erebion/coreboot
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

tpm2: implement locking firmware rollback counter

Browse source 
TPM1.2 is using the somewhat misnamed tlcl_set_global_lock() command
function to lock the hardware rollback counter. For TPM2 let's
implement and use the TPM2 command to lock an NV Ram location
(TPM2_NV_WriteLock).

BRANCH=none
BUG=chrome-os-partner:50645
TEST=verified that TPM2_NV_WriteLock command is invoked before RO
     firmware starts RW, and succeeds.

Change-Id: I62f22b9991522d4309cccc44180a5ebd4dca488d
Signed-off-by: Vadim Bendebury <vbendeb@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/358097
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
Reviewed-by: Darren Krahn <dkrahn@chromium.org>
This commit is contained in:
Vadim Bendebury 2016-07-03 17:08:10 -07:00 • committed by chrome-bot
commit 2f859335df
5 changed files with 49 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

15
src/vendorcode/google/chromeos/vboot2/antirollback.c
View file

@ -157,6 +157,11 @@ uint32_t tpm_clear_and_reenable(void)
return TPM_SUCCESS;
}
uint32_t antirollback_lock_space_firmware(void)
{
return tlcl_lock_nv_write(FIRMWARE_NV_INDEX);
}
#else
uint32_t tpm_clear_and_reenable(void)
@ -263,6 +268,11 @@ static uint32_t _factory_initialize_tpm(struct vb2_context *ctx)
VB2_SECDATA_SIZE));
return TPM_SUCCESS;
}
uint32_t antirollback_lock_space_firmware(void)
{
return tlcl_set_global_lock();
}
#endif
uint32_t factory_initialize_tpm(struct vb2_context *ctx)
@ -424,8 +434,3 @@ uint32_t antirollback_write_space_firmware(struct vb2_context *ctx)
{
return write_secdata(FIRMWARE_NV_INDEX, ctx->secdata, VB2_SECDATA_SIZE);
}
uint32_t antirollback_lock_space_firmware()
{
return tlcl_set_global_lock();
}