tests: Add a unit test for mok mirroring

Test that our mok mirroring doesn't ever try to delete any variable that
it has previously created, and that it properly mirrors at least
MokList, MokListX, and SbatLevel, at least when variables actually work.

These tests will fail (rather a lot) without 7f64fd6da9458b73c4.

Currently valgrind shows a memory leak in this code which is not
introduced in this patch series.  Since all of our memory is freed on
Exit() or when kernel does ExitBootServices(), this doesn't have any
significant repercussions.

Signed-off-by: Peter Jones <pjones@redhat.com>

4 files changed, 502 insertions, 1 deletions

diff --git a/include/mock-variables.h b/include/mock-variables.h
index 759fd1f0..3f282a68 100644
--- a/include/mock-variables.h
+++ b/include/mock-variables.h
@@ -124,6 +124,21 @@ typedef enum {
 	REPLACE,
 } mock_variable_op_t;
 
+static inline const char *
+format_var_op(mock_variable_op_t op)
+{
+	static const char *var_op_names[] = {
+		"NONE",
+		"CREATE",
+		"DELETE",
+		"APPEND",
+		"REPLACE",
+		NULL
+	};
+
+	return var_op_names[op];
+}
+
 typedef EFI_STATUS (mock_set_variable_pre_hook_t)(CHAR16 *name, EFI_GUID *guid,
 						  UINT32 attrs, UINTN size,
 						  VOID *data);
diff --git a/include/test-data-efivars-1.h b/include/test-data-efivars-1.h
new file mode 100644
index 00000000..55090ede
--- /dev/null
+++ b/include/test-data-efivars-1.h
@@ -0,0 +1,106 @@
+// SPDX-License-Identifier: BSD-2-Clause-Patent
+/*
+ * test-data-efivars-1.h - test data
+ * Copyright Peter Jones <pjones@redhat.com>
+ */
+
+#ifndef TEST_DATA_EFIVARS_1_H_
+#define TEST_DATA_EFIVARS_1_H_
+
+static const unsigned char test_data_efivars_1_MokListRT[] = {
+	0xa1, 0x59, 0xc0, 0xa5, 0xe4, 0x94, 0xa7, 0x4a, 0x87, 0xb5, 0xab, 0x15,
+	0x5c, 0x2b, 0xf0, 0x72, 0x98, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x7c, 0x03, 0x00, 0x00, 0x50, 0xab, 0x5d, 0x60, 0x46, 0xe0, 0x00, 0x43,
+	0xab, 0xb6, 0x3d, 0xd8, 0x10, 0xdd, 0x8b, 0x23, 0x30, 0x82, 0x03, 0x68,
+	0x30, 0x82, 0x02, 0x50, 0xa0, 0x03, 0x02, 0x01, 0x02, 0x02, 0x05, 0x00,
+	0x99, 0x76, 0xf2, 0xf4, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86,
+	0xf7, 0x0d, 0x01, 0x01, 0x0b, 0x05, 0x00, 0x30, 0x20, 0x31, 0x1e, 0x30,
+	0x1c, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x15, 0x46, 0x65, 0x64, 0x6f,
+	0x72, 0x61, 0x20, 0x53, 0x65, 0x63, 0x75, 0x72, 0x65, 0x20, 0x42, 0x6f,
+	0x6f, 0x74, 0x20, 0x43, 0x41, 0x30, 0x1e, 0x17, 0x0d, 0x31, 0x32, 0x31,
+	0x32, 0x30, 0x37, 0x31, 0x36, 0x32, 0x35, 0x35, 0x34, 0x5a, 0x17, 0x0d,
+	0x32, 0x32, 0x31, 0x32, 0x30, 0x35, 0x31, 0x36, 0x32, 0x35, 0x35, 0x34,
+	0x5a, 0x30, 0x20, 0x31, 0x1e, 0x30, 0x1c, 0x06, 0x03, 0x55, 0x04, 0x03,
+	0x13, 0x15, 0x46, 0x65, 0x64, 0x6f, 0x72, 0x61, 0x20, 0x53, 0x65, 0x63,
+	0x75, 0x72, 0x65, 0x20, 0x42, 0x6f, 0x6f, 0x74, 0x20, 0x43, 0x41, 0x30,
+	0x82, 0x01, 0x22, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7,
+	0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x03, 0x82, 0x01, 0x0f, 0x00, 0x30,
+	0x82, 0x01, 0x0a, 0x02, 0x82, 0x01, 0x01, 0x00, 0xae, 0xf5, 0xf7, 0x52,
+	0x81, 0xa9, 0x5c, 0x3e, 0x2b, 0xf7, 0x1d, 0x55, 0xf4, 0x5a, 0x68, 0x84,
+	0x2d, 0xbc, 0x8b, 0x76, 0x96, 0x85, 0x0d, 0x27, 0xb8, 0x18, 0xa5, 0xcd,
+	0xc1, 0x83, 0xb2, 0x8c, 0x27, 0x5d, 0x23, 0x0a, 0xd1, 0x12, 0x0a, 0x75,
+	0x98, 0xa2, 0xe6, 0x5d, 0x01, 0x8a, 0xf4, 0xd9, 0x9f, 0xfc, 0x70, 0xbc,
+	0xc3, 0xc4, 0x17, 0x7b, 0x02, 0xb5, 0x13, 0xc4, 0x51, 0x92, 0xe0, 0xc0,
+	0x05, 0x74, 0xb9, 0x2e, 0x3d, 0x24, 0x78, 0xa0, 0x79, 0x73, 0x94, 0xc0,
+	0xc2, 0x2b, 0xb2, 0x82, 0xa7, 0xf4, 0xab, 0x67, 0x4a, 0x22, 0xf3, 0x64,
+	0xcd, 0xc3, 0xf9, 0x0c, 0x26, 0x01, 0xbf, 0x1b, 0xd5, 0x3d, 0x39, 0xbf,
+	0xc9, 0xfa, 0xfb, 0x5e, 0x52, 0xb9, 0xa4, 0x48, 0xfb, 0x13, 0xbf, 0x87,
+	0x29, 0x0a, 0x64, 0xef, 0x21, 0x7b, 0xbc, 0x1e, 0x16, 0x7b, 0x88, 0x4f,
+	0xf1, 0x40, 0x2b, 0xd9, 0x22, 0x15, 0x47, 0x4e, 0x84, 0xf6, 0x24, 0x1c,
+	0x4d, 0x53, 0x16, 0x5a, 0xb1, 0x29, 0xbb, 0x5e, 0x7d, 0x7f, 0xc0, 0xd4,
+	0xe2, 0xd5, 0x79, 0xaf, 0x59, 0x73, 0x02, 0xdc, 0xb7, 0x48, 0xbf, 0xae,
+	0x2b, 0x70, 0xc1, 0xfa, 0x74, 0x7f, 0x79, 0xf5, 0xee, 0x23, 0xd0, 0x03,
+	0x05, 0xb1, 0x79, 0x18, 0x4f, 0xfd, 0x4f, 0x2f, 0xe2, 0x63, 0x19, 0x4d,
+	0x77, 0xba, 0xc1, 0x2c, 0x8b, 0xb3, 0xd9, 0x05, 0x2e, 0xd9, 0xd8, 0xb6,
+	0x51, 0x13, 0xbf, 0xce, 0x36, 0x67, 0x97, 0xe4, 0xad, 0x58, 0x56, 0x07,
+	0xab, 0xd0, 0x8c, 0x66, 0x12, 0x49, 0xdc, 0x91, 0x68, 0xb4, 0xc8, 0xea,
+	0xdd, 0x9c, 0xc0, 0x81, 0xc6, 0x91, 0x5b, 0xdb, 0x12, 0x78, 0xdb, 0xff,
+	0xc1, 0xaf, 0x08, 0x16, 0xfc, 0x70, 0x13, 0x97, 0x5b, 0x57, 0xad, 0x6b,
+	0x44, 0x98, 0x7e, 0x1f, 0xec, 0xed, 0x46, 0x66, 0x95, 0x0f, 0x05, 0x55,
+	0x02, 0x03, 0x01, 0x00, 0x01, 0xa3, 0x81, 0xa8, 0x30, 0x81, 0xa5, 0x30,
+	0x4e, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x01, 0x01, 0x04,
+	0x42, 0x30, 0x40, 0x30, 0x3e, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05,
+	0x07, 0x30, 0x02, 0x86, 0x32, 0x68, 0x74, 0x74, 0x70, 0x73, 0x3a, 0x2f,
+	0x2f, 0x66, 0x65, 0x64, 0x6f, 0x72, 0x61, 0x70, 0x72, 0x6f, 0x6a, 0x65,
+	0x63, 0x74, 0x2e, 0x6f, 0x72, 0x67, 0x2f, 0x77, 0x69, 0x6b, 0x69, 0x2f,
+	0x46, 0x65, 0x61, 0x74, 0x75, 0x72, 0x65, 0x73, 0x2f, 0x53, 0x65, 0x63,
+	0x75, 0x72, 0x65, 0x42, 0x6f, 0x6f, 0x74, 0x30, 0x1f, 0x06, 0x03, 0x55,
+	0x1d, 0x23, 0x04, 0x18, 0x30, 0x16, 0x80, 0x14, 0xfd, 0xe3, 0x25, 0x99,
+	0xc2, 0xd6, 0x1d, 0xb1, 0xbf, 0x58, 0x07, 0x33, 0x5d, 0x7b, 0x20, 0xe4,
+	0xcd, 0x96, 0x3b, 0x42, 0x30, 0x13, 0x06, 0x03, 0x55, 0x1d, 0x25, 0x04,
+	0x0c, 0x30, 0x0a, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x03,
+	0x03, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x1d, 0x0e, 0x04, 0x16, 0x04, 0x14,
+	0xfd, 0xe3, 0x25, 0x99, 0xc2, 0xd6, 0x1d, 0xb1, 0xbf, 0x58, 0x07, 0x33,
+	0x5d, 0x7b, 0x20, 0xe4, 0xcd, 0x96, 0x3b, 0x42, 0x30, 0x0d, 0x06, 0x09,
+	0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b, 0x05, 0x00, 0x03,
+	0x82, 0x01, 0x01, 0x00, 0x37, 0x77, 0xf0, 0x3a, 0x41, 0xa2, 0x1c, 0x9f,
+	0x71, 0x3b, 0xd6, 0x9b, 0x95, 0xb5, 0x15, 0xdf, 0x4a, 0xb6, 0xf4, 0xd1,
+	0x51, 0xba, 0x0d, 0x04, 0xda, 0x9c, 0xb2, 0x23, 0xf0, 0xf3, 0x34, 0x59,
+	0x8d, 0xb8, 0xd4, 0x9a, 0x75, 0x74, 0x65, 0x80, 0x17, 0x61, 0x3a, 0xc1,
+	0x96, 0x7f, 0xa7, 0xc1, 0x2b, 0xd3, 0x1a, 0xd6, 0x60, 0x3c, 0x71, 0x3a,
+	0xa4, 0xc4, 0xe3, 0x39, 0x03, 0x02, 0x15, 0x12, 0x08, 0x1f, 0x4e, 0xcd,
+	0x97, 0x50, 0xf8, 0xff, 0x50, 0xcc, 0xb6, 0x3e, 0x03, 0x7d, 0x7a, 0xe7,
+	0x82, 0x7a, 0xc2, 0x67, 0xbe, 0xc9, 0x0e, 0x11, 0x0f, 0x16, 0x2e, 0x1e,
+	0xa9, 0xf2, 0x6e, 0xfe, 0x04, 0xbd, 0xea, 0x9e, 0xf4, 0xa9, 0xb3, 0xd9,
+	0xd4, 0x61, 0x57, 0x08, 0x87, 0xc4, 0x98, 0xd8, 0xa2, 0x99, 0x64, 0xde,
+	0x15, 0x54, 0x8d, 0x57, 0x79, 0x14, 0x1f, 0xfa, 0x0d, 0x4d, 0x6b, 0xcd,
+	0x98, 0x35, 0xf5, 0x0c, 0x06, 0xbd, 0xf3, 0x31, 0xd6, 0xfe, 0x05, 0x1f,
+	0x60, 0x90, 0xb6, 0x1e, 0x10, 0xf7, 0x24, 0xe0, 0x3c, 0xf6, 0x33, 0x50,
+	0xcd, 0x44, 0xc2, 0x71, 0x18, 0x51, 0xbd, 0x18, 0x31, 0x81, 0x1e, 0x32,
+	0xe1, 0xe6, 0x9f, 0xf9, 0x9c, 0x02, 0x53, 0xb4, 0xe5, 0x6a, 0x41, 0xd6,
+	0x65, 0xb4, 0x2e, 0xf1, 0xcf, 0xb3, 0xb8, 0x82, 0xb0, 0xa3, 0x96, 0xe2,
+	0x24, 0xd8, 0x83, 0xae, 0x06, 0x5b, 0xb3, 0x24, 0x74, 0x4d, 0xd1, 0xa4,
+	0x0a, 0x1d, 0x0a, 0x32, 0x1b, 0x75, 0xa2, 0x96, 0xd1, 0x0e, 0x3e, 0xe1,
+	0x30, 0xc3, 0x18, 0xe8, 0xcb, 0x53, 0xc4, 0x0b, 0x00, 0xad, 0x7e, 0xad,
+	0xc8, 0x49, 0x41, 0xef, 0x97, 0x69, 0xbd, 0x13, 0x5f, 0xef, 0xef, 0x3c,
+	0xda, 0x60, 0x05, 0xd8, 0x92, 0xfc, 0xda, 0x6a, 0xea, 0x48, 0x3f, 0x0e,
+	0x3e, 0x73, 0x77, 0xfd, 0xa6, 0x89, 0xe9, 0x3f
+};
+
+static const unsigned char test_data_efivars_1_MokListXRT[] = {
+	0x26, 0x16, 0xc4, 0xc1, 0x4c, 0x50, 0x92, 0x40, 0xac, 0xa9, 0x41,
+	0xf9, 0x36, 0x93, 0x43, 0x28, 0x4c, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x30, 0x00, 0x00, 0x00, 0x50, 0xab, 0x5d, 0x60, 0x46,
+	0xe0, 0x00, 0x43, 0xab, 0xb6, 0x3d, 0xd8, 0x10, 0xdd, 0x8b, 0x23,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
+};
+
+static const unsigned char test_data_efivars_1_SbatLevelRT[] = {
+	0x73, 0x62, 0x61, 0x74, 0x2c, 0x31, 0x2c, 0x32, 0x30,
+	0x32, 0x31, 0x30, 0x33, 0x30, 0x32, 0x31, 0x38, 0x0a
+};
+
+#endif /* !TEST_DATA_EFIVARS_1_H_ */
+// vim:fenc=utf-8:tw=75:noet
diff --git a/include/test.mk b/include/test.mk
index d362253b..343053d3 100644
--- a/include/test.mk
+++ b/include/test.mk
@@ -82,7 +82,7 @@ test-load-options : CFLAGS+=-DHAVE_SHIM_LOCK_GUID
 test-mock-variables_FILES = mok.c globals.c tpm.c lib/guid.c lib/variables.c mock-variables.c
 test-mock-variables: CFLAGS+=-DHAVE_SHIM_LOCK_GUID
 
-test-mok-mirror_FILES = mok.c globals.c tpm.c lib/guid.c lib/variables.c
+test-mok-mirror_FILES = mok.c globals.c tpm.c lib/guid.c lib/variables.c mock-variables.c
 test-mok-mirror: CFLAGS+=-DHAVE_START_IMAGE -DHAVE_SHIM_LOCK_GUID
 
 test-sbat_FILES = csv.c lib/variables.c lib/guid.c
diff --git a/test-mok-mirror.c b/test-mok-mirror.c
new file mode 100644
index 00000000..d7829843
--- /dev/null
+++ b/test-mok-mirror.c
@@ -0,0 +1,380 @@
+// SPDX-License-Identifier: BSD-2-Clause-Patent
+/*
+ * test-mok-mirror.c - try to test our mok mirroring code
+ * Copyright Peter Jones <pjones@redhat.com>
+ */
+
+#include "shim.h"
+#include "mock-variables.h"
+#include "test-data-efivars-1.h"
+
+#include <stdio.h>
+
+#pragma GCC diagnostic ignored "-Wunused-parameter"
+
+EFI_STATUS
+start_image(EFI_HANDLE image_handle UNUSED, CHAR16 *mm)
+{
+	printf("Attempted to launch %s\n", Str2str(mm));
+	return EFI_SUCCESS;
+}
+
+#define N_TEST_VAR_OPS 40
+struct test_var {
+	EFI_GUID guid;
+	CHAR16 *name;
+	UINT32 attrs;
+	UINTN n_ops;
+	bool must_be_present;
+	bool must_be_absent;
+	mock_variable_op_t ops[N_TEST_VAR_OPS];
+	EFI_STATUS results[N_TEST_VAR_OPS];
+};
+
+static struct test_var *test_vars;
+
+struct mock_mok_variable_config_entry {
+	CHAR8 name[256];
+	UINT64 data_size;
+	const unsigned char *data;
+};
+
+static void
+setvar_post(CHAR16 *name, EFI_GUID *guid, UINT32 attrs,
+	    UINTN size, VOID *data, EFI_STATUS *status,
+	    mock_variable_op_t op, const char * const file,
+	    const int line, const char * const func)
+{
+	if (!test_vars)
+		return;
+
+	for (UINTN i = 0; test_vars[i].name != NULL; i++) {
+		struct test_var *tv = &test_vars[i];
+
+		if (CompareGuid(&tv->guid, guid) != 0 ||
+		    StrCmp(tv->name, name) != 0)
+			continue;
+		tv->ops[tv->n_ops] = op;
+		tv->results[tv->n_ops] = *status;
+		tv->n_ops += 1;
+	}
+}
+
+static void
+getvar_post(CHAR16 *name, EFI_GUID *guid,
+	    UINT32 *attrs, UINTN *size,
+	    VOID *data, EFI_STATUS *status,
+	    const char * const file, const int line, const char * func)
+{
+	if (EFI_ERROR(*status) &&
+	    (*status != EFI_NOT_FOUND &&
+	     *status != EFI_BUFFER_TOO_SMALL)) {
+		printf("%s:%d:%s():Getting "GUID_FMT"-%s ",
+		       file, line, func,
+		       GUID_ARGS(*guid), Str2str(name));
+		if (attrs)
+			printf("attrs:%s\n", format_var_attrs(*attrs));
+		else
+			printf("attrs:NULL\n");
+		printf("failed:%s\n", efi_strerror(*status));
+	}
+}
+
+static int
+test_mok_mirror_0(void)
+{
+	const char *mok_rt_vars[n_mok_state_variables];
+	EFI_STATUS status;
+	EFI_GUID guid = SHIM_LOCK_GUID;
+	EFI_GUID mok_config_guid = MOK_VARIABLE_STORE;
+	int ret = -1;
+
+	struct test_var test_mok_mirror_0_vars[] = {
+		{.guid = SHIM_LOCK_GUID,
+		 .name = L"MokList",
+		 .must_be_present = true,
+		 .attrs = EFI_VARIABLE_BOOTSERVICE_ACCESS |
+			  EFI_VARIABLE_NON_VOLATILE,
+		 .ops = { NONE, },
+		},
+		{.guid = SHIM_LOCK_GUID,
+		 .name = L"MokListRT",
+		 .must_be_present = true,
+		 .attrs = EFI_VARIABLE_BOOTSERVICE_ACCESS |
+			  EFI_VARIABLE_RUNTIME_ACCESS,
+		 .ops = { NONE, },
+		},
+		{.guid = SHIM_LOCK_GUID,
+		 .name = L"MokListX",
+		 .must_be_present = true,
+		 .attrs = EFI_VARIABLE_BOOTSERVICE_ACCESS |
+			  EFI_VARIABLE_NON_VOLATILE,
+		 .ops = { NONE, },
+		},
+		{.guid = SHIM_LOCK_GUID,
+		 .name = L"MokListXRT",
+		 .must_be_present = true,
+		 .attrs = EFI_VARIABLE_BOOTSERVICE_ACCESS |
+			  EFI_VARIABLE_RUNTIME_ACCESS,
+		 .ops = { NONE, },
+		},
+		{.guid = SHIM_LOCK_GUID,
+		 .name = L"SbatLevel",
+		 .must_be_present = true,
+		 .attrs = EFI_VARIABLE_BOOTSERVICE_ACCESS |
+			  EFI_VARIABLE_NON_VOLATILE,
+		 .ops = { NONE, },
+		},
+		{.guid = SHIM_LOCK_GUID,
+		 .name = L"SbatLevelRT",
+		 .must_be_present = true,
+		 .attrs = EFI_VARIABLE_BOOTSERVICE_ACCESS |
+			  EFI_VARIABLE_RUNTIME_ACCESS,
+		 .ops = { NONE, },
+		},
+		{.guid = SHIM_LOCK_GUID,
+		 .name = L"MokIgnoreDB",
+		 .must_be_absent = true,
+		 .attrs = EFI_VARIABLE_BOOTSERVICE_ACCESS |
+			  EFI_VARIABLE_RUNTIME_ACCESS,
+		 .ops = { NONE, },
+		},
+		{.guid = SHIM_LOCK_GUID,
+		 .name = L"MokSBState",
+		 .attrs = EFI_VARIABLE_BOOTSERVICE_ACCESS |
+			  EFI_VARIABLE_NON_VOLATILE,
+		 .ops = { NONE, },
+		},
+		{.guid = SHIM_LOCK_GUID,
+		 .name = L"MokSBStateRT",
+		 .must_be_absent = true,
+		 .attrs = EFI_VARIABLE_BOOTSERVICE_ACCESS |
+			  EFI_VARIABLE_RUNTIME_ACCESS,
+		 .ops = { NONE, },
+		},
+		{.guid = { 0, },
+		 .name = NULL,
+		}
+	};
+
+	struct mock_mok_variable_config_entry test_mok_config_table[] = {
+		{.name = "MokListRT",
+		 .data_size = sizeof(test_data_efivars_1_MokListRT),
+		 .data = test_data_efivars_1_MokListRT
+		},
+		{.name = "MokListXRT",
+		 .data_size = sizeof(test_data_efivars_1_MokListXRT),
+		 .data = test_data_efivars_1_MokListXRT
+		},
+		{.name = "SbatLevelRT",
+		 .data_size = sizeof(test_data_efivars_1_SbatLevelRT),
+		 .data = test_data_efivars_1_SbatLevelRT
+		},
+		{.name = { 0, },
+		 .data_size = 0,
+		 .data = NULL,
+		}
+	};
+
+	for (size_t i = 0; i < n_mok_state_variables; i++) {
+		mok_rt_vars[i] = mok_state_variables[i].rtname8;
+	}
+
+	mock_load_variables("test-data/efivars-1", mok_rt_vars, true);
+
+	mock_set_variable_post_hook = setvar_post;
+	mock_get_variable_post_hook = getvar_post;
+	test_vars = &test_mok_mirror_0_vars[0];
+
+	import_mok_state(NULL);
+
+	for (size_t i = 0; test_mok_mirror_0_vars[i].name != NULL; i++) {
+		struct test_var *tv = &test_mok_mirror_0_vars[i];
+		list_t *pos = NULL;
+		bool found = false;
+		char buf[1];
+		UINTN size = 0;
+		UINT32 attrs = 0;
+		bool present = false;
+
+		list_for_each(pos, &mock_variables) {
+			struct mock_variable *var;
+			bool deleted;
+			bool created;
+
+			var = list_entry(pos, struct mock_variable, list);
+			if (CompareGuid(&tv->guid, &var->guid) != 0 ||
+			    StrCmp(var->name, tv->name) != 0)
+				continue;
+			found = true;
+			assert_equal_goto(var->attrs, tv->attrs, err,
+					  "\"%s\": wrong attrs; got %s expected %s\n",
+					  Str2str(tv->name),
+					  format_var_attrs(var->attrs),
+					  format_var_attrs(tv->attrs));
+			for (UINTN j = 0; j < N_TEST_VAR_OPS
+					  && tv->ops[j] != NONE; j++) {
+				switch (tv->ops[j]) {
+				case NONE:
+				default:
+					break;
+				case CREATE:
+					if (tv->results[j] == EFI_SUCCESS)
+						created = true;
+					break;
+				case DELETE:
+					assert_goto(tv->results[j] != EFI_SUCCESS, err,
+							  "Tried to delete absent variable \"%s\"\n",
+							  Str2str(tv->name));
+					assert_goto(created == false, err,
+						    "Deleted variable \"%s\" was previously created.\n",
+						    Str2str(tv->name));
+					break;
+				case APPEND:
+					assert_goto(false, err,
+						    "No append action should have been tested\n");
+					break;
+				case REPLACE:
+					assert_goto(false, err,
+						    "No replace action should have been tested\n");
+					break;
+				}
+			}
+		}
+		if (tv->must_be_present) {
+			assert_goto(found == true, err,
+				 "variable \"%s\" was not found.\n",
+				 Str2str(tv->name));
+		}
+
+		if (tv->must_be_absent) {
+			assert_goto(found == false, err,
+				 "variable \"%s\" was found.\n",
+				 Str2str(tv->name));
+		}
+	}
+
+	uint8_t *pos = NULL;
+	for (size_t i = 0; i < ST->NumberOfTableEntries; i++) {
+		EFI_CONFIGURATION_TABLE *ct = &ST->ConfigurationTable[i];
+
+		if (CompareGuid(&ct->VendorGuid, &mok_config_guid) != 0)
+			continue;
+
+		pos = (void *)ct->VendorTable;
+		break;
+	}
+
+	assert_nonzero_goto(pos, err, "%p != 0\n");
+
+	size_t i = 0;
+	while (pos) {
+		struct mock_mok_variable_config_entry *mock_entry =
+			&test_mok_config_table[i];
+		struct mok_variable_config_entry *mok_entry =
+			(struct mok_variable_config_entry *)pos;
+
+		/*
+		 * If the tables are different lengths, this will trigger.
+		 */
+		assert_equal_goto(mok_entry->name[0], mock_entry->name[0], err,
+				  "mok.name[0] %ld != test.name[0] %ld\n");
+		if (mock_entry->name[0] == 0)
+			break;
+
+		assert_nonzero_goto(mok_entry->name[0], err, "%ld != %ld\n");
+		assert_zero_goto(strncmp(mok_entry->name, mock_entry->name,
+					 sizeof(mock_entry->name)),
+				 err, "%ld != %ld: strcmp(\"%s\",\"%s\")\n",
+				 mok_entry->name, mock_entry->name);
+
+		/*
+		 * As of 7501b6bb449f ("mok: fix potential buffer overrun in
+		 * import_mok_state"), we should not see any mok config
+		 * variables with data_size == 0.
+		 */
+		assert_nonzero_goto(mok_entry->data_size, err, "%ld != 0\n");
+
+		assert_equal_goto(mok_entry->data_size, mock_entry->data_size,
+				  err, "%ld != %ld\n");
+		assert_zero_goto(CompareMem(mok_entry->data, mock_entry->data,
+					    mok_entry->data_size),
+				 err, "%ld != %ld\n");
+		pos += offsetof(struct mok_variable_config_entry, data)
+		       + mok_entry->data_size;
+		i += 1;
+	}
+
+	ret = 0;
+err:
+	for (UINTN k = 0; k < n_mok_state_variables; k++) {
+		struct mok_state_variable *v =
+			&mok_state_variables[k];
+		if (v->data_size && v->data) {
+			free(v->data);
+			v->data = NULL;
+			v->data_size = 0;
+		}
+	}
+
+	test_vars = NULL;
+	mock_set_variable_post_hook = NULL;
+	mock_get_variable_post_hook = NULL;
+	return ret;
+}
+
+int
+main(void)
+{
+	int status = 0;
+	setbuf(stdout, NULL);
+
+	const char *sort_policy_names[] = {
+		"MOCK_SORT_DESCENDING",
+		"MOCK_SORT_PREPEND",
+		"MOCK_SORT_APPEND",
+		"MOCK_SORT_ASCENDING",
+		"MOCK_SORT_MAX_SENTINEL"
+	};
+
+	const char *del_policy_names[] = {
+		"MOCK_VAR_DELETE_ATTR_ALLOW_ZERO",
+		"MOCK_VAR_DELETE_ATTR_ALOW_MISMATCH",
+		"MOCK_VAR_DELETE_ATTR_ALLOW_ZERO|MOCK_VAR_DELETE_ATTR_ALOW_MISMATCH",
+		"MOCK_VAR_DELETE_ATTR_ALLOW_NONE",
+		NULL
+	};
+
+	int delete_policies[] = {
+		MOCK_VAR_DELETE_ATTR_ALLOW_ZERO,
+		MOCK_VAR_DELETE_ATTR_ALOW_MISMATCH,
+		MOCK_VAR_DELETE_ATTR_ALLOW_ZERO
+		| MOCK_VAR_DELETE_ATTR_ALOW_MISMATCH,
+		0
+	};
+
+	for (int i = 0; i < MOCK_SORT_MAX_SENTINEL; i++) {
+		mock_variable_sort_policy = i;
+		mock_config_table_sort_policy = i;
+		int j = 0;
+
+		printf("%s: setting variable sort policy to %s\n",
+		       program_invocation_short_name, sort_policy_names[i]);
+		do {
+			printf("%s: setting delete policy to %s\n",
+			       program_invocation_short_name,
+			       del_policy_names[j]);
+
+			mock_variable_delete_attr_policy = delete_policies[j];
+			test(test_mok_mirror_0);
+			mock_finalize_vars_and_configs();
+
+			if (delete_policies[j] == 0)
+				break;
+		} while (++j);
+	}
+
+	return status;
+}
+
+// vim:fenc=utf-8:tw=75:noet