Reland "vboot_logic: Set VB2_CONTEXT_EC_TRUSTED in verstage_main"

This reverts commit adb393bdd6cd6734fa2672bd174aca4588a68016.
This relands commit 6260bf712a836762b18d80082505e981e040f4bc.

Reason for revert:
The original CL did not handle some devices correctly.
With the fixes:
* commit 36721a4 (mb/google/brya: Add GPIO_IN_RW to all variants'
early GPIO tables)
* commit 3bfe46c (mb/google/guybrush: Add GPIO EC in RW to early
GPIO tables)
* commit 3a30cf9 (mb/google/guybrush: Build chromeos.c in verstage

This CL also fix the following platforms:
* Change to always trusted: cyan.
* Add to early GPIO table: dedede, eve, fizz, glados, hatch, octopus,
			   poppy, reef, volteer.
* Add to both Makefile and early GPIO table: zork.

For mb/intel:
* adlrvp: Add support for get_ec_is_trusted().
* glkrvp: Add support for get_ec_is_trusted() with always trusted.
* kblrvp: Add support for get_ec_is_trusted() with always trusted.
* kunimitsu: Add support for get_ec_is_trusted() and initialize it as
	     early GPIO.
* shadowmountain: Add support for get_ec_is_trusted() and initialize
	     it as early GPIO.
* tglrvp: Add support for get_ec_is_trusted() with always trusted.

For qemu-q35: Add support for get_ec_is_trusted() with always trusted.

We could attempt another land.

Change-Id: I66b8b99d6e6bf259b18573f9f6010f9254357bf9
Signed-off-by: Hsuan Ting Chen <roccochen@chromium.org>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/58253
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Karthik Ramasubramanian <kramasub@google.com>
Reviewed-by: Tim Wawrzynczak <twawrzynczak@chromium.org>
Reviewed-by: Yu-Ping Wu <yupingso@google.com>

100 files changed, 471 insertions, 35 deletions

diff --git a/src/mainboard/google/asurada/chromeos.c b/src/mainboard/google/asurada/chromeos.c
index 6f8f24281a..1aa8876ca4 100644
--- a/src/mainboard/google/asurada/chromeos.c
+++ b/src/mainboard/google/asurada/chromeos.c
@@ -40,3 +40,9 @@ int tis_plat_irq_status(void)
 {
 	return gpio_eint_poll(GPIO_H1_AP_INT);
 }
+
+int get_ec_is_trusted(void)
+{
+	/* EC is trusted if not in RW. This is active low. */
+	return !!gpio_get(GPIO_EC_IN_RW);
+}
diff --git a/src/mainboard/google/auron/chromeos.c b/src/mainboard/google/auron/chromeos.c
index 40f98f20eb..9807acec36 100644
--- a/src/mainboard/google/auron/chromeos.c
+++ b/src/mainboard/google/auron/chromeos.c
@@ -9,6 +9,13 @@
 
 #include "onboard.h"
 
+/* EC_IN_RW is GPIO 25 in samus and 14 otherwise */
+#if CONFIG(BOARD_GOOGLE_SAMUS)
+#define EC_IN_RW_GPIO	25
+#else
+#define EC_IN_RW_GPIO	14
+#endif
+
 void fill_lb_gpios(struct lb_gpios *gpios)
 {
 	struct lb_gpio chromeos_gpios[] = {
@@ -33,3 +40,9 @@ void mainboard_chromeos_acpi_generate(void)
 {
 	chromeos_acpi_gpio_generate(cros_gpios, ARRAY_SIZE(cros_gpios));
 }
+
+int get_ec_is_trusted(void)
+{
+	/* EC is trusted if not in RW. */
+	return !get_gpio(EC_IN_RW_GPIO);
+}
diff --git a/src/mainboard/google/beltino/chromeos.c b/src/mainboard/google/beltino/chromeos.c
index ce3030daf5..db646495de 100644
--- a/src/mainboard/google/beltino/chromeos.c
+++ b/src/mainboard/google/beltino/chromeos.c
@@ -74,3 +74,10 @@ void mainboard_chromeos_acpi_generate(void)
 {
 	chromeos_acpi_gpio_generate(cros_gpios, ARRAY_SIZE(cros_gpios));
 }
+
+int get_ec_is_trusted(void)
+{
+	/* Do not have a Chrome EC involved in entering recovery mode;
+	   Always return trusted. */
+	return 1;
+}
diff --git a/src/mainboard/google/brya/chromeos.c b/src/mainboard/google/brya/chromeos.c
index bf7f9eb21f..cb636c616a 100644
--- a/src/mainboard/google/brya/chromeos.c
+++ b/src/mainboard/google/brya/chromeos.c
@@ -31,3 +31,9 @@ void mainboard_chromeos_acpi_generate(void)
 	gpios = variant_cros_gpios(&num);
 	chromeos_acpi_gpio_generate(gpios, num);
 }
+
+int get_ec_is_trusted(void)
+{
+	/* EC is trusted if not in RW. */
+	return !gpio_get(GPIO_EC_IN_RW);
+}
diff --git a/src/mainboard/google/butterfly/chromeos.c b/src/mainboard/google/butterfly/chromeos.c
index 83b6ba04c4..a7d56aee4a 100644
--- a/src/mainboard/google/butterfly/chromeos.c
+++ b/src/mainboard/google/butterfly/chromeos.c
@@ -64,3 +64,10 @@ void mainboard_chromeos_acpi_generate(void)
 
 	chromeos_acpi_gpio_generate(cros_gpios, ARRAY_SIZE(cros_gpios));
 }
+
+int get_ec_is_trusted(void)
+{
+	/* Do not have a Chrome EC involved in entering recovery mode;
+	   Always return trusted. */
+	return 1;
+}
diff --git a/src/mainboard/google/cherry/chromeos.c b/src/mainboard/google/cherry/chromeos.c
index 748e06e28d..13b673cf07 100644
--- a/src/mainboard/google/cherry/chromeos.c
+++ b/src/mainboard/google/cherry/chromeos.c
@@ -59,3 +59,9 @@ int tis_plat_irq_status(void)
 {
 	return gpio_eint_poll(GPIO_GSC_AP_INT);
 }
+
+int get_ec_is_trusted(void)
+{
+	/* EC is trusted if not in RW. This is active low. */
+	return !!gpio_get(GPIO_EC_IN_RW);
+}
diff --git a/src/mainboard/google/cyan/chromeos.c b/src/mainboard/google/cyan/chromeos.c
index f0c1446160..a11b6f9f63 100644
--- a/src/mainboard/google/cyan/chromeos.c
+++ b/src/mainboard/google/cyan/chromeos.c
@@ -64,3 +64,10 @@ void mainboard_chromeos_acpi_generate(void)
 {
 	chromeos_acpi_gpio_generate(cros_gpios, ARRAY_SIZE(cros_gpios));
 }
+
+int get_ec_is_trusted(void)
+{
+	/* Do not have a Chrome EC involved in entering recovery mode;
+	   Always return trusted. */
+	return 1;
+}
diff --git a/src/mainboard/google/daisy/chromeos.c b/src/mainboard/google/daisy/chromeos.c
index 00fa126434..c32c3b0f1e 100644
--- a/src/mainboard/google/daisy/chromeos.c
+++ b/src/mainboard/google/daisy/chromeos.c
@@ -38,3 +38,9 @@ int get_write_protect_state(void)
 {
 	return !gpio_get_value(GPIO_D16);
 }
+
+int get_ec_is_trusted(void)
+{
+	/* EC is trusted if not in RW. */
+	return !gpio_get_value(GPIO_D17);
+}
diff --git a/src/mainboard/google/dedede/chromeos.c b/src/mainboard/google/dedede/chromeos.c
index e5ae163809..ad37b204bb 100644
--- a/src/mainboard/google/dedede/chromeos.c
+++ b/src/mainboard/google/dedede/chromeos.c
@@ -32,3 +32,9 @@ void mainboard_chromeos_acpi_generate(void)
 	gpios = variant_cros_gpios(&num);
 	chromeos_acpi_gpio_generate(gpios, num);
 }
+
+int get_ec_is_trusted(void)
+{
+	/* EC is trusted if not in RW. */
+	return !gpio_get(GPIO_EC_IN_RW);
+}
diff --git a/src/mainboard/google/dedede/variants/baseboard/gpio.c b/src/mainboard/google/dedede/variants/baseboard/gpio.c
index 864bb29cf7..3bee32074a 100644
--- a/src/mainboard/google/dedede/variants/baseboard/gpio.c
+++ b/src/mainboard/google/dedede/variants/baseboard/gpio.c
@@ -423,6 +423,9 @@ static const struct pad_config early_gpio_table[] = {
 	/* C5  : RAM_STRAP_3 */
 	PAD_CFG_GPI(GPP_C5, NONE, DEEP),
 
+	/* C14 : EC_IN_RW_OD */
+	PAD_CFG_GPI(GPP_C14, NONE, DEEP),
+
 	/* C20 : UART2 RX */
 	PAD_CFG_NF(GPP_C20, NONE, DEEP, NF1),
 	/* C21 : UART2 TX */
diff --git a/src/mainboard/google/deltaur/chromeos.c b/src/mainboard/google/deltaur/chromeos.c
index 7083c802fb..2be5295117 100644
--- a/src/mainboard/google/deltaur/chromeos.c
+++ b/src/mainboard/google/deltaur/chromeos.c
@@ -98,3 +98,10 @@ void mainboard_prepare_cr50_reset(void)
 	if (ENV_RAMSTAGE)
 		pmc_soc_set_afterg3_en(true);
 }
+
+int get_ec_is_trusted(void)
+{
+	/* Do not have a Chrome EC involved in entering recovery mode;
+	   Always return trusted. */
+	return 1;
+}
diff --git a/src/mainboard/google/drallion/chromeos.c b/src/mainboard/google/drallion/chromeos.c
index 726736a5cf..58ad3c32c2 100644
--- a/src/mainboard/google/drallion/chromeos.c
+++ b/src/mainboard/google/drallion/chromeos.c
@@ -97,3 +97,10 @@ void mainboard_prepare_cr50_reset(void)
 	pmc_soc_set_afterg3_en(true);
 #endif
 }
+
+int get_ec_is_trusted(void)
+{
+	/* Do not have a Chrome EC involved in entering recovery mode;
+	   Always return trusted. */
+	return 1;
+}
diff --git a/src/mainboard/google/eve/chromeos.c b/src/mainboard/google/eve/chromeos.c
index 7c0cc96b3b..bc458dea77 100644
--- a/src/mainboard/google/eve/chromeos.c
+++ b/src/mainboard/google/eve/chromeos.c
@@ -36,3 +36,9 @@ void mainboard_chromeos_acpi_generate(void)
 {
 	chromeos_acpi_gpio_generate(cros_gpios, ARRAY_SIZE(cros_gpios));
 }
+
+int get_ec_is_trusted(void)
+{
+	/* EC is trusted if not in RW. */
+	return !gpio_get(GPIO_EC_IN_RW);
+}
diff --git a/src/mainboard/google/eve/gpio.h b/src/mainboard/google/eve/gpio.h
index 607486be4c..ad77eb5ffa 100644
--- a/src/mainboard/google/eve/gpio.h
+++ b/src/mainboard/google/eve/gpio.h
@@ -225,6 +225,9 @@ static const struct pad_config early_gpio_table[] = {
 /* Ensure UART pins are in native mode for H1 */
 /* UART2_RXD */		PAD_CFG_NF(GPP_C20, NONE, DEEP, NF1), /* SERVO */
 /* UART2_TXD */		PAD_CFG_NF(GPP_C21, NONE, DEEP, NF1), /* SERVO */
+
+/* SM1CLK */		PAD_CFG_GPI_GPIO_DRIVER(GPP_C6, UP_20K,
+						DEEP), /* EC_IN_RW */
 };
 
 #endif
diff --git a/src/mainboard/google/fizz/chromeos.c b/src/mainboard/google/fizz/chromeos.c
index 5ee822c22a..d10a59f610 100644
--- a/src/mainboard/google/fizz/chromeos.c
+++ b/src/mainboard/google/fizz/chromeos.c
@@ -36,3 +36,9 @@ void mainboard_chromeos_acpi_generate(void)
 	gpios = variant_cros_gpios(&num);
 	chromeos_acpi_gpio_generate(gpios, num);
 }
+
+int get_ec_is_trusted(void)
+{
+	/* EC is trusted if not in RW. */
+	return !gpio_get(GPIO_EC_IN_RW);
+}
diff --git a/src/mainboard/google/fizz/variants/baseboard/gpio.c b/src/mainboard/google/fizz/variants/baseboard/gpio.c
index 71546aaeba..4787d2df5a 100644
--- a/src/mainboard/google/fizz/variants/baseboard/gpio.c
+++ b/src/mainboard/google/fizz/variants/baseboard/gpio.c
@@ -241,6 +241,9 @@ static const struct pad_config early_gpio_table[] = {
 /* SATAXPCIE1 */       PAD_CFG_NF(GPP_E1, NONE, DEEP,
 				  NF1), /* MB_PCIE_SATA#_DET */
 /* SATA_DEVSLP1 */     PAD_CFG_NF(GPP_E5, NONE, DEEP, NF1), /* DEVSLP1_MB */
+
+/* SM1CLK */		PAD_CFG_GPI_GPIO_DRIVER(GPP_C6, UP_20K,
+						DEEP), /* EC_IN_RW */
 };
 
 const struct pad_config * __weak variant_gpio_table(size_t *num)
diff --git a/src/mainboard/google/fizz/variants/karma/gpio.c b/src/mainboard/google/fizz/variants/karma/gpio.c
index 2735fed671..8b88f23640 100644
--- a/src/mainboard/google/fizz/variants/karma/gpio.c
+++ b/src/mainboard/google/fizz/variants/karma/gpio.c
@@ -245,6 +245,9 @@ static const struct pad_config early_gpio_table[] = {
 /* SATAXPCIE1 */       PAD_CFG_NF(GPP_E1, NONE, DEEP,
 				  NF1), /* MB_PCIE_SATA#_DET */
 /* SATA_DEVSLP1 */     PAD_CFG_NF(GPP_E5, NONE, DEEP, NF1), /* DEVSLP1_MB */
+
+/* SM1CLK */		PAD_CFG_GPI_GPIO_DRIVER(GPP_C6, UP_20K,
+						DEEP), /* EC_IN_RW */
 };
 
 const struct pad_config *variant_gpio_table(size_t *num)
diff --git a/src/mainboard/google/foster/chromeos.c b/src/mainboard/google/foster/chromeos.c
index 4e744f116f..9ac4cf0168 100644
--- a/src/mainboard/google/foster/chromeos.c
+++ b/src/mainboard/google/foster/chromeos.c
@@ -26,3 +26,10 @@ int get_write_protect_state(void)
 {
 	return 0;
 }
+
+int get_ec_is_trusted(void)
+{
+	/* Do not have a Chrome EC involved in entering recovery mode;
+	   Always return trusted. */
+	return 1;
+}
diff --git a/src/mainboard/google/gale/chromeos.c b/src/mainboard/google/gale/chromeos.c
index 2987e91d06..54646406b9 100644
--- a/src/mainboard/google/gale/chromeos.c
+++ b/src/mainboard/google/gale/chromeos.c
@@ -157,3 +157,10 @@ int get_write_protect_state(void)
 {
 	return !read_gpio(get_wp_status_gpio_pin());
 }
+
+int get_ec_is_trusted(void)
+{
+	/* Do not have a Chrome EC involved in entering recovery mode;
+	   Always return trusted. */
+	return 1;
+}
diff --git a/src/mainboard/google/glados/chromeos.c b/src/mainboard/google/glados/chromeos.c
index 1dff1caba6..1adaed412f 100644
--- a/src/mainboard/google/glados/chromeos.c
+++ b/src/mainboard/google/glados/chromeos.c
@@ -35,3 +35,9 @@ void mainboard_chromeos_acpi_generate(void)
 {
 	chromeos_acpi_gpio_generate(cros_gpios, ARRAY_SIZE(cros_gpios));
 }
+
+int get_ec_is_trusted(void)
+{
+	/* EC is trusted if not in RW. */
+	return !gpio_get(GPIO_EC_IN_RW);
+}
diff --git a/src/mainboard/google/glados/variants/asuka/include/variant/gpio.h b/src/mainboard/google/glados/variants/asuka/include/variant/gpio.h
index 17c24a2ed7..d21d9e756a 100644
--- a/src/mainboard/google/glados/variants/asuka/include/variant/gpio.h
+++ b/src/mainboard/google/glados/variants/asuka/include/variant/gpio.h
@@ -219,6 +219,7 @@ static const struct pad_config early_gpio_table[] = {
 /* SPI_WP_STATUS */	PAD_CFG_GPI_GPIO_DRIVER(GPP_C23, UP_20K, DEEP),
 /* GD_UART2_RXD */	PAD_CFG_NF(GPP_C20, NONE, DEEP, NF1),
 /* GD_UART2_TXD */	PAD_CFG_NF(GPP_C21, NONE, DEEP, NF1),
+/* EC_IN_RW */		PAD_CFG_GPI_GPIO_DRIVER(GPP_C6, NONE, DEEP),
 };
 
 #endif
diff --git a/src/mainboard/google/glados/variants/caroline/include/variant/gpio.h b/src/mainboard/google/glados/variants/caroline/include/variant/gpio.h
index f570006180..95d2d043b7 100644
--- a/src/mainboard/google/glados/variants/caroline/include/variant/gpio.h
+++ b/src/mainboard/google/glados/variants/caroline/include/variant/gpio.h
@@ -236,6 +236,7 @@ static const struct pad_config early_gpio_table[] = {
 /* UART2_CTS# */	PAD_CFG_GPI_GPIO_DRIVER(GPP_C23, UP_20K, DEEP), /* PCH_WP */
 /* GD_UART2_RXD */	PAD_CFG_NF(GPP_C20, NONE, DEEP, NF1),
 /* GD_UART2_TXD */	PAD_CFG_NF(GPP_C21, NONE, DEEP, NF1),
+/* SM1CLK */		PAD_CFG_GPI_GPIO_DRIVER(GPP_C6, UP_20K, DEEP), /* EC_IN_RW */
 };
 
 #endif
diff --git a/src/mainboard/google/glados/variants/cave/include/variant/gpio.h b/src/mainboard/google/glados/variants/cave/include/variant/gpio.h
index 45e1f67531..cd71ebac2f 100644
--- a/src/mainboard/google/glados/variants/cave/include/variant/gpio.h
+++ b/src/mainboard/google/glados/variants/cave/include/variant/gpio.h
@@ -228,6 +228,7 @@ static const struct pad_config early_gpio_table[] = {
 /* UART2_CTS# */	PAD_CFG_GPI_GPIO_DRIVER(GPP_C23, UP_20K, DEEP), /* PCH_WP */
 /* GD_UART2_RXD */	PAD_CFG_NF(GPP_C20, NONE, DEEP, NF1),
 /* GD_UART2_TXD */	PAD_CFG_NF(GPP_C21, NONE, DEEP, NF1),
+/* SM1CLK */		PAD_CFG_GPI_GPIO_DRIVER(GPP_C6, UP_20K, DEEP), /* EC_IN_RW */
 };
 
 #endif
diff --git a/src/mainboard/google/glados/variants/chell/include/variant/gpio.h b/src/mainboard/google/glados/variants/chell/include/variant/gpio.h
index 1c92e51df9..ce78ed3856 100644
--- a/src/mainboard/google/glados/variants/chell/include/variant/gpio.h
+++ b/src/mainboard/google/glados/variants/chell/include/variant/gpio.h
@@ -224,6 +224,7 @@ static const struct pad_config early_gpio_table[] = {
 /* UART2_CTS# */	PAD_CFG_GPI_GPIO_DRIVER(GPP_C23, UP_20K, DEEP), /* PCH_WP */
 /* GD_UART2_RXD */	PAD_CFG_NF(GPP_C20, NONE, DEEP, NF1),
 /* GD_UART2_TXD */	PAD_CFG_NF(GPP_C21, NONE, DEEP, NF1),
+/* SM1CLK */		PAD_CFG_GPI_GPIO_DRIVER(GPP_C6, UP_20K, DEEP), /* EC_IN_RW */
 };
 
 #endif
diff --git a/src/mainboard/google/glados/variants/glados/include/variant/gpio.h b/src/mainboard/google/glados/variants/glados/include/variant/gpio.h
index a7bcdd7435..fc4eebde0a 100644
--- a/src/mainboard/google/glados/variants/glados/include/variant/gpio.h
+++ b/src/mainboard/google/glados/variants/glados/include/variant/gpio.h
@@ -226,6 +226,8 @@ static const struct pad_config early_gpio_table[] = {
 /* UART0_CTS# */	PAD_CFG_GPO(GPP_C11, 0, DEEP), /* EN_PP3300_KEPLER */
 /* GD_UART2_RXD */	PAD_CFG_NF(GPP_C20, NONE, DEEP, NF1),
 /* GD_UART2_TXD */	PAD_CFG_NF(GPP_C21, NONE, DEEP, NF1),
+/* SM1CLK */		PAD_CFG_GPI_GPIO_DRIVER(GPP_C6, UP_20K,
+						DEEP), /* EC_IN_RW */
 };
 
 #endif
diff --git a/src/mainboard/google/glados/variants/lars/include/variant/gpio.h b/src/mainboard/google/glados/variants/lars/include/variant/gpio.h
index acbf157ac0..51514b22d9 100644
--- a/src/mainboard/google/glados/variants/lars/include/variant/gpio.h
+++ b/src/mainboard/google/glados/variants/lars/include/variant/gpio.h
@@ -215,6 +215,7 @@ static const struct pad_config early_gpio_table[] = {
 /* SPI_WP_STATUS */	PAD_CFG_GPI_GPIO_DRIVER(GPP_C23, UP_20K, DEEP),
 /* GD_UART2_RXD */	PAD_CFG_NF(GPP_C20, NONE, DEEP, NF1),
 /* GD_UART2_TXD */	PAD_CFG_NF(GPP_C21, NONE, DEEP, NF1),
+/* EC_IN_RW */		PAD_CFG_GPI_GPIO_DRIVER(GPP_C6, NONE, DEEP),
 };
 
 #endif
diff --git a/src/mainboard/google/glados/variants/sentry/include/variant/gpio.h b/src/mainboard/google/glados/variants/sentry/include/variant/gpio.h
index a2052a3379..b4011c705b 100644
--- a/src/mainboard/google/glados/variants/sentry/include/variant/gpio.h
+++ b/src/mainboard/google/glados/variants/sentry/include/variant/gpio.h
@@ -223,6 +223,7 @@ static const struct pad_config early_gpio_table[] = {
 /* UART0_CTS# */	PAD_CFG_GPO(GPP_C11, 0, DEEP), /* EN_PP3300_KEPLER */
 /* GD_UART2_RXD */	PAD_CFG_NF(GPP_C20, NONE, DEEP, NF1),
 /* GD_UART2_TXD */	PAD_CFG_NF(GPP_C21, NONE, DEEP, NF1),
+/* EC_IN_RW */		PAD_CFG_GPI_GPIO_DRIVER(GPP_C6, NONE, DEEP),
 };
 
 #endif
diff --git a/src/mainboard/google/gru/chromeos.c b/src/mainboard/google/gru/chromeos.c
index 688c0dd27a..479ca3d85d 100644
--- a/src/mainboard/google/gru/chromeos.c
+++ b/src/mainboard/google/gru/chromeos.c
@@ -49,3 +49,9 @@ int tis_plat_irq_status(void)
 	return gpio_irq_status(GPIO_TPM_IRQ);
 }
 #endif
+
+int get_ec_is_trusted(void)
+{
+	/* EC is trusted if not in RW. */
+	return !gpio_get(GPIO_EC_IN_RW);
+}
diff --git a/src/mainboard/google/guybrush/chromeos.c b/src/mainboard/google/guybrush/chromeos.c
index 3e54fa4964..9875554d64 100644
--- a/src/mainboard/google/guybrush/chromeos.c
+++ b/src/mainboard/google/guybrush/chromeos.c
@@ -1,6 +1,7 @@
 /* SPDX-License-Identifier: GPL-2.0-or-later */
 
 #include <baseboard/gpio.h>
+#include <boardid.h>
 #include <bootmode.h>
 #include <boot/coreboot_tables.h>
 #include <gpio.h>
@@ -26,3 +27,14 @@ void mainboard_chromeos_acpi_generate(void)
 {
 	chromeos_acpi_gpio_generate(cros_gpios, ARRAY_SIZE(cros_gpios));
 }
+
+int get_ec_is_trusted(void)
+{
+	/* Board versions 1 & 2 support H1 DB, but the EC_IN_RW signal is not
+	   routed. So emulate EC is trusted. */
+	if (CONFIG(BOARD_GOOGLE_GUYBRUSH) &&
+	    (board_id() == UNDEFINED_STRAPPING_ID || board_id() < 3))
+		return 1;
+	/* EC is trusted if not in RW. */
+	return !gpio_get(GPIO_EC_IN_RW);
+}
diff --git a/src/mainboard/google/hatch/chromeos.c b/src/mainboard/google/hatch/chromeos.c
index 3401b82d97..3f585c9ebe 100644
--- a/src/mainboard/google/hatch/chromeos.c
+++ b/src/mainboard/google/hatch/chromeos.c
@@ -36,3 +36,9 @@ void mainboard_chromeos_acpi_generate(void)
 
 	chromeos_acpi_gpio_generate(cros_gpios, num_gpios);
 }
+
+int get_ec_is_trusted(void)
+{
+	/* EC is trusted if not in RW. */
+	return !gpio_get(GPIO_EC_IN_RW);
+}
diff --git a/src/mainboard/google/hatch/variants/akemi/gpio.c b/src/mainboard/google/hatch/variants/akemi/gpio.c
index b08f062186..d7fe09e264 100644
--- a/src/mainboard/google/hatch/variants/akemi/gpio.c
+++ b/src/mainboard/google/hatch/variants/akemi/gpio.c
@@ -162,6 +162,8 @@ static const struct pad_config early_gpio_table[] = {
 	PAD_CFG_GPI(GPP_C20, NONE, DEEP),
 	/* C21 : H1_PCH_INT_ODL */
 	PAD_CFG_GPI_APIC(GPP_C21, NONE, PLTRST, LEVEL, INVERT),
+	/* C22 : EC_IN_RW_OD */
+	PAD_CFG_GPI(GPP_C22, NONE, DEEP),
 	/* C23 : WLAN_PE_RST# */
 	PAD_CFG_GPO(GPP_C23, 1, DEEP),
 	/* E1  : M2_SSD_PEDET */
diff --git a/src/mainboard/google/hatch/variants/ambassador/gpio.c b/src/mainboard/google/hatch/variants/ambassador/gpio.c
index 5a911fc4f9..996edc4fc7 100644
--- a/src/mainboard/google/hatch/variants/ambassador/gpio.c
+++ b/src/mainboard/google/hatch/variants/ambassador/gpio.c
@@ -100,6 +100,8 @@ static const struct pad_config early_gpio_table[] = {
 	PAD_CFG_GPI(GPP_C20, NONE, DEEP),
 	/* C21 : H1_PCH_INT_ODL */
 	PAD_CFG_GPI_APIC(GPP_C21, NONE, PLTRST, LEVEL, INVERT),
+	/* C22 : EC_IN_RW_OD */
+	PAD_CFG_GPI(GPP_C22, NONE, DEEP),
 	/* C23 : WLAN_PE_RST# */
 	PAD_CFG_GPO(GPP_C23, 1, DEEP),
 	/* E1  : M2_SSD_PEDET */
diff --git a/src/mainboard/google/hatch/variants/dooly/gpio.c b/src/mainboard/google/hatch/variants/dooly/gpio.c
index d28f1fe86b..37cd08cdae 100644
--- a/src/mainboard/google/hatch/variants/dooly/gpio.c
+++ b/src/mainboard/google/hatch/variants/dooly/gpio.c
@@ -137,6 +137,8 @@ static const struct pad_config early_gpio_table[] = {
 	PAD_CFG_GPI(GPP_C20, NONE, DEEP),
 	/* C21 : H1_PCH_INT_ODL */
 	PAD_CFG_GPI_APIC(GPP_C21, NONE, PLTRST, LEVEL, INVERT),
+	/* C22 : EC_IN_RW_OD */
+	PAD_CFG_GPI(GPP_C22, NONE, DEEP),
 	/* C23 : WLAN_PE_RST# */
 	PAD_CFG_GPO(GPP_C23, 1, DEEP),
 	/* E1  : M2_SSD_PEDET */
diff --git a/src/mainboard/google/hatch/variants/dratini/gpio.c b/src/mainboard/google/hatch/variants/dratini/gpio.c
index 712a9185d0..02555a0369 100644
--- a/src/mainboard/google/hatch/variants/dratini/gpio.c
+++ b/src/mainboard/google/hatch/variants/dratini/gpio.c
@@ -86,6 +86,8 @@ static const struct pad_config early_gpio_table[] = {
 	PAD_CFG_GPI(GPP_C20, NONE, DEEP),
 	/* C21 : H1_PCH_INT_ODL */
 	PAD_CFG_GPI_APIC(GPP_C21, NONE, PLTRST, LEVEL, INVERT),
+	/* C22 : EC_IN_RW_OD */
+	PAD_CFG_GPI(GPP_C22, NONE, DEEP),
 	/* C23 : WLAN_PE_RST# */
 	PAD_CFG_GPO(GPP_C23, 1, DEEP),
 	/* E1  : M2_SSD_PEDET */
diff --git a/src/mainboard/google/hatch/variants/duffy/gpio.c b/src/mainboard/google/hatch/variants/duffy/gpio.c
index 5a911fc4f9..996edc4fc7 100644
--- a/src/mainboard/google/hatch/variants/duffy/gpio.c
+++ b/src/mainboard/google/hatch/variants/duffy/gpio.c
@@ -100,6 +100,8 @@ static const struct pad_config early_gpio_table[] = {
 	PAD_CFG_GPI(GPP_C20, NONE, DEEP),
 	/* C21 : H1_PCH_INT_ODL */
 	PAD_CFG_GPI_APIC(GPP_C21, NONE, PLTRST, LEVEL, INVERT),
+	/* C22 : EC_IN_RW_OD */
+	PAD_CFG_GPI(GPP_C22, NONE, DEEP),
 	/* C23 : WLAN_PE_RST# */
 	PAD_CFG_GPO(GPP_C23, 1, DEEP),
 	/* E1  : M2_SSD_PEDET */
diff --git a/src/mainboard/google/hatch/variants/faffy/gpio.c b/src/mainboard/google/hatch/variants/faffy/gpio.c
index 5a911fc4f9..996edc4fc7 100644
--- a/src/mainboard/google/hatch/variants/faffy/gpio.c
+++ b/src/mainboard/google/hatch/variants/faffy/gpio.c
@@ -100,6 +100,8 @@ static const struct pad_config early_gpio_table[] = {
 	PAD_CFG_GPI(GPP_C20, NONE, DEEP),
 	/* C21 : H1_PCH_INT_ODL */
 	PAD_CFG_GPI_APIC(GPP_C21, NONE, PLTRST, LEVEL, INVERT),
+	/* C22 : EC_IN_RW_OD */
+	PAD_CFG_GPI(GPP_C22, NONE, DEEP),
 	/* C23 : WLAN_PE_RST# */
 	PAD_CFG_GPO(GPP_C23, 1, DEEP),
 	/* E1  : M2_SSD_PEDET */
diff --git a/src/mainboard/google/hatch/variants/genesis/gpio.c b/src/mainboard/google/hatch/variants/genesis/gpio.c
index cb5c89b89e..66a1b8aec1 100644
--- a/src/mainboard/google/hatch/variants/genesis/gpio.c
+++ b/src/mainboard/google/hatch/variants/genesis/gpio.c
@@ -128,6 +128,8 @@ static const struct pad_config early_gpio_table[] = {
 	PAD_CFG_GPI(GPP_C20, NONE, DEEP),
 	/* C21 : H1_PCH_INT_ODL */
 	PAD_CFG_GPI_APIC(GPP_C21, NONE, PLTRST, LEVEL, INVERT),
+	/* C22 : EC_IN_RW_OD */
+	PAD_CFG_GPI(GPP_C22, NONE, DEEP),
 	/* C23 : WLAN_PE_RST# */
 	PAD_CFG_GPO(GPP_C23, 1, DEEP),
 	/* E1  : M2_SSD_PEDET */
diff --git a/src/mainboard/google/hatch/variants/hatch/gpio.c b/src/mainboard/google/hatch/variants/hatch/gpio.c
index cfd324892d..dbe72dd888 100644
--- a/src/mainboard/google/hatch/variants/hatch/gpio.c
+++ b/src/mainboard/google/hatch/variants/hatch/gpio.c
@@ -60,6 +60,8 @@ static const struct pad_config early_gpio_table[] = {
 	PAD_CFG_GPI(GPP_C20, NONE, DEEP),
 	/* C21 : H1_PCH_INT_ODL */
 	PAD_CFG_GPI_APIC(GPP_C21, NONE, PLTRST, LEVEL, INVERT),
+	/* C22 : EC_IN_RW_OD */
+	PAD_CFG_GPI(GPP_C22, NONE, DEEP),
 	/* C23 : WLAN_PE_RST# */
 	PAD_CFG_GPO(GPP_C23, 1, DEEP),
 	/* E1  : M2_SSD_PEDET */
diff --git a/src/mainboard/google/hatch/variants/helios/gpio.c b/src/mainboard/google/hatch/variants/helios/gpio.c
index 9885802140..f7c5e8f59a 100644
--- a/src/mainboard/google/hatch/variants/helios/gpio.c
+++ b/src/mainboard/google/hatch/variants/helios/gpio.c
@@ -124,6 +124,8 @@ static const struct pad_config early_gpio_table[] = {
 	PAD_CFG_GPI(GPP_C20, NONE, DEEP),
 	/* C21 : H1_PCH_INT_ODL */
 	PAD_CFG_GPI_APIC(GPP_C21, NONE, PLTRST, LEVEL, INVERT),
+	/* C22 : EC_IN_RW_OD */
+	PAD_CFG_GPI(GPP_C22, NONE, DEEP),
 	/* E1  : M2_SSD_PEDET */
 	PAD_CFG_NF(GPP_E1, NONE, DEEP, NF1),
 	/* E5  : SATA_DEVSLP1 */
diff --git a/src/mainboard/google/hatch/variants/jinlon/gpio.c b/src/mainboard/google/hatch/variants/jinlon/gpio.c
index a0658b091a..1020dd6ecf 100644
--- a/src/mainboard/google/hatch/variants/jinlon/gpio.c
+++ b/src/mainboard/google/hatch/variants/jinlon/gpio.c
@@ -90,6 +90,8 @@ static const struct pad_config early_gpio_table[] = {
 	PAD_CFG_GPI(GPP_C20, NONE, DEEP),
 	/* C21 : H1_PCH_INT_ODL */
 	PAD_CFG_GPI_APIC(GPP_C21, NONE, PLTRST, LEVEL, INVERT),
+	/* C22 : EC_IN_RW_OD */
+	PAD_CFG_GPI(GPP_C22, NONE, DEEP),
 	/* C23 : WLAN_PE_RST# */
 	PAD_CFG_GPO(GPP_C23, 1, DEEP),
 	/* E1  : M2_SSD_PEDET */
diff --git a/src/mainboard/google/hatch/variants/kaisa/gpio.c b/src/mainboard/google/hatch/variants/kaisa/gpio.c
index 5a911fc4f9..996edc4fc7 100644
--- a/src/mainboard/google/hatch/variants/kaisa/gpio.c
+++ b/src/mainboard/google/hatch/variants/kaisa/gpio.c
@@ -100,6 +100,8 @@ static const struct pad_config early_gpio_table[] = {
 	PAD_CFG_GPI(GPP_C20, NONE, DEEP),
 	/* C21 : H1_PCH_INT_ODL */
 	PAD_CFG_GPI_APIC(GPP_C21, NONE, PLTRST, LEVEL, INVERT),
+	/* C22 : EC_IN_RW_OD */
+	PAD_CFG_GPI(GPP_C22, NONE, DEEP),
 	/* C23 : WLAN_PE_RST# */
 	PAD_CFG_GPO(GPP_C23, 1, DEEP),
 	/* E1  : M2_SSD_PEDET */
diff --git a/src/mainboard/google/hatch/variants/kindred/gpio.c b/src/mainboard/google/hatch/variants/kindred/gpio.c
index b147e41118..0d55730076 100644
--- a/src/mainboard/google/hatch/variants/kindred/gpio.c
+++ b/src/mainboard/google/hatch/variants/kindred/gpio.c
@@ -220,6 +220,8 @@ static const struct pad_config early_gpio_table[] = {
 	PAD_CFG_GPI(GPP_C20, NONE, DEEP),
 	/* C21 : H1_PCH_INT_ODL */
 	PAD_CFG_GPI_APIC(GPP_C21, NONE, PLTRST, LEVEL, INVERT),
+	/* C22 : EC_IN_RW_OD */
+	PAD_CFG_GPI(GPP_C22, NONE, DEEP),
 	/* C23 : WLAN_PE_RST# */
 	PAD_CFG_GPO(GPP_C23, 1, DEEP),
 	/* E1  : M2_SSD_PEDET */
diff --git a/src/mainboard/google/hatch/variants/kohaku/gpio.c b/src/mainboard/google/hatch/variants/kohaku/gpio.c
index d45e9cb0ff..aa86932426 100644
--- a/src/mainboard/google/hatch/variants/kohaku/gpio.c
+++ b/src/mainboard/google/hatch/variants/kohaku/gpio.c
@@ -106,6 +106,8 @@ static const struct pad_config early_gpio_table[] = {
 	PAD_CFG_GPI(GPP_C20, NONE, DEEP),
 	/* C21 : H1_PCH_INT_ODL */
 	PAD_CFG_GPI_APIC(GPP_C21, NONE, PLTRST, LEVEL, INVERT),
+	/* C22 : EC_IN_RW_OD */
+	PAD_CFG_GPI(GPP_C22, NONE, DEEP),
 	/* E1  : M2_SSD_PEDET */
 	PAD_CFG_NF(GPP_E1, NONE, DEEP, NF1),
 	/* E5  : SATA_DEVSLP1 */
diff --git a/src/mainboard/google/hatch/variants/moonbuggy/gpio.c b/src/mainboard/google/hatch/variants/moonbuggy/gpio.c
index 759768b3c8..ba75fb768d 100644
--- a/src/mainboard/google/hatch/variants/moonbuggy/gpio.c
+++ b/src/mainboard/google/hatch/variants/moonbuggy/gpio.c
@@ -126,6 +126,8 @@ static const struct pad_config early_gpio_table[] = {
 	PAD_CFG_GPI(GPP_C20, NONE, DEEP),
 	/* C21 : H1_PCH_INT_ODL */
 	PAD_CFG_GPI_APIC(GPP_C21, NONE, PLTRST, LEVEL, INVERT),
+	/* C22 : EC_IN_RW_OD */
+	PAD_CFG_GPI(GPP_C22, NONE, DEEP),
 	/* C23 : WLAN_PE_RST# */
 	PAD_CFG_GPO(GPP_C23, 1, DEEP),
 	/* E1  : M2_SSD_PEDET */
diff --git a/src/mainboard/google/hatch/variants/mushu/gpio.c b/src/mainboard/google/hatch/variants/mushu/gpio.c
index 582d68e6a2..4ead952c14 100644
--- a/src/mainboard/google/hatch/variants/mushu/gpio.c
+++ b/src/mainboard/google/hatch/variants/mushu/gpio.c
@@ -64,6 +64,8 @@ static const struct pad_config early_gpio_table[] = {
 	PAD_CFG_GPI(GPP_C20, NONE, DEEP),
 	/* C21 : H1_PCH_INT_ODL */
 	PAD_CFG_GPI_APIC(GPP_C21, NONE, PLTRST, LEVEL, INVERT),
+	/* C22 : EC_IN_RW_OD */
+	PAD_CFG_GPI(GPP_C22, NONE, DEEP),
 	/* C23 : WLAN_PE_RST# */
 	PAD_CFG_GPO(GPP_C23, 1, DEEP),
 	/* E1  : M2_SSD_PEDET */
diff --git a/src/mainboard/google/hatch/variants/nightfury/gpio.c b/src/mainboard/google/hatch/variants/nightfury/gpio.c
index 1ab10a84af..a813dfa577 100644
--- a/src/mainboard/google/hatch/variants/nightfury/gpio.c
+++ b/src/mainboard/google/hatch/variants/nightfury/gpio.c
@@ -120,6 +120,8 @@ static const struct pad_config early_gpio_table[] = {
 	PAD_CFG_GPI(GPP_C20, NONE, DEEP),
 	/* C21 : H1_PCH_INT_ODL */
 	PAD_CFG_GPI_APIC(GPP_C21, NONE, PLTRST, LEVEL, INVERT),
+	/* C22 : EC_IN_RW_OD */
+	PAD_CFG_GPI(GPP_C22, NONE, DEEP),
 	/* E1  : M2_SSD_PEDET */
 	PAD_CFG_NF(GPP_E1, NONE, DEEP, NF1),
 	/* E5  : SATA_DEVSLP1 */
diff --git a/src/mainboard/google/hatch/variants/noibat/gpio.c b/src/mainboard/google/hatch/variants/noibat/gpio.c
index 5a911fc4f9..996edc4fc7 100644
--- a/src/mainboard/google/hatch/variants/noibat/gpio.c
+++ b/src/mainboard/google/hatch/variants/noibat/gpio.c
@@ -100,6 +100,8 @@ static const struct pad_config early_gpio_table[] = {
 	PAD_CFG_GPI(GPP_C20, NONE, DEEP),
 	/* C21 : H1_PCH_INT_ODL */
 	PAD_CFG_GPI_APIC(GPP_C21, NONE, PLTRST, LEVEL, INVERT),
+	/* C22 : EC_IN_RW_OD */
+	PAD_CFG_GPI(GPP_C22, NONE, DEEP),
 	/* C23 : WLAN_PE_RST# */
 	PAD_CFG_GPO(GPP_C23, 1, DEEP),
 	/* E1  : M2_SSD_PEDET */
diff --git a/src/mainboard/google/hatch/variants/palkia/gpio.c b/src/mainboard/google/hatch/variants/palkia/gpio.c
index c4d6f50dd7..58ec12b582 100644
--- a/src/mainboard/google/hatch/variants/palkia/gpio.c
+++ b/src/mainboard/google/hatch/variants/palkia/gpio.c
@@ -128,6 +128,8 @@ static const struct pad_config early_gpio_table[] = {
 	PAD_CFG_GPI(GPP_C20, NONE, DEEP),
 	/* C21 : H1_PCH_INT_ODL */
 	PAD_CFG_GPI_APIC(GPP_C21, NONE, PLTRST, LEVEL, INVERT),
+	/* C22 : EC_IN_RW_OD */
+	PAD_CFG_GPI(GPP_C22, NONE, DEEP),
 	/* E1  : M2_SSD_PEDET */
 	PAD_CFG_NF(GPP_E1, NONE, DEEP, NF1),
 	/* E5  : SATA_DEVSLP1 */
diff --git a/src/mainboard/google/hatch/variants/puff/gpio.c b/src/mainboard/google/hatch/variants/puff/gpio.c
index 5a911fc4f9..996edc4fc7 100644
--- a/src/mainboard/google/hatch/variants/puff/gpio.c
+++ b/src/mainboard/google/hatch/variants/puff/gpio.c
@@ -100,6 +100,8 @@ static const struct pad_config early_gpio_table[] = {
 	PAD_CFG_GPI(GPP_C20, NONE, DEEP),
 	/* C21 : H1_PCH_INT_ODL */
 	PAD_CFG_GPI_APIC(GPP_C21, NONE, PLTRST, LEVEL, INVERT),
+	/* C22 : EC_IN_RW_OD */
+	PAD_CFG_GPI(GPP_C22, NONE, DEEP),
 	/* C23 : WLAN_PE_RST# */
 	PAD_CFG_GPO(GPP_C23, 1, DEEP),
 	/* E1  : M2_SSD_PEDET */
diff --git a/src/mainboard/google/hatch/variants/scout/gpio.c b/src/mainboard/google/hatch/variants/scout/gpio.c
index 5491efef9d..218d3db698 100644
--- a/src/mainboard/google/hatch/variants/scout/gpio.c
+++ b/src/mainboard/google/hatch/variants/scout/gpio.c
@@ -160,6 +160,8 @@ static const struct pad_config early_gpio_table[] = {
 	PAD_CFG_GPI(GPP_C20, NONE, DEEP),
 	/* C21 : H1_PCH_INT_ODL */
 	PAD_CFG_GPI_APIC(GPP_C21, NONE, PLTRST, LEVEL, INVERT),
+	/* C22 : EC_IN_RW_OD */
+	PAD_CFG_GPI(GPP_C22, NONE, DEEP),
 	/* C23 : WLAN_PE_RST# */
 	PAD_CFG_GPO(GPP_C23, 1, DEEP),
 	/* E1  : M2_SSD_PEDET */
diff --git a/src/mainboard/google/hatch/variants/stryke/gpio.c b/src/mainboard/google/hatch/variants/stryke/gpio.c
index fd8a55c09d..2734629efb 100644
--- a/src/mainboard/google/hatch/variants/stryke/gpio.c
+++ b/src/mainboard/google/hatch/variants/stryke/gpio.c
@@ -80,6 +80,8 @@ static const struct pad_config early_gpio_table[] = {
 	PAD_CFG_GPI(GPP_C20, NONE, DEEP),
 	/* C21 : H1_PCH_INT_ODL */
 	PAD_CFG_GPI_APIC(GPP_C21, NONE, PLTRST, LEVEL, INVERT),
+	/* C22 : EC_IN_RW_OD */
+	PAD_CFG_GPI(GPP_C22, NONE, DEEP),
 	/* C23 : WLAN_PE_RST# */
 	PAD_CFG_GPO(GPP_C23, 1, DEEP),
 	/* E1  : M2_SSD_PEDET */
diff --git a/src/mainboard/google/hatch/variants/wyvern/gpio.c b/src/mainboard/google/hatch/variants/wyvern/gpio.c
index 5a911fc4f9..996edc4fc7 100644
--- a/src/mainboard/google/hatch/variants/wyvern/gpio.c
+++ b/src/mainboard/google/hatch/variants/wyvern/gpio.c
@@ -100,6 +100,8 @@ static const struct pad_config early_gpio_table[] = {
 	PAD_CFG_GPI(GPP_C20, NONE, DEEP),
 	/* C21 : H1_PCH_INT_ODL */
 	PAD_CFG_GPI_APIC(GPP_C21, NONE, PLTRST, LEVEL, INVERT),
+	/* C22 : EC_IN_RW_OD */
+	PAD_CFG_GPI(GPP_C22, NONE, DEEP),
 	/* C23 : WLAN_PE_RST# */
 	PAD_CFG_GPO(GPP_C23, 1, DEEP),
 	/* E1  : M2_SSD_PEDET */
diff --git a/src/mainboard/google/herobrine/chromeos.c b/src/mainboard/google/herobrine/chromeos.c
index a11667586b..9faf4baf5f 100644
--- a/src/mainboard/google/herobrine/chromeos.c
+++ b/src/mainboard/google/herobrine/chromeos.c
@@ -24,3 +24,9 @@ void fill_lb_gpios(struct lb_gpios *gpios)
 
 	lb_add_gpios(gpios, chromeos_gpios, ARRAY_SIZE(chromeos_gpios));
 }
+
+int get_ec_is_trusted(void)
+{
+	/* Stub GPIO. */
+	return 0;
+}
diff --git a/src/mainboard/google/jecht/chromeos.c b/src/mainboard/google/jecht/chromeos.c
index 807e37fcb2..239134bc5f 100644
--- a/src/mainboard/google/jecht/chromeos.c
+++ b/src/mainboard/google/jecht/chromeos.c
@@ -76,3 +76,10 @@ void mainboard_chromeos_acpi_generate(void)
 {
 	chromeos_acpi_gpio_generate(cros_gpios, ARRAY_SIZE(cros_gpios));
 }
+
+int get_ec_is_trusted(void)
+{
+	/* Do not have a Chrome EC involved in entering recovery mode;
+	   Always return trusted. */
+	return 1;
+}
diff --git a/src/mainboard/google/kahlee/chromeos.c b/src/mainboard/google/kahlee/chromeos.c
index 0a465c98a4..690a9e3af3 100644
--- a/src/mainboard/google/kahlee/chromeos.c
+++ b/src/mainboard/google/kahlee/chromeos.c
@@ -34,3 +34,9 @@ void mainboard_chromeos_acpi_generate(void)
 {
 	chromeos_acpi_gpio_generate(cros_gpios, ARRAY_SIZE(cros_gpios));
 }
+
+int get_ec_is_trusted(void)
+{
+	/* EC is trusted if not in RW. */
+	return !gpio_get(GPIO_EC_IN_RW);
+}
diff --git a/src/mainboard/google/kukui/chromeos.c b/src/mainboard/google/kukui/chromeos.c
index 3f15a3fb91..4c4a8bec03 100644
--- a/src/mainboard/google/kukui/chromeos.c
+++ b/src/mainboard/google/kukui/chromeos.c
@@ -37,3 +37,9 @@ int tis_plat_irq_status(void)
 {
 	return gpio_eint_poll(CR50_IRQ);
 }
+
+int get_ec_is_trusted(void)
+{
+	/* EC is trusted if not in RW. */
+	return !gpio_get(EC_IN_RW);
+}
diff --git a/src/mainboard/google/link/chromeos.c b/src/mainboard/google/link/chromeos.c
index f77c822f6c..f5441677db 100644
--- a/src/mainboard/google/link/chromeos.c
+++ b/src/mainboard/google/link/chromeos.c
@@ -8,6 +8,8 @@
 #include <vendorcode/google/chromeos/chromeos.h>
 #include "onboard.h"
 
+#define GPIO_EC_IN_RW 21
+
 void fill_lb_gpios(struct lb_gpios *gpios)
 {
 	struct lb_gpio chromeos_gpios[] = {
@@ -39,3 +41,9 @@ void mainboard_chromeos_acpi_generate(void)
 {
 	chromeos_acpi_gpio_generate(cros_gpios, ARRAY_SIZE(cros_gpios));
 }
+
+int get_ec_is_trusted(void)
+{
+	/* EC is trusted if not in RW. */
+	return !get_gpio(GPIO_EC_IN_RW);
+}
diff --git a/src/mainboard/google/mistral/chromeos.c b/src/mainboard/google/mistral/chromeos.c
index c827c7d13d..7ffcd57c51 100644
--- a/src/mainboard/google/mistral/chromeos.c
+++ b/src/mainboard/google/mistral/chromeos.c
@@ -1,8 +1,16 @@
 /* SPDX-License-Identifier: GPL-2.0-only */
 
 #include <boot/coreboot_tables.h>
+#include <bootmode.h>
 
 void fill_lb_gpios(struct lb_gpios *gpios)
 {
 
 }
+
+int get_ec_is_trusted(void)
+{
+	/* Do not have a Chrome EC involved in entering recovery mode;
+	   Always return trusted. */
+	return 1;
+}
diff --git a/src/mainboard/google/nyan/chromeos.c b/src/mainboard/google/nyan/chromeos.c
index 7fe877bff0..9aaad2f191 100644
--- a/src/mainboard/google/nyan/chromeos.c
+++ b/src/mainboard/google/nyan/chromeos.c
@@ -19,3 +19,9 @@ int get_write_protect_state(void)
 {
 	return !gpio_get(GPIO(R1));
 }
+
+int get_ec_is_trusted(void)
+{
+	/* EC is trusted if not in RW. */
+	return !gpio_get(GPIO(U4));
+}
diff --git a/src/mainboard/google/nyan_big/chromeos.c b/src/mainboard/google/nyan_big/chromeos.c
index 7fe877bff0..9aaad2f191 100644
--- a/src/mainboard/google/nyan_big/chromeos.c
+++ b/src/mainboard/google/nyan_big/chromeos.c
@@ -19,3 +19,9 @@ int get_write_protect_state(void)
 {
 	return !gpio_get(GPIO(R1));
 }
+
+int get_ec_is_trusted(void)
+{
+	/* EC is trusted if not in RW. */
+	return !gpio_get(GPIO(U4));
+}
diff --git a/src/mainboard/google/nyan_blaze/chromeos.c b/src/mainboard/google/nyan_blaze/chromeos.c
index 7fe877bff0..9aaad2f191 100644
--- a/src/mainboard/google/nyan_blaze/chromeos.c
+++ b/src/mainboard/google/nyan_blaze/chromeos.c
@@ -19,3 +19,9 @@ int get_write_protect_state(void)
 {
 	return !gpio_get(GPIO(R1));
 }
+
+int get_ec_is_trusted(void)
+{
+	/* EC is trusted if not in RW. */
+	return !gpio_get(GPIO(U4));
+}
diff --git a/src/mainboard/google/oak/chromeos.c b/src/mainboard/google/oak/chromeos.c
index 9e7af27382..739df2e25b 100644
--- a/src/mainboard/google/oak/chromeos.c
+++ b/src/mainboard/google/oak/chromeos.c
@@ -34,3 +34,9 @@ int get_write_protect_state(void)
 {
 	return !gpio_get(WRITE_PROTECT);
 }
+
+int get_ec_is_trusted(void)
+{
+	/* EC is trusted if not in RW. */
+	return !gpio_get(EC_IN_RW);
+}
diff --git a/src/mainboard/google/octopus/chromeos.c b/src/mainboard/google/octopus/chromeos.c
index 9c260ab60a..82599aca73 100644
--- a/src/mainboard/google/octopus/chromeos.c
+++ b/src/mainboard/google/octopus/chromeos.c
@@ -35,3 +35,9 @@ void mainboard_chromeos_acpi_generate(void)
 	gpios = variant_cros_gpios(&num);
 	chromeos_acpi_gpio_generate(gpios, num);
 }
+
+int get_ec_is_trusted(void)
+{
+	/* EC is trusted if not in RW. */
+	return !gpio_get(GPIO_EC_IN_RW);
+}
diff --git a/src/mainboard/google/octopus/variants/baseboard/gpio.c b/src/mainboard/google/octopus/variants/baseboard/gpio.c
index d16c4e1b12..61e8e0d9c9 100644
--- a/src/mainboard/google/octopus/variants/baseboard/gpio.c
+++ b/src/mainboard/google/octopus/variants/baseboard/gpio.c
@@ -344,6 +344,8 @@ static const struct pad_config early_gpio_table[] = {
 	 * stages.
 	 */
 	PAD_CFG_GPO_IOSSTATE_IOSTERM(GPIO_161, 1, DEEP, UP_20K, Tx1RxDCRx0, DISPUPD), /* AVS_I2S1_MCLK -- LTE_OFF_ODL */
+
+	PAD_CFG_GPI(GPIO_189, NONE, DEEP), /* EC_IN_RW */
 };
 
 const struct pad_config *__weak
diff --git a/src/mainboard/google/parrot/chromeos.c b/src/mainboard/google/parrot/chromeos.c
index 4781f7e622..01a2d8e31d 100644
--- a/src/mainboard/google/parrot/chromeos.c
+++ b/src/mainboard/google/parrot/chromeos.c
@@ -64,3 +64,10 @@ void mainboard_chromeos_acpi_generate(void)
 
 	chromeos_acpi_gpio_generate(cros_gpios, ARRAY_SIZE(cros_gpios));
 }
+
+int get_ec_is_trusted(void)
+{
+	/* Do not have a Chrome EC involved in entering recovery mode;
+	   Always return trusted. */
+	return 1;
+}
diff --git a/src/mainboard/google/peach_pit/chromeos.c b/src/mainboard/google/peach_pit/chromeos.c
index 07a13a31b5..e1d8fa1a9a 100644
--- a/src/mainboard/google/peach_pit/chromeos.c
+++ b/src/mainboard/google/peach_pit/chromeos.c
@@ -38,3 +38,9 @@ int get_write_protect_state(void)
 {
 	return !gpio_get_value(GPIO_X30);
 }
+
+int get_ec_is_trusted(void)
+{
+	/* EC is trusted if not in RW. */
+	return !gpio_get_value(GPIO_X23);
+}
diff --git a/src/mainboard/google/poppy/chromeos.c b/src/mainboard/google/poppy/chromeos.c
index ff39fbf337..4cd9029a83 100644
--- a/src/mainboard/google/poppy/chromeos.c
+++ b/src/mainboard/google/poppy/chromeos.c
@@ -40,3 +40,9 @@ void mainboard_chromeos_acpi_generate(void)
 	gpios = variant_cros_gpios(&num);
 	chromeos_acpi_gpio_generate(gpios, num);
 }
+
+int get_ec_is_trusted(void)
+{
+	/* EC is trusted if not in RW. */
+	return !gpio_get(GPIO_EC_IN_RW);
+}
diff --git a/src/mainboard/google/poppy/variants/atlas/gpio.c b/src/mainboard/google/poppy/variants/atlas/gpio.c
index d3ea6b537b..ffea694910 100644
--- a/src/mainboard/google/poppy/variants/atlas/gpio.c
+++ b/src/mainboard/google/poppy/variants/atlas/gpio.c
@@ -345,6 +345,9 @@ static const struct pad_config early_gpio_table[] = {
 	/* B18 : GSPI0_MOSI ==> H1_SLAVE_SPI_MOSI */
 	PAD_CFG_NF(GPP_B18, NONE, DEEP, NF1),
 
+	/* C6  : SM1CLK ==> EC_IN_RW_OD */
+	PAD_CFG_GPI_GPIO_DRIVER(GPP_C6, UP_20K, DEEP),
+
 	/* Ensure UART pins are in native mode for H1. */
 	/* C20 : UART2_RXD ==> PCHRX_SERVOTX_UART */
 	PAD_CFG_NF(GPP_C20, NONE, DEEP, NF1),
diff --git a/src/mainboard/google/poppy/variants/baseboard/gpio.c b/src/mainboard/google/poppy/variants/baseboard/gpio.c
index d3df99e44f..ea9de7aa54 100644
--- a/src/mainboard/google/poppy/variants/baseboard/gpio.c
+++ b/src/mainboard/google/poppy/variants/baseboard/gpio.c
@@ -341,6 +341,9 @@ static const struct pad_config gpio_table[] = {
 
 /* Early pad configuration in bootblock */
 static const struct pad_config early_gpio_table[] = {
+	/* C6  : SM1CLK ==> EC_IN_RW_OD */
+	PAD_CFG_GPI_GPIO_DRIVER(GPP_C6, UP_20K, DEEP),
+
 	/* C18 : I2C1_SDA ==> PCH_I2C1_H1_3V3_SDA */
 	PAD_CFG_NF(GPP_C18, NONE, DEEP, NF1),
 	/* C19 : I2C1_SCL ==> PCH_I2C1_H1_3V3_SCL */
diff --git a/src/mainboard/google/poppy/variants/nami/gpio.c b/src/mainboard/google/poppy/variants/nami/gpio.c
index 6dba783920..b5ec95405e 100644
--- a/src/mainboard/google/poppy/variants/nami/gpio.c
+++ b/src/mainboard/google/poppy/variants/nami/gpio.c
@@ -346,6 +346,9 @@ static const struct pad_config early_gpio_table[] = {
 	/* B18 : GSPI0_MOSI ==> PCH_SPI_H1_3V3_MOSI */
 	PAD_CFG_NF(GPP_B18, NONE, DEEP, NF1),
 
+	/* C6  : SM1CLK ==> EC_IN_RW_OD */
+	PAD_CFG_GPI_GPIO_DRIVER(GPP_C6, UP_20K, DEEP),
+
 	/* Ensure UART pins are in native mode for H1. */
 	/* C20 : UART2_RXD ==> PCHRX_SERVOTX_UART */
 	PAD_CFG_NF(GPP_C20, NONE, DEEP, NF1),
diff --git a/src/mainboard/google/poppy/variants/nautilus/gpio.c b/src/mainboard/google/poppy/variants/nautilus/gpio.c
index 37378f93a7..e06355a3b7 100644
--- a/src/mainboard/google/poppy/variants/nautilus/gpio.c
+++ b/src/mainboard/google/poppy/variants/nautilus/gpio.c
@@ -331,6 +331,9 @@ static const struct pad_config gpio_table[] = {
 
 /* Early pad configuration in bootblock */
 static const struct pad_config early_gpio_table[] = {
+	/* C6  : SM1CLK ==> EC_IN_RW_OD */
+	PAD_CFG_GPI_GPIO_DRIVER(GPP_C6, UP_20K, DEEP),
+
 	/* C18 : I2C1_SDA ==> PCH_I2C1_H1_3V3_SDA */
 	PAD_CFG_NF(GPP_C18, NONE, DEEP, NF1),
 	/* C19 : I2C1_SCL ==> PCH_I2C1_H1_3V3_SCL */
diff --git a/src/mainboard/google/poppy/variants/nocturne/gpio.c b/src/mainboard/google/poppy/variants/nocturne/gpio.c
index f5344584ba..6324d8fa47 100644
--- a/src/mainboard/google/poppy/variants/nocturne/gpio.c
+++ b/src/mainboard/google/poppy/variants/nocturne/gpio.c
@@ -352,6 +352,9 @@ static const struct pad_config early_gpio_table[] = {
 	/* B18 : GSPI0_MOSI ==> H1_SLAVE_SPI_MOSI */
 	PAD_CFG_NF(GPP_B18, DN_20K, DEEP, NF1),
 
+	/* C6  : SM1CLK ==> EC_IN_RW_OD */
+	PAD_CFG_GPI_GPIO_DRIVER(GPP_C6, UP_20K, DEEP),
+
 	/* Ensure UART pins are in native mode for H1. */
 	/* C20 : UART2_RXD ==> PCHRX_SERVOTX_UART */
 	PAD_CFG_NF(GPP_C20, NONE, DEEP, NF1),
diff --git a/src/mainboard/google/poppy/variants/rammus/gpio.c b/src/mainboard/google/poppy/variants/rammus/gpio.c
index 8e9e5c01c5..c67c560c70 100644
--- a/src/mainboard/google/poppy/variants/rammus/gpio.c
+++ b/src/mainboard/google/poppy/variants/rammus/gpio.c
@@ -349,6 +349,9 @@ static const struct pad_config early_gpio_table[] = {
 	/* B18 : GSPI0_MOSI ==> PCH_SPI_H1_3V3_MOSI */
 	PAD_CFG_NF(GPP_B18, NONE, DEEP, NF1),
 
+	/* C6  : SM1CLK ==> EC_IN_RW_OD */
+	PAD_CFG_GPI_GPIO_DRIVER(GPP_C6, UP_20K, DEEP),
+
 	/* Ensure UART pins are in native mode for H1. */
 	/* C20 : UART2_RXD ==> PCHRX_SERVOTX_UART */
 	PAD_CFG_NF(GPP_C20, NONE, DEEP, NF1),
diff --git a/src/mainboard/google/poppy/variants/soraka/gpio.c b/src/mainboard/google/poppy/variants/soraka/gpio.c
index 9d52773271..808ab3b504 100644
--- a/src/mainboard/google/poppy/variants/soraka/gpio.c
+++ b/src/mainboard/google/poppy/variants/soraka/gpio.c
@@ -342,6 +342,10 @@ static const struct pad_config gpio_table[] = {
 static const struct pad_config early_gpio_table[] = {
 	/* B8  : SRCCLKREQ3# ==> WLAN_PE_RST */
 	PAD_CFG_GPO(GPP_B8, 0, RSMRST),
+
+	/* C6  : SM1CLK ==> EC_IN_RW_OD */
+	PAD_CFG_GPI_GPIO_DRIVER(GPP_C6, UP_20K, DEEP),
+
 	/* C18 : I2C1_SDA ==> PCH_I2C1_H1_3V3_SDA */
 	PAD_CFG_NF(GPP_C18, NONE, DEEP, NF1),
 	/* C19 : I2C1_SCL ==> PCH_I2C1_H1_3V3_SCL */
diff --git a/src/mainboard/google/rambi/chromeos.c b/src/mainboard/google/rambi/chromeos.c
index 773a807f95..d76c5e4c57 100644
--- a/src/mainboard/google/rambi/chromeos.c
+++ b/src/mainboard/google/rambi/chromeos.c
@@ -9,6 +9,9 @@
 /* The WP status pin lives on GPIO_SSUS_6 which is pad 36 in the SUS well. */
 #define WP_STATUS_PAD	36
 
+/* The EC_IN_RW lives on SCGPIO59 */
+#define EC_IN_RW_PAD	59
+
 void fill_lb_gpios(struct lb_gpios *gpios)
 {
 	struct lb_gpio chromeos_gpios[] = {
@@ -44,3 +47,9 @@ void mainboard_chromeos_acpi_generate(void)
 {
 	chromeos_acpi_gpio_generate(cros_gpios, ARRAY_SIZE(cros_gpios));
 }
+
+int get_ec_is_trusted(void)
+{
+	/* EC is trusted if not in RW. */
+	return !score_get_gpio(EC_IN_RW_PAD);
+}
diff --git a/src/mainboard/google/reef/chromeos.c b/src/mainboard/google/reef/chromeos.c
index d258678d7c..1d1c990d73 100644
--- a/src/mainboard/google/reef/chromeos.c
+++ b/src/mainboard/google/reef/chromeos.c
@@ -35,3 +35,9 @@ void mainboard_chromeos_acpi_generate(void)
 	gpios = variant_cros_gpios(&num);
 	chromeos_acpi_gpio_generate(gpios, num);
 }
+
+int get_ec_is_trusted(void)
+{
+	/* EC is trusted if not in RW. */
+	return !gpio_get(GPIO_EC_IN_RW);
+}
diff --git a/src/mainboard/google/reef/variants/baseboard/gpio.c b/src/mainboard/google/reef/variants/baseboard/gpio.c
index 9bb3e45fe5..8263459789 100644
--- a/src/mainboard/google/reef/variants/baseboard/gpio.c
+++ b/src/mainboard/google/reef/variants/baseboard/gpio.c
@@ -368,6 +368,8 @@ static const struct pad_config early_gpio_table[] = {
 
 	/* WLAN_PE_RST - default to deasserted just in case FSP misbehaves. */
 	PAD_CFG_GPO(GPIO_122, 0, DEEP),		 /* SIO_SPI_2_RXD */
+
+	PAD_CFG_GPI(GPIO_41, NONE, DEEP),	 /* LPSS_UART0_CTS - EC_IN_RW */
 };
 
 const struct pad_config * __weak
diff --git a/src/mainboard/google/reef/variants/coral/gpio.c b/src/mainboard/google/reef/variants/coral/gpio.c
index de54929d4b..b60e031af8 100644
--- a/src/mainboard/google/reef/variants/coral/gpio.c
+++ b/src/mainboard/google/reef/variants/coral/gpio.c
@@ -369,6 +369,8 @@ static const struct pad_config early_gpio_table[] = {
 
 	/* WLAN_PE_RST - default to deasserted just in case FSP misbehaves. */
 	PAD_CFG_GPO(GPIO_122, 0, DEEP),		 /* SIO_SPI_2_RXD */
+
+	PAD_CFG_GPI(GPIO_41, NONE, DEEP),	 /* LPSS_UART0_CTS - EC_IN_RW */
 };
 
 const struct pad_config *variant_early_gpio_table(size_t *num)
diff --git a/src/mainboard/google/sarien/chromeos.c b/src/mainboard/google/sarien/chromeos.c
index 37fd817a68..83374157fa 100644
--- a/src/mainboard/google/sarien/chromeos.c
+++ b/src/mainboard/google/sarien/chromeos.c
@@ -94,3 +94,10 @@ void mainboard_prepare_cr50_reset(void)
 	if (ENV_RAMSTAGE)
 		pmc_soc_set_afterg3_en(true);
 }
+
+int get_ec_is_trusted(void)
+{
+	/* Do not have a Chrome EC involved in entering recovery mode;
+	   Always return trusted. */
+	return 1;
+}
diff --git a/src/mainboard/google/slippy/chromeos.c b/src/mainboard/google/slippy/chromeos.c
index 0fa78c921f..634e5637e3 100644
--- a/src/mainboard/google/slippy/chromeos.c
+++ b/src/mainboard/google/slippy/chromeos.c
@@ -32,3 +32,9 @@ void mainboard_chromeos_acpi_generate(void)
 {
 	chromeos_acpi_gpio_generate(cros_gpios, ARRAY_SIZE(cros_gpios));
 }
+
+int get_ec_is_trusted(void)
+{
+	/* EC is trusted if not in RW. */
+	return !get_gpio(14);
+}
diff --git a/src/mainboard/google/smaug/chromeos.c b/src/mainboard/google/smaug/chromeos.c
index 13a69bc0ed..d74df8267e 100644
--- a/src/mainboard/google/smaug/chromeos.c
+++ b/src/mainboard/google/smaug/chromeos.c
@@ -19,3 +19,9 @@ int get_write_protect_state(void)
 {
 	return !gpio_get(WRITE_PROTECT_L);
 }
+
+int get_ec_is_trusted(void)
+{
+	/* EC is trusted if not in RW. */
+	return !gpio_get(EC_IN_RW);
+}
diff --git a/src/mainboard/google/storm/chromeos.c b/src/mainboard/google/storm/chromeos.c
index 69f0fcca2b..4ecc228385 100644
--- a/src/mainboard/google/storm/chromeos.c
+++ b/src/mainboard/google/storm/chromeos.c
@@ -128,3 +128,10 @@ int get_write_protect_state(void)
 {
 	return !read_gpio(WP_SW);
 }
+
+int get_ec_is_trusted(void)
+{
+	/* Do not have a Chrome EC involved in entering recovery mode;
+	   Always return trusted. */
+	return 1;
+}
diff --git a/src/mainboard/google/trogdor/chromeos.c b/src/mainboard/google/trogdor/chromeos.c
index 90de1e4ce0..11b38b513d 100644
--- a/src/mainboard/google/trogdor/chromeos.c
+++ b/src/mainboard/google/trogdor/chromeos.c
@@ -57,3 +57,9 @@ int tis_plat_irq_status(void)
 {
 	return gpio_irq_status(GPIO_H1_AP_INT);
 }
+
+int get_ec_is_trusted(void)
+{
+	/* EC is trusted if not in RW. This is active low. */
+	return !!gpio_get(GPIO_EC_IN_RW);
+}
diff --git a/src/mainboard/google/veyron/chromeos.c b/src/mainboard/google/veyron/chromeos.c
index cdea2cebe0..9374dc4d4a 100644
--- a/src/mainboard/google/veyron/chromeos.c
+++ b/src/mainboard/google/veyron/chromeos.c
@@ -56,3 +56,9 @@ int get_write_protect_state(void)
 {
 	return !gpio_get(GPIO_WP);
 }
+
+int get_ec_is_trusted(void)
+{
+	/* EC is trusted if not in RW. */
+	return !gpio_get(GPIO_ECINRW);
+}
diff --git a/src/mainboard/google/veyron_mickey/chromeos.c b/src/mainboard/google/veyron_mickey/chromeos.c
index a3fe3f4eb9..c4cd6c64c3 100644
--- a/src/mainboard/google/veyron_mickey/chromeos.c
+++ b/src/mainboard/google/veyron_mickey/chromeos.c
@@ -34,3 +34,10 @@ int get_write_protect_state(void)
 {
 	return !gpio_get(GPIO_WP);
 }
+
+int get_ec_is_trusted(void)
+{
+	/* Do not have a Chrome EC involved in entering recovery mode;
+	   Always return trusted. */
+	return 1;
+}
diff --git a/src/mainboard/google/veyron_rialto/chromeos.c b/src/mainboard/google/veyron_rialto/chromeos.c
index 7dcf7dc778..f1eb1c3d27 100644
--- a/src/mainboard/google/veyron_rialto/chromeos.c
+++ b/src/mainboard/google/veyron_rialto/chromeos.c
@@ -43,3 +43,10 @@ int get_write_protect_state(void)
 {
 	return !gpio_get(GPIO_WP);
 }
+
+int get_ec_is_trusted(void)
+{
+	/* Do not have a Chrome EC involved in entering recovery mode;
+	   Always return trusted. */
+	return 1;
+}
diff --git a/src/mainboard/google/volteer/chromeos.c b/src/mainboard/google/volteer/chromeos.c
index 20469d6297..9b8e2f5296 100644
--- a/src/mainboard/google/volteer/chromeos.c
+++ b/src/mainboard/google/volteer/chromeos.c
@@ -34,3 +34,9 @@ void mainboard_chromeos_acpi_generate(void)
 	gpios = variant_cros_gpios(&num);
 	chromeos_acpi_gpio_generate(gpios, num);
 }
+
+int get_ec_is_trusted(void)
+{
+	/* EC is trusted if not in RW. */
+	return !gpio_get(GPIO_EC_IN_RW);
+}
diff --git a/src/mainboard/google/volteer/variants/baseboard/gpio.c b/src/mainboard/google/volteer/variants/baseboard/gpio.c
index ac8c5c2706..05c757ce97 100644
--- a/src/mainboard/google/volteer/variants/baseboard/gpio.c
+++ b/src/mainboard/google/volteer/variants/baseboard/gpio.c
@@ -432,6 +432,9 @@ static const struct pad_config early_gpio_table[] = {
 
 	/* F11 : THC1_SPI2_CLK ==> EN_PP3300_WWAN */
 	PAD_CFG_GPO(GPP_F11, 1, DEEP),
+
+	/* A9  : I2S2_TXD ==> EC_IN_RW_OD */
+	PAD_CFG_GPI(GPP_A9, NONE, DEEP),
 };
 
 const struct pad_config *__weak variant_base_gpio_table(size_t *num)
diff --git a/src/mainboard/google/volteer/variants/collis/gpio.c b/src/mainboard/google/volteer/variants/collis/gpio.c
index 03bd91ef48..86919b90a2 100644
--- a/src/mainboard/google/volteer/variants/collis/gpio.c
+++ b/src/mainboard/google/volteer/variants/collis/gpio.c
@@ -204,6 +204,9 @@ static const struct pad_config early_gpio_table[] = {
 
 	/* E12 : SPI1_MISO_IO1 ==> PEN_ALERT_ODL */
 	PAD_CFG_GPI(GPP_E12, NONE, DEEP),
+
+	/* F17 : WWAN_RF_DISABLE_ODL ==> EC_IN_RW_OD */
+	PAD_CFG_GPI(GPP_F17, NONE, DEEP),
 };
 
 const struct pad_config *variant_early_gpio_table(size_t *num)
diff --git a/src/mainboard/google/volteer/variants/copano/gpio.c b/src/mainboard/google/volteer/variants/copano/gpio.c
index bec58e53e2..933aebb938 100644
--- a/src/mainboard/google/volteer/variants/copano/gpio.c
+++ b/src/mainboard/google/volteer/variants/copano/gpio.c
@@ -220,6 +220,9 @@ static const struct pad_config early_gpio_table[] = {
 
 	/* E12 : SPI1_MISO_IO1 ==> PEN_ALERT_ODL */
 	PAD_CFG_GPI(GPP_E12, NONE, DEEP),
+
+	/* F17 : WWAN_RF_DISABLE_ODL ==> EC_IN_RW_OD */
+	PAD_CFG_GPI(GPP_F17, NONE, DEEP),
 };
 
 const struct pad_config *variant_early_gpio_table(size_t *num)
diff --git a/src/mainboard/google/volteer/variants/halvor/gpio.c b/src/mainboard/google/volteer/variants/halvor/gpio.c
index 7d6725a95b..994df04452 100644
--- a/src/mainboard/google/volteer/variants/halvor/gpio.c
+++ b/src/mainboard/google/volteer/variants/halvor/gpio.c
@@ -233,6 +233,9 @@ static const struct pad_config early_gpio_table[] = {
 	/* D16 : ISH_UART0_CTS# ==> EN_PP3300_SD */
 	PAD_CFG_GPO(GPP_D16, 1, DEEP),
 
+	/* F17 : WWAN_RF_DISABLE_ODL ==> EC_IN_RW_OD */
+	PAD_CFG_GPI(GPP_F17, NONE, DEEP),
+
 	/* H11 : SRCCLKREQ5# ==> WLAN_PERST_L */
 	PAD_CFG_GPO(GPP_H11, 1, DEEP),
 };
diff --git a/src/mainboard/google/volteer/variants/terrador/gpio.c b/src/mainboard/google/volteer/variants/terrador/gpio.c
index 69760c13ff..0febca898f 100644
--- a/src/mainboard/google/volteer/variants/terrador/gpio.c
+++ b/src/mainboard/google/volteer/variants/terrador/gpio.c
@@ -221,6 +221,9 @@ static const struct pad_config early_gpio_table[] = {
 
 	/* E12 : SPI1_MISO_IO1 ==> PEN_ALERT_ODL */
 	PAD_CFG_GPI(GPP_E12, NONE, DEEP),
+
+	/* F17 : WWAN_RF_DISABLE_ODL ==> EC_IN_RW_OD */
+	PAD_CFG_GPI(GPP_F17, NONE, DEEP),
 };
 
 const struct pad_config *variant_early_gpio_table(size_t *num)
diff --git a/src/mainboard/google/volteer/variants/todor/gpio.c b/src/mainboard/google/volteer/variants/todor/gpio.c
index 5611ccabae..e699027320 100644
--- a/src/mainboard/google/volteer/variants/todor/gpio.c
+++ b/src/mainboard/google/volteer/variants/todor/gpio.c
@@ -231,6 +231,9 @@ static const struct pad_config early_gpio_table[] = {
 
 	/* E12 : SPI1_MISO_IO1 ==> PEN_ALERT_ODL */
 	PAD_CFG_GPI(GPP_E12, NONE, DEEP),
+
+	/* F17 : WWAN_RF_DISABLE_ODL ==> EC_IN_RW_OD */
+	PAD_CFG_GPI(GPP_F17, NONE, DEEP),
 };
 
 const struct pad_config *variant_early_gpio_table(size_t *num)
diff --git a/src/mainboard/google/volteer/variants/voema/gpio.c b/src/mainboard/google/volteer/variants/voema/gpio.c
index 70b7f52340..4f3f799cff 100644
--- a/src/mainboard/google/volteer/variants/voema/gpio.c
+++ b/src/mainboard/google/volteer/variants/voema/gpio.c
@@ -219,6 +219,9 @@ static const struct pad_config early_gpio_table[] = {
 
 	/* E12 : SPI1_MISO_IO1 ==> PEN_ALERT_ODL */
 	PAD_CFG_GPI(GPP_E12, NONE, DEEP),
+
+	/* F17 : WWAN_RF_DISABLE_ODL ==> EC_IN_RW_OD */
+	PAD_CFG_GPI(GPP_F17, NONE, DEEP),
 };
 
 const struct pad_config *variant_early_gpio_table(size_t *num)
diff --git a/src/mainboard/google/zork/Makefile.inc b/src/mainboard/google/zork/Makefile.inc
index ccc163c4dd..a260b0fd21 100644
--- a/src/mainboard/google/zork/Makefile.inc
+++ b/src/mainboard/google/zork/Makefile.inc
@@ -10,6 +10,7 @@ ramstage-y += chromeos.c
 ramstage-y += ec.c
 ramstage-y += sku_id.c
 
+verstage-y += chromeos.c
 verstage-y += verstage.c
 
 subdirs-y += variants/baseboard
diff --git a/src/mainboard/google/zork/chromeos.c b/src/mainboard/google/zork/chromeos.c
index 35c002d45c..d64919316b 100644
--- a/src/mainboard/google/zork/chromeos.c
+++ b/src/mainboard/google/zork/chromeos.c
@@ -33,3 +33,9 @@ void mainboard_chromeos_acpi_generate(void)
 {
 	chromeos_acpi_gpio_generate(cros_gpios, ARRAY_SIZE(cros_gpios));
 }
+
+int get_ec_is_trusted(void)
+{
+	/* EC is trusted if not in RW. */
+	return !gpio_get(GPIO_EC_IN_RW);
+}
diff --git a/src/mainboard/google/zork/variants/baseboard/Makefile.inc b/src/mainboard/google/zork/variants/baseboard/Makefile.inc
index 2764a89b08..437ba0b52c 100644
--- a/src/mainboard/google/zork/variants/baseboard/Makefile.inc
+++ b/src/mainboard/google/zork/variants/baseboard/Makefile.inc
@@ -1,23 +1,19 @@
 # SPDX-License-Identifier: GPL-2.0-or-later
 
-bootblock-y += gpio_baseboard_common.c
 bootblock-y += helpers.c
 bootblock-$(CONFIG_BOARD_GOOGLE_BASEBOARD_TREMBYLE) += gpio_baseboard_trembyle.c
 bootblock-$(CONFIG_BOARD_GOOGLE_BASEBOARD_DALBOZ) += gpio_baseboard_dalboz.c
 
-verstage-y += gpio_baseboard_common.c
 verstage-y += helpers.c
 verstage-$(CONFIG_BOARD_GOOGLE_BASEBOARD_TREMBYLE) += gpio_baseboard_trembyle.c
 verstage-$(CONFIG_BOARD_GOOGLE_BASEBOARD_DALBOZ) += gpio_baseboard_dalboz.c
 verstage-y += tpm_tis.c
 
-romstage-y += gpio_baseboard_common.c
 romstage-y += helpers.c
 romstage-$(CONFIG_BOARD_GOOGLE_BASEBOARD_TREMBYLE) += gpio_baseboard_trembyle.c
 romstage-$(CONFIG_BOARD_GOOGLE_BASEBOARD_DALBOZ) += gpio_baseboard_dalboz.c
 romstage-y += tpm_tis.c
 
-ramstage-y += gpio_baseboard_common.c
 ramstage-$(CONFIG_BOARD_GOOGLE_BASEBOARD_TREMBYLE) += gpio_baseboard_trembyle.c
 ramstage-$(CONFIG_BOARD_GOOGLE_BASEBOARD_TREMBYLE) += fsps_baseboard_trembyle.c
 ramstage-$(CONFIG_BOARD_GOOGLE_BASEBOARD_DALBOZ) += gpio_baseboard_dalboz.c
diff --git a/src/mainboard/google/zork/variants/baseboard/gpio_baseboard_common.c b/src/mainboard/google/zork/variants/baseboard/gpio_baseboard_common.c
deleted file mode 100644
index 948ce8f9d4..0000000000
--- a/src/mainboard/google/zork/variants/baseboard/gpio_baseboard_common.c
+++ /dev/null
@@ -1,31 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0-or-later */
-
-#include <baseboard/variants.h>
-#include <soc/gpio.h>
-#include <stdlib.h>
-#include <variant/gpio.h>
-
-static const struct soc_amd_gpio early_gpio_table[] = {
-	/* H1_FCH_INT_ODL */
-	PAD_INT(GPIO_3, PULL_NONE, EDGE_LOW, STATUS),
-	/* I2C3_SCL - H1 */
-	PAD_NF(GPIO_19, I2C3_SCL, PULL_NONE),
-	/* I2C3_SDA - H1 */
-	PAD_NF(GPIO_20, I2C3_SDA, PULL_NONE),
-	/* PCIE_RST0_L - Fixed timings */
-	PAD_NF(GPIO_26, PCIE_RST_L, PULL_NONE),
-	/* FCH_ESPI_EC_CS_L */
-	PAD_NF(GPIO_30, ESPI_CS_L, PULL_NONE),
-	/* ESPI_ALERT_L */
-	PAD_NF(GPIO_108, ESPI_ALERT_L, PULL_NONE),
-	/* UART0_RXD - DEBUG */
-	PAD_NF(GPIO_136, UART0_RXD, PULL_NONE),
-	/* UART0_TXD - DEBUG */
-	PAD_NF(GPIO_138, UART0_TXD, PULL_NONE),
-};
-
-const __weak struct soc_amd_gpio *variant_early_gpio_table(size_t *size)
-{
-	*size = ARRAY_SIZE(early_gpio_table);
-	return early_gpio_table;
-}
diff --git a/src/mainboard/google/zork/variants/baseboard/gpio_baseboard_dalboz.c b/src/mainboard/google/zork/variants/baseboard/gpio_baseboard_dalboz.c
index 6f8a416657..5d3e21ffb2 100644
--- a/src/mainboard/google/zork/variants/baseboard/gpio_baseboard_dalboz.c
+++ b/src/mainboard/google/zork/variants/baseboard/gpio_baseboard_dalboz.c
@@ -310,3 +310,30 @@ const __weak struct soc_amd_gpio *variant_sleep_gpio_table(size_t *size, int slp
 	*size = ARRAY_SIZE(gpio_sleep_table);
 	return gpio_sleep_table;
 }
+
+static const struct soc_amd_gpio early_gpio_table[] = {
+	/* H1_FCH_INT_ODL */
+	PAD_INT(GPIO_3, PULL_NONE, EDGE_LOW, STATUS),
+	/* I2C3_SCL - H1 */
+	PAD_NF(GPIO_19, I2C3_SCL, PULL_NONE),
+	/* I2C3_SDA - H1 */
+	PAD_NF(GPIO_20, I2C3_SDA, PULL_NONE),
+	/* PCIE_RST0_L - Fixed timings */
+	PAD_NF(GPIO_26, PCIE_RST_L, PULL_NONE),
+	/* FCH_ESPI_EC_CS_L */
+	PAD_NF(GPIO_30, ESPI_CS_L, PULL_NONE),
+	/* ESPI_ALERT_L */
+	PAD_NF(GPIO_108, ESPI_ALERT_L, PULL_NONE),
+	/* UART0_RXD - DEBUG */
+	PAD_NF(GPIO_136, UART0_RXD, PULL_NONE),
+	/* UART0_TXD - DEBUG */
+	PAD_NF(GPIO_138, UART0_TXD, PULL_NONE),
+	/* EC_IN_RW_OD */
+	PAD_GPI(GPIO_11, PULL_NONE),
+};
+
+const struct soc_amd_gpio *variant_early_gpio_table(size_t *size)
+{
+	*size = ARRAY_SIZE(early_gpio_table);
+	return early_gpio_table;
+}
diff --git a/src/mainboard/google/zork/variants/baseboard/gpio_baseboard_trembyle.c b/src/mainboard/google/zork/variants/baseboard/gpio_baseboard_trembyle.c
index 62935a66a9..415c426f15 100644
--- a/src/mainboard/google/zork/variants/baseboard/gpio_baseboard_trembyle.c
+++ b/src/mainboard/google/zork/variants/baseboard/gpio_baseboard_trembyle.c
@@ -359,3 +359,30 @@ const __weak struct soc_amd_gpio *variant_sleep_gpio_table(size_t *size, int slp
 	*size = ARRAY_SIZE(gpio_sleep_table);
 	return gpio_sleep_table;
 }
+
+static const struct soc_amd_gpio early_gpio_table[] = {
+	/* H1_FCH_INT_ODL */
+	PAD_INT(GPIO_3, PULL_NONE, EDGE_LOW, STATUS),
+	/* I2C3_SCL - H1 */
+	PAD_NF(GPIO_19, I2C3_SCL, PULL_NONE),
+	/* I2C3_SDA - H1 */
+	PAD_NF(GPIO_20, I2C3_SDA, PULL_NONE),
+	/* PCIE_RST0_L - Fixed timings */
+	PAD_NF(GPIO_26, PCIE_RST_L, PULL_NONE),
+	/* FCH_ESPI_EC_CS_L */
+	PAD_NF(GPIO_30, ESPI_CS_L, PULL_NONE),
+	/* ESPI_ALERT_L */
+	PAD_NF(GPIO_108, ESPI_ALERT_L, PULL_NONE),
+	/* UART0_RXD - DEBUG */
+	PAD_NF(GPIO_136, UART0_RXD, PULL_NONE),
+	/* UART0_TXD - DEBUG */
+	PAD_NF(GPIO_138, UART0_TXD, PULL_NONE),
+	/* EC_IN_RW_OD */
+	PAD_GPI(GPIO_130, PULL_NONE),
+};
+
+const struct soc_amd_gpio *variant_early_gpio_table(size_t *size)
+{
+	*size = ARRAY_SIZE(early_gpio_table);
+	return early_gpio_table;
+}