Files
OpenCellular/tests/tpm_bootmode_tests.c
Bill Richardson f4f395e1ca Extend HWID digest into PCR1 (GBB v1.2 only)
GBB header v1.2 adds a digest of the HWID string to the blob (and
maintains it when updated with the current futility/gbb_utility).

This CL causes VbSelectFirmware() to extend PCR1 with that HWID
digest (only for GBB header v1.2 and later, of course).

Tests are updated.

This also adds a "pcr" command to futility to help determine that
the change is working on the hardware (adds 4K bytes or fewer to
the size of the executable).

BUG=chromium:415714
BRANCH=ToT (and maybe others?)
TEST=make runtests, manual install on HW

To test on hardware, build and update a system with this change
(both the disk image and the RO firmware).

NOTE: The BIOS image must be built in a chroot that is using the
current version of futility. You may need to update your chroot
if your BIOS image still produces v1.1 GBB headers. Check with:

  futility show <firmware_image.bin> | grep -B1 'digest:'

Boot the new system with a new test image, then follow these steps:

Read the BIOS:

  # flashrom -r /tmp/bios.bin

Make sure the GBB has a valid digest for the HWID.

  # futility show /tmp/bios.bin | grep -B1 'digest:'
    HWID:                SAMUS TEST 8028
     digest:             4172d24f40bf72cc0ab8...  <valid>
  #

Extract only the sha1sum-sized part of the HWID digest:

  # futility show /tmp/bios.bin | awk '/digest:/ {print $2}' | colrm 41
  4172d24f40bf72cc0ab878b4c589b8fe9cf4405e
  #

Simulate extending that value in a PCR using the futility "pcr"
command:

  # futility pcr 4172d24f40bf72cc0ab878b4c589b8fe9cf4405e
  PCR: 0000000000000000000000000000000000000000
     + 4172d24f40bf72cc0ab878b4c589b8fe9cf4405e
  PCR: b6e5ffd2d898a7b15236ad22ca25f53ac1f40776
  #

Finally, look at the value of PCR1. It should match the last line
of the futility pcr output:

  # head /sys/class/misc/tpm0/device/pcrs | grep PCR-01
  PCR-01: B6 E5 FF D2 D8 98 A7 B1 52 36 AD 22 CA 25 F5 3A C1 F4 07 76
  #

Change-Id: I09cf855f1a24616cc1a9ddb676670edbc76827d2
Signed-off-by: Bill Richardson <wfrichar@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/226408
Reviewed-by: Darren Krahn <dkrahn@chromium.org>
Reviewed-by: Randall Spangler <rspangler@chromium.org>
2014-10-31 20:55:28 +00:00

153 lines
4.1 KiB
C

/* Copyright (c) 2011 The Chromium OS Authors. All rights reserved.
* Use of this source code is governed by a BSD-style license that can be
* found in the LICENSE file.
*
* Tests for tpm_bootmode functions
*/
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#define _STUB_IMPLEMENTATION_ /* So we can use memset() ourselves */
#include "test_common.h"
#include "utility.h"
#include "tpm_bootmode.h"
extern const char* kBootStateSHA1Digests[];
/* Last in_digest passed to TlclExtend() for each PCR */
static const uint8_t *last_in[20];
/* Return value to pass for TlclExtend() */
static uint32_t extend_returns;
/* How many calls to TlclExtend() should one SetTPMBootModeState() make? */
static int expected_extend_count;
/* How many did we get? */
static int actual_extend_count;
static GoogleBinaryBlockHeader gbb_v1 = {
.major_version = GBB_MAJOR_VER,
.minor_version = 1,
};
static GoogleBinaryBlockHeader gbb_v2 = {
.major_version = GBB_MAJOR_VER,
.minor_version = 2,
.hwid_digest = {1, 2, 3, 4,},
};
/* Mocked TlclExtend() function for testing */
uint32_t TlclExtend(int pcr_num, const uint8_t *in_digest,
uint8_t *out_digest)
{
/* Should be using correct pcr */
TEST_EQ(pcr_num, actual_extend_count, "TlclExtend pcr_num");
last_in[actual_extend_count] = in_digest;
actual_extend_count++;
return extend_returns;
}
/* Test setting TPM boot mode state */
static void BootStateTest(void)
{
int recdev;
int flags;
int index;
char what[128];
/* Test all permutations of developer and recovery mode */
for (recdev = 0; recdev < 4; recdev++) {
/* Exhaustively test all permutations of key block flags
* currently defined in vboot_struct.h (KEY_BLOCK_FLAG_*) */
for (flags = 0; flags < 16; flags++) {
index = recdev * 3;
if (6 == flags)
index += 2;
else if (7 == flags)
index += 1;
/* Passing a null pointer for GBB */
memset(last_in, 0, sizeof(last_in));
actual_extend_count = 0;
expected_extend_count = 1;
TEST_EQ(SetTPMBootModeState(recdev & 2, recdev & 1,
flags, 0), 0,
"SetTPMBootModeState return (gbb0)");
snprintf(what, sizeof(what),
"SetTPMBootModeState %d, 0x%x (gbb0)",
recdev, flags);
TEST_PTR_EQ(last_in[0],
kBootStateSHA1Digests[index], what);
TEST_EQ(expected_extend_count, actual_extend_count,
"Expected TlclExtend call count (gbb0)");
snprintf(what, sizeof(what),
"SetTPMBootModeState %d, 0x%x (gbb0) PCR1",
recdev, flags);
TEST_PTR_EQ(last_in[1], NULL, what);
/* GBB v1.1 - should be exactly the same */
memset(last_in, 0, sizeof(last_in));
actual_extend_count = 0;
expected_extend_count = 1;
TEST_EQ(SetTPMBootModeState(recdev & 2, recdev & 1,
flags, &gbb_v1), 0,
"SetTPMBootModeState return (gbb1)");
snprintf(what, sizeof(what),
"SetTPMBootModeState %d, 0x%x (gbb1)",
recdev, flags);
TEST_PTR_EQ(last_in[0],
kBootStateSHA1Digests[index], what);
TEST_EQ(expected_extend_count, actual_extend_count,
"Expected TlclExtend call count (gbb1)");
snprintf(what, sizeof(what),
"SetTPMBootModeState %d, 0x%x (gbb1) PCR1",
recdev, flags);
TEST_PTR_EQ(last_in[1], NULL, what);
/* GBB v1.2 - should extend PCR1 with HWID digest */
memset(last_in, 0, sizeof(last_in));
actual_extend_count = 0;
expected_extend_count = 2;
TEST_EQ(SetTPMBootModeState(recdev & 2, recdev & 1,
flags, &gbb_v2), 0,
"SetTPMBootModeState return (gbb2)");
snprintf(what, sizeof(what),
"SetTPMBootModeState %d, 0x%x (gbb2)",
recdev, flags);
TEST_PTR_EQ(last_in[0],
kBootStateSHA1Digests[index], what);
TEST_EQ(expected_extend_count, actual_extend_count,
"Expected TlclExtend call count (gbb2)");
snprintf(what, sizeof(what),
"SetTPMBootModeState %d, 0x%x (gbb2) PCR1",
recdev, flags);
TEST_PTR_EQ(last_in[1], gbb_v2.hwid_digest, what);
}
}
extend_returns = 1;
actual_extend_count = 0;
expected_extend_count = 1;
TEST_EQ(SetTPMBootModeState(0, 0, 0, 0), 1,
"SetTPMBootModeState error");
}
int main(int argc, char *argv[])
{
int error_code = 0;
BootStateTest();
if (!gTestSuccess)
error_code = 255;
return error_code;
}