summaryrefslogtreecommitdiff
path: root/src/vendorcode/google/chromeos
diff options
context:
space:
mode:
Diffstat (limited to 'src/vendorcode/google/chromeos')
-rw-r--r--src/vendorcode/google/chromeos/vboot2/antirollback.c17
-rw-r--r--src/vendorcode/google/chromeos/vboot2/verstage.c15
2 files changed, 32 insertions, 0 deletions
diff --git a/src/vendorcode/google/chromeos/vboot2/antirollback.c b/src/vendorcode/google/chromeos/vboot2/antirollback.c
index f420d16114..407b19cecd 100644
--- a/src/vendorcode/google/chromeos/vboot2/antirollback.c
+++ b/src/vendorcode/google/chromeos/vboot2/antirollback.c
@@ -35,6 +35,23 @@
} \
} while (0)
+
+uint32_t tpm_extend_pcr(struct vb2_context *ctx, int pcr,
+ enum vb2_pcr_digest which_digest)
+{
+ uint8_t buffer[VB2_PCR_DIGEST_RECOMMENDED_SIZE];
+ uint32_t size = sizeof(buffer);
+ int rv;
+
+ rv = vb2api_get_pcr_digest(ctx, which_digest, buffer, &size);
+ if (rv != VB2_SUCCESS)
+ return rv;
+ if (size < TPM_PCR_DIGEST)
+ return VB2_ERROR_UNKNOWN;
+
+ return tlcl_extend(pcr, buffer, NULL);
+}
+
uint32_t tpm_clear_and_reenable(void)
{
VBDEBUG("TPM: Clear and re-enable\n");
diff --git a/src/vendorcode/google/chromeos/vboot2/verstage.c b/src/vendorcode/google/chromeos/vboot2/verstage.c
index 06d76fe24a..0ce4e89246 100644
--- a/src/vendorcode/google/chromeos/vboot2/verstage.c
+++ b/src/vendorcode/google/chromeos/vboot2/verstage.c
@@ -205,6 +205,12 @@ static void save_if_needed(struct vb2_context *ctx)
}
}
+static uint32_t extend_pcrs(struct vb2_context *ctx)
+{
+ return tpm_extend_pcr(ctx, 0, BOOT_MODE_PCR) ||
+ tpm_extend_pcr(ctx, 1, HWID_DIGEST_PCR);
+}
+
/**
* Verify and select the firmware in the RW image
*
@@ -248,6 +254,7 @@ void verstage_main(void)
printk(BIOS_INFO, "Recovery requested (%x)\n", rv);
/* If we need recovery mode, leave firmware selection now */
save_if_needed(&ctx);
+ extend_pcrs(&ctx); /* ignore failures */
timestamp_add_now(TS_END_VBOOT);
return;
}
@@ -284,6 +291,14 @@ void verstage_main(void)
vboot_reboot();
}
+ rv = extend_pcrs(&ctx);
+ if (rv) {
+ printk(BIOS_WARNING, "Failed to extend TPM PCRs (%#x)\n", rv);
+ vb2api_fail(&ctx, VB2_RECOVERY_RO_TPM_U_ERROR, rv);
+ save_if_needed(&ctx);
+ vboot_reboot();
+ }
+
/* Lock TPM */
rv = antirollback_lock_space_firmware();
if (rv) {