From 76e3303290f7f17d5318e87321567188f165cc2a Mon Sep 17 00:00:00 2001 From: Julius Werner Date: Fri, 30 Jan 2015 18:45:27 -0800 Subject: chromeos: vboot2: Add TPM PCR extension support ChromeOS/vboot devices expect the TPM PCRs 0 and 1 to be extended with digests that attest the chosen boot mode (developer/recovery) and the HWID in a secure way. This patch uses the newly added vboot2 support functions to fetch these digests and store them in the TPM. CQ-DEPEND=CL:244542 BRANCH=veyron BUG=chromium:451609 TEST=Booted Jerry. Confirmed that PCR0 contains the same value as on my vboot1 Blaze and Falco (and PCR1 contains some non-zero hash). Original-Change-Id: I7037b8198c09fccee5440c4c85f0821166784cec Original-Signed-off-by: Julius Werner Original-Reviewed-on: https://chromium-review.googlesource.com/245119 Original-Reviewed-by: Aaron Durbin Original-Reviewed-by: Daisuke Nojiri (cherry picked from commit 8b44e13098cb7493091f2ce6c4ab423f2cbf0177) Signed-off-by: Aaron Durbin Change-Id: I549de8c07353683633fbf73e4ee62ba0ed72ff89 Reviewed-on: http://review.coreboot.org/9706 Tested-by: build bot (Jenkins) Reviewed-by: Stefan Reinauer Reviewed-by: Paul Menzel --- src/include/antirollback.h | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'src/include') diff --git a/src/include/antirollback.h b/src/include/antirollback.h index 942793a62b..5ba36f7e65 100644 --- a/src/include/antirollback.h +++ b/src/include/antirollback.h @@ -12,6 +12,7 @@ #include "tpm_lite/tss_constants.h" struct vb2_context; +enum vb2_pcr_digest; /* TPM NVRAM location indices. */ #define FIRMWARE_NV_INDEX 0x1007 @@ -50,6 +51,12 @@ uint32_t antirollback_lock_space_firmware(void); * only. */ +/** + * Ask vboot for a digest and extend a TPM PCR with it. + */ +uint32_t tpm_extend_pcr(struct vb2_context *ctx, int pcr, + enum vb2_pcr_digest which_digest); + /** * Issue a TPM_Clear and reenable/reactivate the TPM. */ -- cgit v1.2.3