise_count < MAX_NOISE_COUNT && noise_on[noise_count]) { if (noise_count < MAX_NOISE_COUNT && noise_on[noise_count]) {
uint8_t *val = data; uint8_t *val = data;
val[length-1]++; val[length - 1]++;
} }
noise_count++; noise_count++;
} }
@@ -80,38 +85,46 @@ static void MaybeInjectNoise(void* data, uint32_t length) {
/****************************************************************************/ /****************************************************************************/
/* Mocks for tlcl functions which log the calls made to mock_calls[]. */ /* Mocks for tlcl functions which log the calls made to mock_calls[]. */
uint32_t TlclLibInit(void) { uint32_t TlclLibInit(void)
{
mock_cnext += sprintf(mock_cnext, "TlclLibInit()\n"); mock_cnext += sprintf(mock_cnext, "TlclLibInit()\n");
return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS; return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
} }
uint32_t TlclStartup(void) { uint32_t TlclStartup(void)
{
mock_cnext += sprintf(mock_cnext, "TlclStartup()\n"); mock_cnext += sprintf(mock_cnext, "TlclStartup()\n");
return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS; return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
} }
uint32_t TlclResume(void) { uint32_t TlclResume(void)
{
mock_cnext += sprintf(mock_cnext, "TlclResume()\n"); mock_cnext += sprintf(mock_cnext, "TlclResume()\n");
return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS; return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
} }
uint32_t TlclForceClear(void) { uint32_t TlclForceClear(void)
{
mock_cnext += sprintf(mock_cnext, "TlclForceClear()\n"); mock_cnext += sprintf(mock_cnext, "TlclForceClear()\n");
return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS; return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
} }
uint32_t TlclSetEnable(void) { uint32_t TlclSetEnable(void)
{
mock_cnext += sprintf(mock_cnext, "TlclSetEnable()\n"); mock_cnext += sprintf(mock_cnext, "TlclSetEnable()\n");
return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS; return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
} }
uint32_t TlclSetDeactivated(uint8_t flag) { uint32_t TlclSetDeactivated(uint8_t flag)
{
mock_cnext += sprintf(mock_cnext, "TlclSetDeactivated(%d)\n", flag); mock_cnext += sprintf(mock_cnext, "TlclSetDeactivated(%d)\n", flag);
return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS; return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
} }
uint32_t TlclRead(uint32_t index, void* data, uint32_t length) { uint32_t TlclRead(uint32_t index, void* data, uint32_t length)
mock_cnext += sprintf(mock_cnext, "TlclRead(0x%x, %d)\n", index, length); {
mock_cnext += sprintf(mock_cnext, "TlclRead(0x%x, %d)\n",
index, length);
if (FIRMWARE_NV_INDEX == index) { if (FIRMWARE_NV_INDEX == index) {
TEST_EQ(length, sizeof(mock_rsf), "TlclRead rsf size"); TEST_EQ(length, sizeof(mock_rsf), "TlclRead rsf size");
@@ -128,8 +141,10 @@ uint32_t TlclRead(uint32_t index, void* data, uint32_t length) {
return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS; return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
} }
uint32_t TlclWrite(uint32_t index, const void* data, uint32_t length) { uint32_t TlclWrite(uint32_t index, const void *data, uint32_t length)
mock_cnext += sprintf(mock_cnext, "TlclWrite(0x%x, %d)\n", index, length); {
mock_cnext += sprintf(mock_cnext, "TlclWrite(0x%x, %d)\n",
index, length);
if (FIRMWARE_NV_INDEX == index) { if (FIRMWARE_NV_INDEX == index) {
TEST_EQ(length, sizeof(mock_rsf), "TlclWrite rsf size"); TEST_EQ(length, sizeof(mock_rsf), "TlclWrite rsf size");
@@ -144,23 +159,27 @@ uint32_t TlclWrite(uint32_t index, const void* data, uint32_t length) {
return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS; return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
} }
uint32_t TlclDefineSpace(uint32_t index, uint32_t perm, uint32_t size) { uint32_t TlclDefineSpace(uint32_t index, uint32_t perm, uint32_t size)
{
mock_cnext += sprintf(mock_cnext, "TlclDefineSpace(0x%x, 0x%x, %d)\n", mock_cnext += sprintf(mock_cnext, "TlclDefineSpace(0x%x, 0x%x, %d)\n",
index, perm, size); index, perm, size);
return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS; return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
} }
uint32_t TlclSelfTestFull(void) { uint32_t TlclSelfTestFull(void)
{
mock_cnext += sprintf(mock_cnext, "TlclSelfTestFull()\n"); mock_cnext += sprintf(mock_cnext, "TlclSelfTestFull()\n");
return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS; return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
} }
uint32_t TlclContinueSelfTest(void) { uint32_t TlclContinueSelfTest(void)
{
mock_cnext += sprintf(mock_cnext, "TlclContinueSelfTest()\n"); mock_cnext += sprintf(mock_cnext, "TlclContinueSelfTest()\n");
return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS; return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
} }
uint32_t TlclGetPermanentFlags(TPM_PERMANENT_FLAGS* pflags) { uint32_t TlclGetPermanentFlags(TPM_PERMANENT_FLAGS *pflags)
{
mock_cnext += sprintf(mock_cnext, "TlclGetPermanentFlags()\n"); mock_cnext += sprintf(mock_cnext, "TlclGetPermanentFlags()\n");
Memcpy(pflags, &mock_pflags, sizeof(mock_pflags)); Memcpy(pflags, &mock_pflags, sizeof(mock_pflags));
return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS; return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
@@ -168,55 +187,62 @@ uint32_t TlclGetPermanentFlags(TPM_PERMANENT_FLAGS* pflags) {
/* TlclGetFlags() doesn't need mocking; it calls TlclGetPermanentFlags() */ /* TlclGetFlags() doesn't need mocking; it calls TlclGetPermanentFlags() */
uint32_t TlclAssertPhysicalPresence(void) { uint32_t TlclAssertPhysicalPresence(void)
{
mock_cnext += sprintf(mock_cnext, "TlclAssertPhysicalPresence()\n"); mock_cnext += sprintf(mock_cnext, "TlclAssertPhysicalPresence()\n");
return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS; return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
} }
uint32_t TlclFinalizePhysicalPresence(void) { uint32_t TlclFinalizePhysicalPresence(void)
{
mock_cnext += sprintf(mock_cnext, "TlclFinalizePhysicalPresence()\n"); mock_cnext += sprintf(mock_cnext, "TlclFinalizePhysicalPresence()\n");
mock_pflags.physicalPresenceLifetimeLock = 1; mock_pflags.physicalPresenceLifetimeLock = 1;
return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS; return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
} }
uint32_t TlclPhysicalPresenceCMDEnable(void) { uint32_t TlclPhysicalPresenceCMDEnable(void)
{
mock_cnext += sprintf(mock_cnext, "TlclPhysicalPresenceCMDEnable()\n"); mock_cnext += sprintf(mock_cnext, "TlclPhysicalPresenceCMDEnable()\n");
return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS; return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
} }
uint32_t TlclSetNvLocked(void) { uint32_t TlclSetNvLocked(void)
{
mock_cnext += sprintf(mock_cnext, "TlclSetNvLocked()\n"); mock_cnext += sprintf(mock_cnext, "TlclSetNvLocked()\n");
mock_pflags.nvLocked = 1; mock_pflags.nvLocked = 1;
return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS; return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
} }
uint32_t TlclSetGlobalLock(void) { uint32_t TlclSetGlobalLock(void)
{
mock_cnext += sprintf(mock_cnext, "TlclSetGlobalLock()\n"); mock_cnext += sprintf(mock_cnext, "TlclSetGlobalLock()\n");
return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS; return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
} }
uint32_t TlclLockPhysicalPresence(void) { uint32_t TlclLockPhysicalPresence(void)
{
mock_cnext += sprintf(mock_cnext, "TlclLockPhysicalPresence()\n"); mock_cnext += sprintf(mock_cnext, "TlclLockPhysicalPresence()\n");
return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS; return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
} }
uint32_t TlclGetPermissions(uint32_t index, uint32_t* permissions) { uint32_t TlclGetPermissions(uint32_t index, uint32_t* permissions)
{
mock_cnext += sprintf(mock_cnext, "TlclGetPermissions(0x%x)\n", index); mock_cnext += sprintf(mock_cnext, "TlclGetPermissions(0x%x)\n", index);
*permissions = mock_permissions; *permissions = mock_permissions;
return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS; return (++mock_count == fail_at_count) ? fail_with_error : TPM_SUCCESS;
} }
/****************************************************************************/ /****************************************************************************/
/* Tests for CRC errors */ /* Tests for CRC errors */
extern uint32_t ReadSpaceFirmware(RollbackSpaceFirmware* rsf); extern uint32_t ReadSpaceFirmware(RollbackSpaceFirmware *rsf);
extern uint32_t WriteSpaceFirmware(RollbackSpaceFirmware* rsf); extern uint32_t WriteSpaceFirmware(RollbackSpaceFirmware *rsf);
static void CrcTestFirmware(void) { static void CrcTestFirmware(void)
{
RollbackSpaceFirmware rsf; RollbackSpaceFirmware rsf;
/* noise on reading, shouldn't matter here because version == 0 */ /* Noise on reading, shouldn't matter here because version == 0 */
ResetMocks(0, 0); ResetMocks(0, 0);
noise_on[0] = 1; noise_on[0] = 1;
TEST_EQ(ReadSpaceFirmware(&rsf), 0, "ReadSpaceFirmware(), v0"); TEST_EQ(ReadSpaceFirmware(&rsf), 0, "ReadSpaceFirmware(), v0");
@@ -224,8 +250,10 @@ static void CrcTestFirmware(void) {
"TlclRead(0x1007, 10)\n", "TlclRead(0x1007, 10)\n",
"tlcl calls"); "tlcl calls");
/* But if the version >= 2, it will try three times and fail because the CRC /*
* is no good. */ * But if the version >= 2, it will try three times and fail because
* the CRC is no good.
*/
ResetMocks(0, 0); ResetMocks(0, 0);
mock_rsf.struct_version = 2; mock_rsf.struct_version = 2;
TEST_EQ(ReadSpaceFirmware(&rsf), TPM_E_CORRUPTED_STATE, TEST_EQ(ReadSpaceFirmware(&rsf), TPM_E_CORRUPTED_STATE,
@@ -236,12 +264,13 @@ static void CrcTestFirmware(void) {
"TlclRead(0x1007, 10)\n", "TlclRead(0x1007, 10)\n",
"tlcl calls"); "tlcl calls");
/* OTOH, if the CRC is good and some noise happens, it should recover. */ /* If the CRC is good and some noise happens, it should recover. */
ResetMocks(0, 0); ResetMocks(0, 0);
mock_rsf.struct_version = 2; mock_rsf.struct_version = 2;
mock_rsf.crc8 = Crc8(&mock_rsf, offsetof(RollbackSpaceFirmware, crc8)); mock_rsf.crc8 = Crc8(&mock_rsf, offsetof(RollbackSpaceFirmware, crc8));
noise_on[0] = 1; noise_on[0] = 1;
TEST_EQ(ReadSpaceFirmware(&rsf), 0, "ReadSpaceFirmware(), v2, good CRC"); TEST_EQ(ReadSpaceFirmware(&rsf), 0,
"ReadSpaceFirmware(), v2, good CRC");
TEST_STR_EQ(mock_calls, TEST_STR_EQ(mock_calls,
"TlclRead(0x1007, 10)\n" "TlclRead(0x1007, 10)\n"
"TlclRead(0x1007, 10)\n", "TlclRead(0x1007, 10)\n",
@@ -262,7 +291,8 @@ static void CrcTestFirmware(void) {
Memset(&rsf, 0, sizeof(rsf)); Memset(&rsf, 0, sizeof(rsf));
noise_on[1] = 1; noise_on[1] = 1;
noise_on[2] = 1; noise_on[2] = 1;
TEST_EQ(WriteSpaceFirmware(&rsf), 0, "WriteSpaceFirmware(), read noise"); TEST_EQ(WriteSpaceFirmware(&rsf), 0,
"WriteSpaceFirmware(), read noise");
TEST_STR_EQ(mock_calls, TEST_STR_EQ(mock_calls,
"TlclWrite(0x1007, 10)\n" "TlclWrite(0x1007, 10)\n"
"TlclRead(0x1007, 10)\n" "TlclRead(0x1007, 10)\n"
@@ -274,7 +304,8 @@ static void CrcTestFirmware(void) {
ResetMocks(0, 0); ResetMocks(0, 0);
Memset(&rsf, 0, sizeof(rsf)); Memset(&rsf, 0, sizeof(rsf));
noise_on[0] = 1; noise_on[0] = 1;
TEST_EQ(WriteSpaceFirmware(&rsf), 0, "WriteSpaceFirmware(), write noise"); TEST_EQ(WriteSpaceFirmware(&rsf), 0,
"WriteSpaceFirmware(), write noise");
TEST_EQ(mock_rsf.struct_version, 2, "WriteSpaceFirmware(), check v2"); TEST_EQ(mock_rsf.struct_version, 2, "WriteSpaceFirmware(), check v2");
TEST_STR_EQ(mock_calls, TEST_STR_EQ(mock_calls,
"TlclWrite(0x1007, 10)\n" "TlclWrite(0x1007, 10)\n"
@@ -307,13 +338,14 @@ static void CrcTestFirmware(void) {
"tlcl calls"); "tlcl calls");
} }
extern uint32_t ReadSpaceKernel(RollbackSpaceKernel* rsk); extern uint32_t ReadSpaceKernel(RollbackSpaceKernel *rsk);
extern uint32_t WriteSpaceKernel(RollbackSpaceKernel* rsk); extern uint32_t WriteSpaceKernel(RollbackSpaceKernel *rsk);
static void CrcTestKernel(void) { static void CrcTestKernel(void)
{
RollbackSpaceKernel rsk; RollbackSpaceKernel rsk;
/* noise on reading, shouldn't matter here because version == 0 */ /* Noise on reading shouldn't matter here because version == 0 */
ResetMocks(0, 0); ResetMocks(0, 0);
noise_on[0] = 1; noise_on[0] = 1;
TEST_EQ(ReadSpaceKernel(&rsk), 0, "ReadSpaceKernel(), v0"); TEST_EQ(ReadSpaceKernel(&rsk), 0, "ReadSpaceKernel(), v0");
@@ -321,8 +353,10 @@ static void CrcTestKernel(void) {
"TlclRead(0x1008, 13)\n", "TlclRead(0x1008, 13)\n",
"tlcl calls"); "tlcl calls");
/* But if the version >= 2, it will try three times and fail because the CRC /*
* is no good. */ * But if the version >= 2, it will try three times and fail because
* the CRC is no good.
*/
ResetMocks(0, 0); ResetMocks(0, 0);
mock_rsk.struct_version = 2; mock_rsk.struct_version = 2;
TEST_EQ(ReadSpaceKernel(&rsk), TPM_E_CORRUPTED_STATE, TEST_EQ(ReadSpaceKernel(&rsk), TPM_E_CORRUPTED_STATE,
@@ -333,7 +367,7 @@ static void CrcTestKernel(void) {
"TlclRead(0x1008, 13)\n", "TlclRead(0x1008, 13)\n",
"tlcl calls"); "tlcl calls");
/* OTOH, if the CRC is good and some noise happens, it should recover. */ /* If the CRC is good and some noise happens, it should recover. */
ResetMocks(0, 0); ResetMocks(0, 0);
mock_rsk.struct_version = 2; mock_rsk.struct_version = 2;
mock_rsk.crc8 = Crc8(&mock_rsk, offsetof(RollbackSpaceKernel, crc8)); mock_rsk.crc8 = Crc8(&mock_rsk, offsetof(RollbackSpaceKernel, crc8));
@@ -407,7 +441,8 @@ static void CrcTestKernel(void) {
/****************************************************************************/ /****************************************************************************/
/* Tests for misc helper functions */ /* Tests for misc helper functions */
static void MiscTest(void) { static void MiscTest(void)
{
uint8_t buf[8]; uint8_t buf[8];
ResetMocks(0, 0); ResetMocks(0, 0);
@@ -468,7 +503,8 @@ static void MiscTest(void) {
/****************************************************************************/ /****************************************************************************/
/* Tests for one-time initialization */ /* Tests for one-time initialization */
static void OneTimeInitTest(void) { static void OneTimeInitTest(void)
{
RollbackSpaceFirmware rsf; RollbackSpaceFirmware rsf;
RollbackSpaceKernel rsk; RollbackSpaceKernel rsk;
@@ -492,10 +528,12 @@ static void OneTimeInitTest(void) {
"TlclWrite(0x1007, 10)\n" "TlclWrite(0x1007, 10)\n"
"TlclRead(0x1007, 10)\n", "TlclRead(0x1007, 10)\n",
"tlcl calls"); "tlcl calls");
TEST_EQ(mock_rsf.struct_version, ROLLBACK_SPACE_FIRMWARE_VERSION, "rsf ver"); TEST_EQ(mock_rsf.struct_version, ROLLBACK_SPACE_FIRMWARE_VERSION,
"rsf ver");
TEST_EQ(mock_rsf.flags, 0, "rsf flags"); TEST_EQ(mock_rsf.flags, 0, "rsf flags");
TEST_EQ(mock_rsf.fw_versions, 0, "rsf fw_versions"); TEST_EQ(mock_rsf.fw_versions, 0, "rsf fw_versions");
TEST_EQ(mock_rsk.struct_version, ROLLBACK_SPACE_KERNEL_VERSION, "rsk ver"); TEST_EQ(mock_rsk.struct_version, ROLLBACK_SPACE_KERNEL_VERSION,
"rsk ver");
TEST_EQ(mock_rsk.uid, ROLLBACK_SPACE_KERNEL_UID, "rsk uid"); TEST_EQ(mock_rsk.uid, ROLLBACK_SPACE_KERNEL_UID, "rsk uid");
TEST_EQ(mock_rsk.kernel_versions, 0, "rsk kernel_versions"); TEST_EQ(mock_rsk.kernel_versions, 0, "rsk kernel_versions");
@@ -553,7 +591,8 @@ static void OneTimeInitTest(void) {
/****************************************************************************/ /****************************************************************************/
/* Tests for TPM setup */ /* Tests for TPM setup */
static void SetupTpmTest(void) { static void SetupTpmTest(void)
{
RollbackSpaceFirmware rsf; RollbackSpaceFirmware rsf;
/* Complete setup */ /* Complete setup */
@@ -570,7 +609,8 @@ static void SetupTpmTest(void) {
/* If TPM is disabled or deactivated, must enable it */ /* If TPM is disabled or deactivated, must enable it */
ResetMocks(0, 0); ResetMocks(0, 0);
mock_pflags.disable = 1; mock_pflags.disable = 1;
TEST_EQ(SetupTPM(0, 0, 0, 0, &rsf), TPM_E_MUST_REBOOT, "SetupTPM() disabled"); TEST_EQ(SetupTPM(0, 0, 0, 0, &rsf), TPM_E_MUST_REBOOT,
"SetupTPM() disabled");
TEST_STR_EQ(mock_calls, TEST_STR_EQ(mock_calls,
"TlclLibInit()\n" "TlclLibInit()\n"
"TlclStartup()\n" "TlclStartup()\n"
@@ -593,7 +633,7 @@ static void SetupTpmTest(void) {
"TlclSetDeactivated(0)\n", "TlclSetDeactivated(0)\n",
"tlcl calls"); "tlcl calls");
/* If physical presence command isn't enabled, should try to enable it */ /* If physical presence command isn't enabled, try to enable it */
ResetMocks(3, TPM_E_IOERROR); ResetMocks(3, TPM_E_IOERROR);
TEST_EQ(SetupTPM(0, 0, 0, 0, &rsf), 0, "SetupTPM() pp cmd"); TEST_EQ(SetupTPM(0, 0, 0, 0, &rsf), 0, "SetupTPM() pp cmd");
TEST_STR_EQ(mock_calls, TEST_STR_EQ(mock_calls,
@@ -658,7 +698,8 @@ static void SetupTpmTest(void) {
"TlclWrite(0x1007, 10)\n" "TlclWrite(0x1007, 10)\n"
"TlclRead(0x1007, 10)\n", "TlclRead(0x1007, 10)\n",
"tlcl calls"); "tlcl calls");
TEST_EQ(mock_rsf.flags, FLAG_LAST_BOOT_DEVELOPER, "fw space flags to dev 1"); TEST_EQ(mock_rsf.flags, FLAG_LAST_BOOT_DEVELOPER,
"fw space flags to dev 1");
ResetMocks(0, 0); ResetMocks(0, 0);
mock_rsf.flags = FLAG_LAST_BOOT_DEVELOPER; mock_rsf.flags = FLAG_LAST_BOOT_DEVELOPER;
@@ -691,13 +732,32 @@ static void SetupTpmTest(void) {
"TlclSetDeactivated(0)\n", "TlclSetDeactivated(0)\n",
"tlcl calls"); "tlcl calls");
/* Note: SetupTPM() recovery_mode parameter sets a global flag in /* Handle request to clear virtual dev switch */
* rollback_index.c; this is tested along with RollbackKernelLock() below. */ ResetMocks(0, 0);
mock_rsf.flags = FLAG_VIRTUAL_DEV_MODE_ON | FLAG_LAST_BOOT_DEVELOPER;
TEST_EQ(SetupTPM(0, 0, 1, 0, &rsf), 0, "SetupTPM() clear virtual dev");
TEST_EQ(mock_rsf.flags, 0, "Clear virtual dev");
/* If virtual dev switch is on, that should set last boot developer */
ResetMocks(0, 0);
mock_rsf.flags = FLAG_VIRTUAL_DEV_MODE_ON;
SetupTPM(0, 0, 0, 0, &rsf);
TEST_EQ(mock_rsf.flags,
FLAG_VIRTUAL_DEV_MODE_ON | FLAG_LAST_BOOT_DEVELOPER,
"virtual dev sets last boot");
/*
* Note: SetupTPM() recovery_mode parameter sets a global flag in
* rollback_index.c; this is tested along with RollbackKernelLock()
* below.
*/
} }
/****************************************************************************/ /****************************************************************************/
/* Tests for RollbackFirmware() calls */ /* Tests for RollbackFirmware() calls */
static void RollbackFirmwareTest(void) {
static void RollbackFirmwareTest(void)
{
uint32_t version; uint32_t version;
int dev_mode; int dev_mode;
@@ -706,8 +766,8 @@ static void RollbackFirmwareTest(void) {
dev_mode = 0; dev_mode = 0;
version = 123; version = 123;
mock_rsf.fw_versions = 0x12345678; mock_rsf.fw_versions = 0x12345678;
TEST_EQ(RollbackFirmwareSetup(0, 0, dev_mode, 0, &dev_mode, &version), 0, TEST_EQ(RollbackFirmwareSetup(0, 0, dev_mode, 0, &dev_mode, &version),
"RollbackFirmwareSetup()"); 0, "RollbackFirmwareSetup()");
TEST_STR_EQ(mock_calls, TEST_STR_EQ(mock_calls,
"TlclLibInit()\n" "TlclLibInit()\n"
"TlclStartup()\n" "TlclStartup()\n"
@@ -733,8 +793,8 @@ static void RollbackFirmwareTest(void) {
/* Developer mode flag gets passed properly */ /* Developer mode flag gets passed properly */
ResetMocks(0, 0); ResetMocks(0, 0);
dev_mode = 1; dev_mode = 1;
TEST_EQ(RollbackFirmwareSetup(0, dev_mode, 0, 0, &dev_mode, &version), 0, TEST_EQ(RollbackFirmwareSetup(0, dev_mode, 0, 0, &dev_mode, &version),
"RollbackFirmwareSetup() to dev"); 0, "RollbackFirmwareSetup() to dev");
TEST_STR_EQ(mock_calls, TEST_STR_EQ(mock_calls,
"TlclLibInit()\n" "TlclLibInit()\n"
"TlclStartup()\n" "TlclStartup()\n"
@@ -747,13 +807,14 @@ static void RollbackFirmwareTest(void) {
"TlclWrite(0x1007, 10)\n" "TlclWrite(0x1007, 10)\n"
"TlclRead(0x1007, 10)\n", "TlclRead(0x1007, 10)\n",
"tlcl calls"); "tlcl calls");
TEST_EQ(mock_rsf.flags, FLAG_LAST_BOOT_DEVELOPER, "fw space flags to dev 2"); TEST_EQ(mock_rsf.flags, FLAG_LAST_BOOT_DEVELOPER,
"fw space flags to dev 2");
/* So does clear-TPM request */ /* So does clear-TPM request */
ResetMocks(0, 0); ResetMocks(0, 0);
dev_mode = 0; dev_mode = 0;
TEST_EQ(RollbackFirmwareSetup(0, dev_mode, 0, 1, &dev_mode, &version), 0, TEST_EQ(RollbackFirmwareSetup(0, dev_mode, 0, 1, &dev_mode, &version),
"RollbackFirmwareSetup() clear owner"); 0, "RollbackFirmwareSetup() clear owner");
TEST_STR_EQ(mock_calls, TEST_STR_EQ(mock_calls,
"TlclLibInit()\n" "TlclLibInit()\n"
"TlclStartup()\n" "TlclStartup()\n"
@@ -767,8 +828,10 @@ static void RollbackFirmwareTest(void) {
/* Test write */ /* Test write */
ResetMocks(0, 0); ResetMocks(0, 0);
TEST_EQ(RollbackFirmwareWrite(0xBEAD1234), 0, "RollbackFirmwareWrite()"); TEST_EQ(RollbackFirmwareWrite(0xBEAD1234), 0,
TEST_EQ(mock_rsf.fw_versions, 0xBEAD1234, "RollbackFirmwareWrite() version"); "RollbackFirmwareWrite()");
TEST_EQ(mock_rsf.fw_versions, 0xBEAD1234,
"RollbackFirmwareWrite() version");
TEST_STR_EQ(mock_calls, TEST_STR_EQ(mock_calls,
"TlclRead(0x1007, 10)\n" "TlclRead(0x1007, 10)\n"
"TlclWrite(0x1007, 10)\n" "TlclWrite(0x1007, 10)\n"
@@ -779,6 +842,24 @@ static void RollbackFirmwareTest(void) {
TEST_EQ(RollbackFirmwareWrite(123), TPM_E_IOERROR, TEST_EQ(RollbackFirmwareWrite(123), TPM_E_IOERROR,
"RollbackFirmwareWrite() error"); "RollbackFirmwareWrite() error");
/* Test setting virtual dev mode */
ResetMocks(0, 0);
TEST_EQ(SetVirtualDevMode(1), 0, "SetVirtualDevMode(1)");
TEST_EQ(mock_rsf.flags, FLAG_VIRTUAL_DEV_MODE_ON, "Virtual dev on");
TEST_STR_EQ(mock_calls,
"TlclRead(0x1007, 10)\n"
"TlclWrite(0x1007, 10)\n"
"TlclRead(0x1007, 10)\n",
"tlcl calls");
ResetMocks(0, 0);
TEST_EQ(SetVirtualDevMode(0), 0, "SetVirtualDevMode(0)");
TEST_EQ(mock_rsf.flags, 0, "Virtual dev off");
TEST_STR_EQ(mock_calls,
"TlclRead(0x1007, 10)\n"
"TlclWrite(0x1007, 10)\n"
"TlclRead(0x1007, 10)\n",
"tlcl calls");
/* Test lock */ /* Test lock */
ResetMocks(0, 0); ResetMocks(0, 0);
TEST_EQ(RollbackFirmwareLock(), 0, "RollbackFirmwareLock()"); TEST_EQ(RollbackFirmwareLock(), 0, "RollbackFirmwareLock()");
@@ -794,13 +875,16 @@ static void RollbackFirmwareTest(void) {
/****************************************************************************/ /****************************************************************************/
/* Tests for RollbackKernel() calls */ /* Tests for RollbackKernel() calls */
static void RollbackKernelTest(void) { static void RollbackKernelTest(void)
{
RollbackSpaceFirmware rsf; RollbackSpaceFirmware rsf;
uint32_t version = 0; uint32_t version = 0;
/* RollbackKernel*() functions use a global flag inside /*
* rollback_index.c based on recovery mode, which is set by * RollbackKernel*() functions use a global flag inside
* SetupTPM(). Clear the flag for the first set of tests. */ * rollback_index.c based on recovery mode, which is set by SetupTPM().
* Clear the flag for the first set of tests.
*/
TEST_EQ(SetupTPM(0, 0, 0, 0, &rsf), 0, "SetupTPM()"); TEST_EQ(SetupTPM(0, 0, 0, 0, &rsf), 0, "SetupTPM()");
/* Normal read */ /* Normal read */
@@ -859,7 +943,8 @@ static void RollbackKernelTest(void) {
"tlcl calls"); "tlcl calls");
ResetMocks(1, TPM_E_IOERROR); ResetMocks(1, TPM_E_IOERROR);
TEST_EQ(RollbackKernelLock(), TPM_E_IOERROR, "RollbackKernelLock() error"); TEST_EQ(RollbackKernelLock(), TPM_E_IOERROR,
"RollbackKernelLock() error");
/* Test lock with recovery on; shouldn't lock PP */ /* Test lock with recovery on; shouldn't lock PP */
SetupTPM(1, 0, 0, 0, &rsf); SetupTPM(1, 0, 0, 0, &rsf);
@@ -869,8 +954,8 @@ static void RollbackKernelTest(void) {
} }
/* Tests for RollbackS3Resume() */ /* Tests for RollbackS3Resume() */
static void RollbackS3ResumeTest(void) { static void RollbackS3ResumeTest(void)
{
ResetMocks(0, 0); ResetMocks(0, 0);
TEST_EQ(RollbackS3Resume(), 0, "RollbackS3Resume()"); TEST_EQ(RollbackS3Resume(), 0, "RollbackS3Resume()");
TEST_STR_EQ(mock_calls, TEST_STR_EQ(mock_calls,
@@ -884,15 +969,15 @@ static void RollbackS3ResumeTest(void) {
/* Resume with other error */ /* Resume with other error */
ResetMocks(2, TPM_E_IOERROR); ResetMocks(2, TPM_E_IOERROR);
TEST_EQ(RollbackS3Resume(), TPM_E_IOERROR, "RollbackS3Resume() other error"); TEST_EQ(RollbackS3Resume(), TPM_E_IOERROR,
"RollbackS3Resume() other error");
} }
/* disable MSVC warnings on unused arguments */ /* disable MSVC warnings on unused arguments */
__pragma(warning (disable: 4100)) __pragma(warning (disable: 4100))
int main(int argc, char* argv[]) { int main(int argc, char* argv[])
int error_code = 0; {
CrcTestFirmware(); CrcTestFirmware();
CrcTestKernel(); CrcTestKernel();
MiscTest(); MiscTest();
@@ -902,8 +987,5 @@ int main(int argc, char* argv[]) {
RollbackKernelTest(); RollbackKernelTest();
RollbackS3ResumeTest(); RollbackS3ResumeTest();
if (!gTestSuccess) return gTestSuccess ? 0 : 255;
error_code = 255;
return error_code;
} }

45
tests/rollback_index3_tests.c Normal file
View File

@@ -0,0 +1,45 @@
/* Copyright (c) 2013 The Chromium OS Authors. All rights reserved.
* Use of this source code is governed by a BSD-style license that can be
* found in the LICENSE file.
*
* Tests for do-nothing rollback_index functions with disabled TPM
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#define _STUB_IMPLEMENTATION_ /* So we can use memset() ourselves */
#include "rollback_index.h"
#include "test_common.h"
/* disable MSVC warnings on unused arguments */
__pragma(warning (disable: 4100))
int main(int argc, char* argv[])
{
int is_virt_dev;
uint32_t version;
TEST_EQ(RollbackS3Resume(), 0, "RollbackS3Resume()");
is_virt_dev = 1;
version = 1;
TEST_EQ(RollbackFirmwareSetup(0, 0, 0, 0, &is_virt_dev, &version),
0, "RollbackFirmwareSetup()");
TEST_EQ(is_virt_dev, 0, "rfs is_virt_dev");
TEST_EQ(version, 0, "rfs version");
TEST_EQ(RollbackFirmwareWrite(0), 0, "RollbackFirmwareWrite()");
TEST_EQ(RollbackFirmwareLock(), 0, "RollbackFirmwareLock()");
version = 1;
TEST_EQ(RollbackKernelRead(&version), 0, "RollbackKernelRead()");
TEST_EQ(version, 0, "rkr version");
TEST_EQ(RollbackKernelWrite(0), 0, "RollbackKernelWrite()");
TEST_EQ(RollbackKernelLock(), 0, "RollbackKernelLock()");
return gTestSuccess ? 0 : 255;
}