erebion/coreboot
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

chromeos: vboot2: Add TPM PCR extension support

Browse source 
ChromeOS/vboot devices expect the TPM PCRs 0 and 1 to be extended with
digests that attest the chosen boot mode (developer/recovery) and the
HWID in a secure way. This patch uses the newly added vboot2 support
functions to fetch these digests and store them in the TPM.

CQ-DEPEND=CL:245530
BRANCH=veyron
BUG=chromium:451609
TEST=Booted Jerry. Confirmed that PCR0 contains the same value as on my
vboot1 Blaze and Falco (and PCR1 contains some non-zero hash).

Change-Id: I7037b8198c09fccee5440c4c85f0821166784cec
Signed-off-by: Julius Werner <jwerner@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/245119
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
Reviewed-by: Daisuke Nojiri <dnojiri@chromium.org>
(cherry picked from commit 8b44e13098cb7493091f2ce6c4ab423f2cbf0177)
Signed-off-by: Julius Werner <jwerner@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/245496
This commit is contained in:
Julius Werner 2015-01-30 18:45:27 -08:00 • committed by ChromeOS Commit Bot
commit 6250aa5a61
4 changed files with 42 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

7
src/include/antirollback.h
View file

@ -12,6 +12,7 @@
#include "tpm_lite/tss_constants.h"
struct vb2_context;
enum vb2_pcr_digest;
/* TPM NVRAM location indices. */
#define FIRMWARE_NV_INDEX 0x1007
@ -50,6 +51,12 @@ uint32_t antirollback_lock_space_firmware(void);
* only.
*/
/**
* Ask vboot for a digest and extend a TPM PCR with it.
*/
uint32_t tpm_extend_pcr(struct vb2_context *ctx, int pcr,
enum vb2_pcr_digest which_digest);
/**
* Issue a TPM_Clear and reenable/reactivate the TPM.
*/