OLD | NEW |
1 /* Copyright (c) 2010 The Chromium OS Authors. All rights reserved. | 1 /* Copyright (c) 2010 The Chromium OS Authors. All rights reserved. |
2 * Use of this source code is governed by a BSD-style license that can be | 2 * Use of this source code is governed by a BSD-style license that can be |
3 * found in the LICENSE file. | 3 * found in the LICENSE file. |
4 */ | 4 */ |
5 | 5 |
6 /* Exhaustive testing for correctness and integrity of TPM locking code from | 6 /* Exhaustive testing for correctness and integrity of TPM locking code from |
7 * all interesting initial conditions. | 7 * all interesting initial conditions. |
8 * | 8 * |
9 * This program iterates through a large number of initial states of the TPM at | 9 * This program iterates through a large number of initial states of the TPM at |
10 * power on, and executes the code related to initialing the TPM and managing | 10 * power on, and executes the code related to initialing the TPM and managing |
(...skipping 137 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
148 static void reboot(void) { | 148 static void reboot(void) { |
149 int status; | 149 int status; |
150 Log("requesting reboot"); | 150 Log("requesting reboot"); |
151 status = system("/sbin/reboot"); | 151 status = system("/sbin/reboot"); |
152 if (status != 0) { | 152 if (status != 0) { |
153 Log("reboot failed with status %d", status); | 153 Log("reboot failed with status %d", status); |
154 exit(1); | 154 exit(1); |
155 } | 155 } |
156 } | 156 } |
157 | 157 |
| 158 static uint32_t SafeWrite(uint32_t index, uint8_t* data, uint32_t length) { |
| 159 uint32_t result = TlclWrite(index, data, length); |
| 160 if (result == TPM_E_MAXNVWRITES) { |
| 161 RETURN_ON_FAILURE(TPMClearAndReenable()); |
| 162 result = TlclWrite(index, data, length); |
| 163 tpm_was_just_cleared = 0; |
| 164 } |
| 165 return result; |
| 166 } |
| 167 |
| 168 static uint32_t SafeDefineSpace(uint32_t index, uint32_t perm, uint32_t size) { |
| 169 uint32_t result = TlclDefineSpace(index, perm, size); |
| 170 if (result == TPM_E_MAXNVWRITES) { |
| 171 RETURN_ON_FAILURE(TPMClearAndReenable()); |
| 172 result = TlclDefineSpace(index, perm, size); |
| 173 tpm_was_just_cleared = 0; |
| 174 } |
| 175 return result; |
| 176 } |
| 177 |
158 static void RollbackTest_SaveState(FILE* file) { | 178 static void RollbackTest_SaveState(FILE* file) { |
159 rewind(file); | 179 rewind(file); |
160 fprintf(file, RBTS_format, | 180 fprintf(file, RBTS_format, |
161 RBTS.advancing, | 181 RBTS.advancing, |
162 RBTS.owned, | 182 RBTS.owned, |
163 RBTS.disable, | 183 RBTS.disable, |
164 RBTS.deactivated, | 184 RBTS.deactivated, |
165 RBTS.writecount, | 185 RBTS.writecount, |
166 RBTS.TPM_IS_INITIALIZED_exists, | 186 RBTS.TPM_IS_INITIALIZED_exists, |
167 RBTS.KERNEL_MUST_USE_BACKUP, | 187 RBTS.KERNEL_MUST_USE_BACKUP, |
(...skipping 128 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
296 } | 316 } |
297 return TPM_SUCCESS; | 317 return TPM_SUCCESS; |
298 } | 318 } |
299 | 319 |
300 /* Removes or creates the TPM_IS_INITIALIZED space. | 320 /* Removes or creates the TPM_IS_INITIALIZED space. |
301 */ | 321 */ |
302 static uint32_t RollbackTest_AdjustIsInitialized(void) { | 322 static uint32_t RollbackTest_AdjustIsInitialized(void) { |
303 int initialized; | 323 int initialized; |
304 RETURN_ON_FAILURE(GetSpacesInitialized(&initialized)); | 324 RETURN_ON_FAILURE(GetSpacesInitialized(&initialized)); |
305 if (RBTS.TPM_IS_INITIALIZED_exists && !initialized) { | 325 if (RBTS.TPM_IS_INITIALIZED_exists && !initialized) { |
306 RETURN_ON_FAILURE(TlclDefineSpace(TPM_IS_INITIALIZED_NV_INDEX, | 326 RETURN_ON_FAILURE(SafeDefineSpace(TPM_IS_INITIALIZED_NV_INDEX, |
307 TPM_NV_PER_PPWRITE, sizeof(uint32_t))); | 327 TPM_NV_PER_PPWRITE, sizeof(uint32_t))); |
308 } | 328 } |
309 if (!RBTS.TPM_IS_INITIALIZED_exists && initialized) { | 329 if (!RBTS.TPM_IS_INITIALIZED_exists && initialized) { |
310 RETURN_ON_FAILURE(RollbackTest_RemoveSpace(TPM_IS_INITIALIZED_NV_INDEX)); | 330 RETURN_ON_FAILURE(RollbackTest_RemoveSpace(TPM_IS_INITIALIZED_NV_INDEX)); |
311 } | 331 } |
312 return TPM_SUCCESS; | 332 return TPM_SUCCESS; |
313 } | 333 } |
314 | 334 |
315 /* Sets or clears KERNEL_MUST_USE_BACKUP. | 335 /* Sets or clears KERNEL_MUST_USE_BACKUP. |
316 */ | 336 */ |
317 static uint32_t RollbackTest_AdjustMustUseBackup(void) { | 337 static uint32_t RollbackTest_AdjustMustUseBackup(void) { |
318 uint32_t must_use_backup; | 338 uint32_t must_use_backup; |
319 RETURN_ON_FAILURE(TlclRead(KERNEL_MUST_USE_BACKUP_NV_INDEX, | 339 RETURN_ON_FAILURE(TlclRead(KERNEL_MUST_USE_BACKUP_NV_INDEX, |
320 (uint8_t*) &must_use_backup, | 340 (uint8_t*) &must_use_backup, |
321 sizeof(must_use_backup))); | 341 sizeof(must_use_backup))); |
322 if (RBTS.KERNEL_MUST_USE_BACKUP != must_use_backup) { | 342 if (RBTS.KERNEL_MUST_USE_BACKUP != must_use_backup) { |
323 RETURN_ON_FAILURE(TlclWrite(KERNEL_MUST_USE_BACKUP_NV_INDEX, | 343 RETURN_ON_FAILURE(SafeWrite(KERNEL_MUST_USE_BACKUP_NV_INDEX, |
324 (uint8_t*) &must_use_backup, | 344 (uint8_t*) &must_use_backup, |
325 sizeof(must_use_backup))); | 345 sizeof(must_use_backup))); |
326 } | 346 } |
327 return TPM_SUCCESS; | 347 return TPM_SUCCESS; |
328 } | 348 } |
329 | 349 |
330 /* Adjusts KERNEL_VERSIONS space. | 350 /* Adjusts KERNEL_VERSIONS space. |
331 */ | 351 */ |
332 static uint32_t RollbackTest_AdjustKernelVersions(int* wrong_value) { | 352 static uint32_t RollbackTest_AdjustKernelVersions(int* wrong_value) { |
333 uint8_t kdata[KERNEL_SPACE_SIZE]; | 353 uint8_t kdata[KERNEL_SPACE_SIZE]; |
334 int exists; | 354 int exists; |
335 uint32_t result; | 355 uint32_t result; |
336 | 356 |
337 result = TlclRead(KERNEL_VERSIONS_NV_INDEX, kdata, sizeof(kdata)); | 357 result = TlclRead(KERNEL_VERSIONS_NV_INDEX, kdata, sizeof(kdata)); |
338 if (result != TPM_SUCCESS && result != TPM_E_BADINDEX) { | 358 if (result != TPM_SUCCESS && result != TPM_E_BADINDEX) { |
339 return result; | 359 return result; |
340 } | 360 } |
341 *wrong_value = Memcmp(kdata + sizeof(uint32_t), KERNEL_SPACE_UID, | 361 *wrong_value = Memcmp(kdata + sizeof(uint32_t), KERNEL_SPACE_UID, |
342 KERNEL_SPACE_UID_SIZE); /* for later use */ | 362 KERNEL_SPACE_UID_SIZE); /* for later use */ |
343 exists = result == TPM_SUCCESS; | 363 exists = result == TPM_SUCCESS; |
344 if (RBTS.KERNEL_VERSIONS_exists && !exists) { | 364 if (RBTS.KERNEL_VERSIONS_exists && !exists) { |
345 RETURN_ON_FAILURE(TlclDefineSpace(KERNEL_VERSIONS_NV_INDEX, | 365 RETURN_ON_FAILURE(SafeDefineSpace(KERNEL_VERSIONS_NV_INDEX, |
346 TPM_NV_PER_PPWRITE, KERNEL_SPACE_SIZE)); | 366 TPM_NV_PER_PPWRITE, KERNEL_SPACE_SIZE)); |
347 } | 367 } |
348 if (!RBTS.KERNEL_VERSIONS_exists && exists) { | 368 if (!RBTS.KERNEL_VERSIONS_exists && exists) { |
349 RETURN_ON_FAILURE(RollbackTest_RemoveSpace(KERNEL_VERSIONS_NV_INDEX)); | 369 RETURN_ON_FAILURE(RollbackTest_RemoveSpace(KERNEL_VERSIONS_NV_INDEX)); |
350 } | 370 } |
351 return TPM_SUCCESS; | 371 return TPM_SUCCESS; |
352 } | 372 } |
353 | 373 |
354 /* Adjusts permissions of KERNEL_VERSIONS space. Updates |wrong_value| to | 374 /* Adjusts permissions of KERNEL_VERSIONS space. Updates |wrong_value| to |
355 * reflect that currently the space contains the wrong value (i.e. does not | 375 * reflect that currently the space contains the wrong value (i.e. does not |
356 * contain the GRWL identifier). | 376 * contain the GRWL identifier). |
357 */ | 377 */ |
358 static uint32_t RollbackTest_AdjustKernelPermissions(int* wrong_value) { | 378 static uint32_t RollbackTest_AdjustKernelPermissions(int* wrong_value) { |
359 uint32_t perms; | 379 uint32_t perms; |
360 | 380 |
361 /* Wrong permissions */ | 381 /* Wrong permissions */ |
362 RETURN_ON_FAILURE(TlclGetPermissions(KERNEL_VERSIONS_NV_INDEX, &perms)); | 382 RETURN_ON_FAILURE(TlclGetPermissions(KERNEL_VERSIONS_NV_INDEX, &perms)); |
363 if (RBTS.KERNEL_VERSIONS_wrong_permissions && perms == TPM_NV_PER_PPWRITE) { | 383 if (RBTS.KERNEL_VERSIONS_wrong_permissions && perms == TPM_NV_PER_PPWRITE) { |
364 /* Redefines with wrong permissions. */ | 384 /* Redefines with wrong permissions. */ |
365 RETURN_ON_FAILURE(RollbackTest_RemoveSpace(KERNEL_VERSIONS_NV_INDEX)); | 385 RETURN_ON_FAILURE(RollbackTest_RemoveSpace(KERNEL_VERSIONS_NV_INDEX)); |
366 RETURN_ON_FAILURE(TlclDefineSpace(KERNEL_VERSIONS_NV_INDEX, | 386 RETURN_ON_FAILURE(SafeDefineSpace(KERNEL_VERSIONS_NV_INDEX, |
367 TPM_NV_PER_PPWRITE | | 387 TPM_NV_PER_PPWRITE | |
368 TPM_NV_PER_GLOBALLOCK, | 388 TPM_NV_PER_GLOBALLOCK, |
369 KERNEL_SPACE_SIZE)); | 389 KERNEL_SPACE_SIZE)); |
370 *wrong_value = 1; | 390 *wrong_value = 1; |
371 } | 391 } |
372 if (!RBTS.KERNEL_VERSIONS_wrong_permissions && | 392 if (!RBTS.KERNEL_VERSIONS_wrong_permissions && |
373 perms != TPM_NV_PER_PPWRITE) { | 393 perms != TPM_NV_PER_PPWRITE) { |
374 /* Redefines with right permissions. */ | 394 /* Redefines with right permissions. */ |
375 RETURN_ON_FAILURE(TlclDefineSpace(KERNEL_VERSIONS_NV_INDEX, | 395 RETURN_ON_FAILURE(SafeDefineSpace(KERNEL_VERSIONS_NV_INDEX, |
376 TPM_NV_PER_PPWRITE, 0)); | 396 TPM_NV_PER_PPWRITE, 0)); |
377 RETURN_ON_FAILURE(TlclDefineSpace(KERNEL_VERSIONS_NV_INDEX, | 397 RETURN_ON_FAILURE(SafeDefineSpace(KERNEL_VERSIONS_NV_INDEX, |
378 TPM_NV_PER_PPWRITE, | 398 TPM_NV_PER_PPWRITE, |
379 KERNEL_SPACE_SIZE)); | 399 KERNEL_SPACE_SIZE)); |
380 *wrong_value = 1; | 400 *wrong_value = 1; |
381 } | 401 } |
382 return TPM_SUCCESS; | 402 return TPM_SUCCESS; |
383 } | 403 } |
384 | 404 |
385 static uint32_t RollbackTest_AdjustKernelValue(int wrong_value) { | 405 static uint32_t RollbackTest_AdjustKernelValue(int wrong_value) { |
386 if (!RBTS.KERNEL_VERSIONS_wrong_value && wrong_value) { | 406 if (!RBTS.KERNEL_VERSIONS_wrong_value && wrong_value) { |
387 RETURN_ON_FAILURE(TlclWrite(KERNEL_VERSIONS_NV_INDEX, | 407 RETURN_ON_FAILURE(SafeWrite(KERNEL_VERSIONS_NV_INDEX, |
388 KERNEL_SPACE_INIT_DATA, KERNEL_SPACE_SIZE)); | 408 KERNEL_SPACE_INIT_DATA, KERNEL_SPACE_SIZE)); |
389 } | 409 } |
390 if (RBTS.KERNEL_VERSIONS_wrong_value && !wrong_value) { | 410 if (RBTS.KERNEL_VERSIONS_wrong_value && !wrong_value) { |
391 RETURN_ON_FAILURE(TlclWrite(KERNEL_VERSIONS_NV_INDEX, | 411 RETURN_ON_FAILURE(SafeWrite(KERNEL_VERSIONS_NV_INDEX, |
392 (uint8_t*) "mickey mouse", | 412 (uint8_t*) "mickey mouse", |
393 KERNEL_SPACE_SIZE)); | 413 KERNEL_SPACE_SIZE)); |
394 } | 414 } |
395 return TPM_SUCCESS; | 415 return TPM_SUCCESS; |
396 } | 416 } |
397 | 417 |
398 /* Adjusts value of KERNEL_VERSIONS_BACKUP space. | 418 /* Adjusts value of KERNEL_VERSIONS_BACKUP space. |
399 */ | 419 */ |
400 static uint32_t RollbackTest_AdjustKernelBackup(void) { | 420 static uint32_t RollbackTest_AdjustKernelBackup(void) { |
401 /* Same as backup */ | 421 /* Same as backup */ |
402 uint32_t kv, kvbackup; | 422 uint32_t kv, kvbackup; |
403 RETURN_ON_FAILURE(TlclRead(KERNEL_VERSIONS_NV_INDEX, | 423 RETURN_ON_FAILURE(TlclRead(KERNEL_VERSIONS_NV_INDEX, |
404 (uint8_t*) &kv, sizeof(kv))); | 424 (uint8_t*) &kv, sizeof(kv))); |
405 RETURN_ON_FAILURE(TlclRead(KERNEL_VERSIONS_BACKUP_NV_INDEX, | 425 RETURN_ON_FAILURE(TlclRead(KERNEL_VERSIONS_BACKUP_NV_INDEX, |
406 (uint8_t*) &kvbackup, sizeof(kvbackup))); | 426 (uint8_t*) &kvbackup, sizeof(kvbackup))); |
407 if (RBTS.KERNEL_VERSIONS_same_as_backup && kv != kvbackup) { | 427 if (RBTS.KERNEL_VERSIONS_same_as_backup && kv != kvbackup) { |
408 kvbackup = kv; | 428 kvbackup = kv; |
409 RETURN_ON_FAILURE(TlclWrite(KERNEL_VERSIONS_BACKUP_NV_INDEX, | 429 RETURN_ON_FAILURE(SafeWrite(KERNEL_VERSIONS_BACKUP_NV_INDEX, |
410 (uint8_t*) &kvbackup, sizeof(kvbackup))); | 430 (uint8_t*) &kvbackup, sizeof(kvbackup))); |
411 } | 431 } |
412 if (!RBTS.KERNEL_VERSIONS_same_as_backup && kv == kvbackup) { | 432 if (!RBTS.KERNEL_VERSIONS_same_as_backup && kv == kvbackup) { |
413 kvbackup = kv + 1; | 433 kvbackup = kv + 1; |
414 RETURN_ON_FAILURE(TlclWrite(KERNEL_VERSIONS_BACKUP_NV_INDEX, | 434 RETURN_ON_FAILURE(SafeWrite(KERNEL_VERSIONS_BACKUP_NV_INDEX, |
415 (uint8_t*) &kvbackup, sizeof(kvbackup))); | 435 (uint8_t*) &kvbackup, sizeof(kvbackup))); |
416 } | 436 } |
417 return TPM_SUCCESS; | 437 return TPM_SUCCESS; |
418 } | 438 } |
419 | 439 |
420 /* Adjust the value in the developer mode transition space. | 440 /* Adjust the value in the developer mode transition space. |
421 */ | 441 */ |
422 static uint32_t RollbackTest_AdjustDeveloperMode(void) { | 442 static uint32_t RollbackTest_AdjustDeveloperMode(void) { |
423 uint32_t dev; | 443 uint32_t dev; |
424 /* Developer mode transitions */ | 444 /* Developer mode transitions */ |
425 RETURN_ON_FAILURE(TlclRead(DEVELOPER_MODE_NV_INDEX, | 445 RETURN_ON_FAILURE(TlclRead(DEVELOPER_MODE_NV_INDEX, |
426 (uint8_t*) &dev, sizeof(dev))); | 446 (uint8_t*) &dev, sizeof(dev))); |
427 | 447 |
428 if (RBTS.developer != dev) { | 448 if (RBTS.developer != dev) { |
429 dev = RBTS.developer; | 449 dev = RBTS.developer; |
430 RETURN_ON_FAILURE(TlclWrite(DEVELOPER_MODE_NV_INDEX, | 450 RETURN_ON_FAILURE(SafeWrite(DEVELOPER_MODE_NV_INDEX, |
431 (uint8_t*) &dev, sizeof(dev))); | 451 (uint8_t*) &dev, sizeof(dev))); |
432 } | 452 } |
433 return TPM_SUCCESS; | 453 return TPM_SUCCESS; |
434 } | 454 } |
435 | 455 |
436 /* Changes the unowned write count. | 456 /* Changes the unowned write count. |
437 */ | 457 */ |
438 static uint32_t RollbackTest_AdjustWriteCount(void) { | 458 static uint32_t RollbackTest_AdjustWriteCount(void) { |
439 int i; | 459 int i; |
440 if (!RBTS.owned) { | 460 if (!RBTS.owned) { |
441 /* Sets the unowned write count, but only if we think that it will make a | 461 /* Sets the unowned write count, but only if we think that it will make a |
442 * difference for the test. In other words: we're trying to reduce the | 462 * difference for the test. In other words: we're trying to reduce the |
443 * number if initial states with some reasoning that we hope is correct. | 463 * number if initial states with some reasoning that we hope is correct. |
444 */ | 464 */ |
445 if (RBTS.writecount > low_writecount) { | 465 if (RBTS.writecount > low_writecount) { |
446 if (!tpm_was_just_cleared) { | 466 if (!tpm_was_just_cleared) { |
447 /* Unknown write count: must clear the TPM to reset to 0 */ | 467 /* Unknown write count: must clear the TPM to reset to 0 */ |
448 RETURN_ON_FAILURE(TPMClearAndReenable()); | 468 RETURN_ON_FAILURE(TPMClearAndReenable()); |
449 } | 469 } |
450 for (i = 0; i < RBTS.writecount; i++) { | 470 for (i = 0; i < RBTS.writecount; i++) { |
451 /* Changes the value to ensure that the TPM won't optimize away | 471 /* Changes the value to ensure that the TPM won't optimize away |
452 * writes. | 472 * writes. |
453 */ | 473 */ |
454 uint8_t b = (uint8_t) i; | 474 uint8_t b = (uint8_t) i; |
455 RETURN_ON_FAILURE(TlclWrite(WRITE_BUCKET_NV_INDEX, &b, 1)); | 475 RETURN_ON_FAILURE(SafeWrite(WRITE_BUCKET_NV_INDEX, &b, 1)); |
456 } | 476 } |
457 } | 477 } |
458 } | 478 } |
459 return TPM_SUCCESS; | 479 return TPM_SUCCESS; |
460 } | 480 } |
461 | 481 |
462 /* Sets the TPM to the right state for the next test run. | 482 /* Sets the TPM to the right state for the next test run. |
463 * | 483 * |
464 * Functionally correct ordering is tricky. Optimal ordering is even trickier | 484 * Functionally correct ordering is tricky. Optimal ordering is even trickier |
465 * (no claim to this). May succeed only partially and require a reboot to | 485 * (no claim to this). May succeed only partially and require a reboot to |
(...skipping 140 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
606 return TPM_SUCCESS; | 626 return TPM_SUCCESS; |
607 } | 627 } |
608 | 628 |
609 /* One-time call to create the WRITE_BUCKET space. | 629 /* One-time call to create the WRITE_BUCKET space. |
610 */ | 630 */ |
611 static uint32_t RollbackTest_InitializeTPM(void) { | 631 static uint32_t RollbackTest_InitializeTPM(void) { |
612 TlclLibInit(); | 632 TlclLibInit(); |
613 RETURN_ON_FAILURE(TlclStartup()); | 633 RETURN_ON_FAILURE(TlclStartup()); |
614 RETURN_ON_FAILURE(TlclContinueSelfTest()); | 634 RETURN_ON_FAILURE(TlclContinueSelfTest()); |
615 RETURN_ON_FAILURE(TlclAssertPhysicalPresence()); | 635 RETURN_ON_FAILURE(TlclAssertPhysicalPresence()); |
616 RETURN_ON_FAILURE(TlclDefineSpace(WRITE_BUCKET_NV_INDEX, | 636 RETURN_ON_FAILURE(SafeDefineSpace(WRITE_BUCKET_NV_INDEX, |
617 TPM_NV_PER_PPWRITE, 1)); | 637 TPM_NV_PER_PPWRITE, 1)); |
618 RETURN_ON_FAILURE(RollbackTest_SetTPMState(0)); | 638 RETURN_ON_FAILURE(RollbackTest_SetTPMState(0)); |
619 return TPM_SUCCESS; | 639 return TPM_SUCCESS; |
620 } | 640 } |
621 | 641 |
622 static void RollbackTest_Initialize(void) { | 642 static void RollbackTest_Initialize(void) { |
623 Log("initializing"); | 643 Log("initializing"); |
624 RollbackTest_InitializeState(); | 644 RollbackTest_InitializeState(); |
625 if (RollbackTest_InitializeTPM() != TPM_SUCCESS) { | 645 if (RollbackTest_InitializeTPM() != TPM_SUCCESS) { |
626 Log("couldn't initialize TPM"); | 646 Log("couldn't initialize TPM"); |
(...skipping 113 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
740 } else if (argc == 2 && strcmp(argv[1], "sync") == 0) { | 760 } else if (argc == 2 && strcmp(argv[1], "sync") == 0) { |
741 RollbackTest_Sync(); | 761 RollbackTest_Sync(); |
742 } else if (argc == 1) { | 762 } else if (argc == 1) { |
743 RollbackTest_Run(); | 763 RollbackTest_Run(); |
744 } else { | 764 } else { |
745 fprintf(stderr, "usage: rollback-test [ initialize ]\n"); | 765 fprintf(stderr, "usage: rollback-test [ initialize ]\n"); |
746 exit(1); | 766 exit(1); |
747 } | 767 } |
748 return 0; | 768 return 0; |
749 } | 769 } |
OLD | NEW |