From dff56a056c7dadf0d970cfe29f0bc9c1fec69e82 Mon Sep 17 00:00:00 2001 From: dnojiri Date: Fri, 3 Apr 2020 10:56:43 -0700 Subject: ec_sync: Run EFS2 in romstage EFS2 allows EC RO to enable PD for special cases. When doing so, it sets NO_BOOT flag to avoid booting the OS. AP needs to get NO_BOOT flag from Cr50 and enforce that. This patch makes verstage get a boot mode and a mirrored hash stored in kernel secdata from Cr50. This patch also makes romstage write an expected EC hash (a.k.a. Hexp) to Cr50 (if there is an update). BUG=b:147298634, chromium:1045217, b:148259137 BRANCH=none TEST=Verify software sync succeeds on Puff. Signed-off-by: dnojiri Change-Id: I1f387b6e920205b9cc4c8536561f2a279c36413d Reviewed-on: https://review.coreboot.org/c/coreboot/+/40389 Tested-by: build bot (Jenkins) Reviewed-by: Julius Werner --- src/security/vboot/secdata_tpm.c | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) (limited to 'src/security/vboot/secdata_tpm.c') diff --git a/src/security/vboot/secdata_tpm.c b/src/security/vboot/secdata_tpm.c index 0ae956276c..b60a1bb315 100644 --- a/src/security/vboot/secdata_tpm.c +++ b/src/security/vboot/secdata_tpm.c @@ -80,6 +80,22 @@ static uint32_t read_space_firmware(struct vb2_context *ctx) return TPM_E_CORRUPTED_STATE; } +uint32_t antirollback_read_space_kernel(struct vb2_context *ctx) +{ + uint8_t size = VB2_SECDATA_KERNEL_MIN_SIZE; + + RETURN_ON_FAILURE(tlcl_read(KERNEL_NV_INDEX, ctx->secdata_kernel, + size)); + + if (vb2api_secdata_kernel_check(ctx, &size) + == VB2_ERROR_SECDATA_KERNEL_INCOMPLETE) + /* Re-read. vboot will run the check and handle errors. */ + RETURN_ON_FAILURE(tlcl_read(KERNEL_NV_INDEX, + ctx->secdata_kernel, size)); + + return TPM_SUCCESS; +} + static uint32_t read_space_rec_hash(uint8_t *data) { RETURN_ON_FAILURE(tlcl_read(REC_HASH_NV_INDEX, data, @@ -440,6 +456,15 @@ uint32_t antirollback_write_space_firmware(struct vb2_context *ctx) VB2_SECDATA_FIRMWARE_SIZE); } +uint32_t antirollback_write_space_kernel(struct vb2_context *ctx) +{ + /* Learn the expected size. */ + uint8_t size = VB2_SECDATA_KERNEL_MIN_SIZE; + vb2api_secdata_kernel_check(ctx, &size); + + return write_secdata(KERNEL_NV_INDEX, ctx->secdata_kernel, size); +} + uint32_t antirollback_read_space_rec_hash(uint8_t *data, uint32_t size) { if (size != REC_HASH_NV_SIZE) { -- cgit v1.2.3