aboutsummaryrefslogtreecommitdiffstats
path: root/src/vendorcode/google/chromeos/vboot2/verstage.c
diff options
context:
space:
mode:
authorJulius Werner <jwerner@chromium.org>2015-01-30 18:45:27 -0800
committerAaron Durbin <adurbin@chromium.org>2015-04-20 17:06:28 +0200
commit76e3303290f7f17d5318e87321567188f165cc2a (patch)
tree43efe41ca19f18bb4f96899b91a86da221fb0a70 /src/vendorcode/google/chromeos/vboot2/verstage.c
parent5aecacca053c3ce8bdb7b8ce94473703b3240e37 (diff)
downloadcoreboot-76e3303290f7f17d5318e87321567188f165cc2a.tar.gz
coreboot-76e3303290f7f17d5318e87321567188f165cc2a.tar.xz
coreboot-76e3303290f7f17d5318e87321567188f165cc2a.zip
chromeos: vboot2: Add TPM PCR extension support
ChromeOS/vboot devices expect the TPM PCRs 0 and 1 to be extended with digests that attest the chosen boot mode (developer/recovery) and the HWID in a secure way. This patch uses the newly added vboot2 support functions to fetch these digests and store them in the TPM. CQ-DEPEND=CL:244542 BRANCH=veyron BUG=chromium:451609 TEST=Booted Jerry. Confirmed that PCR0 contains the same value as on my vboot1 Blaze and Falco (and PCR1 contains some non-zero hash). Original-Change-Id: I7037b8198c09fccee5440c4c85f0821166784cec Original-Signed-off-by: Julius Werner <jwerner@chromium.org> Original-Reviewed-on: https://chromium-review.googlesource.com/245119 Original-Reviewed-by: Aaron Durbin <adurbin@chromium.org> Original-Reviewed-by: Daisuke Nojiri <dnojiri@chromium.org> (cherry picked from commit 8b44e13098cb7493091f2ce6c4ab423f2cbf0177) Signed-off-by: Aaron Durbin <adurbin@chromium.org> Change-Id: I549de8c07353683633fbf73e4ee62ba0ed72ff89 Reviewed-on: http://review.coreboot.org/9706 Tested-by: build bot (Jenkins) Reviewed-by: Stefan Reinauer <stefan.reinauer@coreboot.org> Reviewed-by: Paul Menzel <paulepanter@users.sourceforge.net>
Diffstat (limited to 'src/vendorcode/google/chromeos/vboot2/verstage.c')
-rw-r--r--src/vendorcode/google/chromeos/vboot2/verstage.c15
1 files changed, 15 insertions, 0 deletions
diff --git a/src/vendorcode/google/chromeos/vboot2/verstage.c b/src/vendorcode/google/chromeos/vboot2/verstage.c
index 06d76fe24..0ce4e8924 100644
--- a/src/vendorcode/google/chromeos/vboot2/verstage.c
+++ b/src/vendorcode/google/chromeos/vboot2/verstage.c
@@ -205,6 +205,12 @@ static void save_if_needed(struct vb2_context *ctx)
}
}
+static uint32_t extend_pcrs(struct vb2_context *ctx)
+{
+ return tpm_extend_pcr(ctx, 0, BOOT_MODE_PCR) ||
+ tpm_extend_pcr(ctx, 1, HWID_DIGEST_PCR);
+}
+
/**
* Verify and select the firmware in the RW image
*
@@ -248,6 +254,7 @@ void verstage_main(void)
printk(BIOS_INFO, "Recovery requested (%x)\n", rv);
/* If we need recovery mode, leave firmware selection now */
save_if_needed(&ctx);
+ extend_pcrs(&ctx); /* ignore failures */
timestamp_add_now(TS_END_VBOOT);
return;
}
@@ -284,6 +291,14 @@ void verstage_main(void)
vboot_reboot();
}
+ rv = extend_pcrs(&ctx);
+ if (rv) {
+ printk(BIOS_WARNING, "Failed to extend TPM PCRs (%#x)\n", rv);
+ vb2api_fail(&ctx, VB2_RECOVERY_RO_TPM_U_ERROR, rv);
+ save_if_needed(&ctx);
+ vboot_reboot();
+ }
+
/* Lock TPM */
rv = antirollback_lock_space_firmware();
if (rv) {