Add NVRAM size limit to nano-emulator and add test to recover from NVRAM hog attack.

utility/chromeos_tpm_recovery_test

 #!/bin/sh -u
 # Copyright (c) 2010 The Chromium OS Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 #
 # Test the chromeos TPM recovery script by faking the entire execution
 # environment.
 
 rm -rf tpm_recovery_test_workdir
 mkdir  tpm_recovery_test_workdir
 cd     tpm_recovery_test_workdir
 
 export USR_BIN=.
 export USR_SBIN=.
 export DOT_RECOVERY=.recovery
 export ACPI_DIR=.
 
 ctr=../chromeos_tpm_recovery
 
 # build the permanent environment
 
 echo > .recovery
 echo 3 > BINF.0
 echo 0 > CRSW
 
+space_overhead=200
+
 # build tpmc
 cat > tpmc <<"EOF"
 #!/bin/sh -u
 # Fake tpmc program
 
 definespace () {
   index=$2
   size=$3
   permissions=$4
+  space_overhead=200
 
   if [ -e space.$index.data -a -e tpm-owned ]; then
     echo "cannot redefine space without auth"
   fi
 
+  totalsize=$(( $size + $space_overhead ))
+  free=$(cat nvram.freespace)
+
+  if [ $totalsize -gt $free ]; then
+    echo "tpmc: definespace: need $totalsize, available $free"
+    return 17  # NO_SPACE
+  fi
+
   if [ $index != 0xf004 ]; then
     echo $size > space.$index.size
     echo $permissions > space.$index.perm
     for i in $(seq 1 $(($size))); do
       echo -n "ff " >> space.$index.data
     done
+    echo $(( $free - $totalsize )) > nvram.freespace
   fi
   return 0
 }
 
 case $1 in
 
   clear)
     rm -f tpm-owned
   ;;
 
@@ skipping 67 matching lines @@
     exit 1
   ;;
 esac
 
 EOF
 
 # build nvtool
 cat > tpm-nvtool <<"EOF"
 #!/bin/sh -u
 
+space_overhead=200
+
 print_space () {
   index=$1
-  echo "# NV Index $index"
+  printf "# NV Index 0x%08x" $(( $index ))
   echo " uninteresting random garbage"
   echo " further random garbage"
   echo ""
 }
 
 if [ "$1" = "--release" ]; then
   if [ "$2" != "--index" -o \
        "$4" != "--owner_password" ]; then
     echo "sorry, picky tpm-nvtool"
     exit 1
   fi
   index=$3
   if [ ! -f tpm-owned ]; then
     echo "tpm is unowned"
     exit 1
   fi
+  size=$(cat space.$index.size)
+  free=$(cat nvram.freespace)
   rm space.$index.*
+  echo $(( $size + $space_overhead + $free )) > nvram.freespace
 elif [ "$1" = "--list" ]; then
   for s in space.*.data; do
     print_space $(echo $s | sed -e "s/[^.]*\.//" -e "s/\..*//")
   done
 fi
 EOF
 
 # build tpm_takeownership
 cat > tpm_takeownership <<"EOF"
 #!/bin/sh -u
@@ skipping 10 matching lines @@
 trap "{ rm tcsd_is_running; }" EXIT
 echo > tcsd_is_running
 sleep 365d
 EOF
 
 chmod 755 tpmc tpm-nvtool tpm_takeownership tcsd
 
 echo "starting TPM recovery test" > log
 
 # normal run
+echo "TEST: normal run" > log
+
+echo 1500 > nvram.freespace
 
 ./tpmc definespace 0x1007 0xa 0x8001
 ./tpmc definespace 0x1008 0xd 0x1
 ./tpmc write 0x1008 01 4c 57 52 47
 touch tpm-owned
 
-echo "TEST: normal run" > log
 $ctr log
 
-# attempt to hijack kernel space
+# Kernel space with wrong ID
+echo "TEST: bad kernel space ID" >> log
 
 rm space.*
+echo 1500 > nvram.freespace
 
 ./tpmc definespace 0x1007 0xa 0x8001
 ./tpmc definespace 0x1008 0xd 0x1
 touch tpm-owned
 
-echo "TEST: bad kernel space ID" >> log
 $ctr log
 
-# attempt to hijack kernel space
+# Kernel space with wrong size
+echo "TEST: bad kernel space size" >> log
 
 rm space.*
+echo 1500 > nvram.freespace
 
 ./tpmc definespace 0x1007 0xa 0x8001
 ./tpmc definespace 0x1008 0xc 0x1
 touch tpm-owned
 
-echo "TEST: bad kernel space size" >> log
 $ctr log
 
+# Kernel space with wrong size AND bogus space to exhaust nvram
+echo "TEST: bad kernel space size and no room" >> log
+
+rm space.*
+echo 1500 > nvram.freespace
+
+./tpmc definespace 0x1007 0xa 0x8001
+./tpmc definespace 0x1008 0x1 0x1
+space_hog_size=$(printf "0x%x" \
+  $(( $(cat nvram.freespace) - $space_overhead - 1 )) )
+echo "remaining $(cat nvram.freespace) bytes" >> log
+echo "hogging $(( $space_hog_size )) bytes" >> log
+./tpmc definespace 0xcafe $space_hog_size 0x1 || echo "hogging failed!" >> log
+touch tpm-owned
+
+$ctr log