diff options
| author | Vadim Bendebury <vbendeb@chromium.org> | 2016-07-03 17:08:10 -0700 |
|---|---|---|
| committer | Martin Roth <martinroth@google.com> | 2016-07-14 00:00:14 +0200 |
| commit | 4c0851cc37f42ed88d62b876357b71cfdaac480f (patch) | |
| tree | 096758fe9295f44382e07a5b2856182e5cd0dbd8 /src/include | |
| parent | 1ec76030edb631a1d37d6c9ad9d3791795681c11 (diff) | |
tpm2: implement locking firmware rollback counter
TPM1.2 is using the somewhat misnamed tlcl_set_global_lock() command
function to lock the hardware rollback counter. For TPM2 let's
implement and use the TPM2 command to lock an NV Ram location
(TPM2_NV_WriteLock).
BRANCH=none
BUG=chrome-os-partner:50645
TEST=verified that TPM2_NV_WriteLock command is invoked before RO
firmware starts RW, and succeeds.
Change-Id: I52aa8db95b908488ec4cf0843afeb6310dc7f38b
Signed-off-by: Martin Roth <martinroth@chromium.org>
Original-Commit-Id: 2f859335dfccfeea900f15bbb8c6cb3fd5ec8c77
Original-Change-Id: I62f22b9991522d4309cccc44180a5ebd4dca488d
Original-Signed-off-by: Vadim Bendebury <vbendeb@chromium.org>
Original-Reviewed-on: https://chromium-review.googlesource.com/358097
Original-Reviewed-by: Aaron Durbin <adurbin@chromium.org>
Original-Reviewed-by: Darren Krahn <dkrahn@chromium.org>
Reviewed-on: https://review.coreboot.org/15638
Tested-by: build bot (Jenkins)
Reviewed-by: Patrick Georgi <pgeorgi@google.com>
Diffstat (limited to 'src/include')
| -rw-r--r-- | src/include/tpm_lite/tlcl.h | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/src/include/tpm_lite/tlcl.h b/src/include/tpm_lite/tlcl.h index 1a4f63865d..8ea5564ecb 100644 --- a/src/include/tpm_lite/tlcl.h +++ b/src/include/tpm_lite/tlcl.h @@ -136,6 +136,11 @@ uint32_t tlcl_get_flags(uint8_t *disable, uint8_t *deactivated, uint32_t tlcl_set_global_lock(void); /** + * Make an NV Ram location read_only. The TPM error code is returned. + */ +uint32_t tlcl_lock_nv_write(uint32_t index); + +/** * Perform a TPM_Extend. */ uint32_t tlcl_extend(int pcr_num, const uint8_t *in_digest, |