TPM: Add tlcl_cr50_get_boot_mode

tlcl_cr50_get_boot_mode gets the boot mode from Cr50. The boot mode
tells coreboot/depthcharge whether booting the kernel is allowed or
not.

BUG=b:147298634, chromium:1045217, b:148259137
BRANCH=none
TEST=Verify software sync succeeds on Puff.

Signed-off-by: dnojiri <dnojiri@chromium.org>
Change-Id: Iadae848c4bf315f2131ff6aebcb35938307b5db4
Reviewed-on: https://review.coreboot.org/c/coreboot/+/40388
Reviewed-by: Julius Werner <jwerner@chromium.org>
Reviewed-by: Christian Walter <christian.walter@9elements.com>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>

1 files changed, 25 insertions, 0 deletions

diff --git a/src/security/tpm/tss/vendor/cr50/cr50.c b/src/security/tpm/tss/vendor/cr50/cr50.c
index ec69df4ac9..ae2f7c2516 100644
--- a/src/security/tpm/tss/vendor/cr50/cr50.c
+++ b/src/security/tpm/tss/vendor/cr50/cr50.c
@@ -107,6 +107,31 @@ uint32_t tlcl_cr50_get_tpm_mode(uint8_t *tpm_mode)
 	return TPM_SUCCESS;
 }
 
+uint32_t tlcl_cr50_get_boot_mode(uint8_t *boot_mode)
+{
+	struct tpm2_response *response;
+	uint16_t mode_command = TPM2_CR50_SUB_CMD_GET_BOOT_MODE;
+
+	printk(BIOS_DEBUG, "Reading cr50 boot mode\n");
+
+	response = tpm_process_command(TPM2_CR50_VENDOR_COMMAND, &mode_command);
+
+	if (!response)
+		return TPM_E_IOERROR;
+
+	if (response->hdr.tpm_code == VENDOR_RC_NO_SUCH_COMMAND)
+		/* Explicitly inform caller when command is not supported */
+		return TPM_E_NO_SUCH_COMMAND;
+
+	if (response->hdr.tpm_code)
+		/* Unexpected return code from Cr50 */
+		return TPM_E_IOERROR;
+
+	*boot_mode = response->vcr.boot_mode;
+
+	return TPM_SUCCESS;
+}
+
 uint32_t tlcl_cr50_immediate_reset(uint16_t timeout_ms)
 {
 	struct tpm2_response *response;