From fc7900b6b96cdb7044122bc00bbd5c760a069325 Mon Sep 17 00:00:00 2001 From: Daisuke Nojiri Date: Wed, 12 May 2021 12:50:41 -0700 Subject: [PATCH] vboot: Add VB2_CONTEXT_EC_TRUSTED This patch makes coreboot set VB2_CONTEXT_EC_TRUSTED based on the EC"s boot mode. Vboot will check VB2_CONTEXT_EC_TRUSTED to determine whether it can enter recovery mode or not. BUG=b:180927027, b:187871195 BRANCH=none TEST=build Signed-off-by: Daisuke Nojiri Change-Id: I9fa09dd7ae5baa1efb4e1ed4f0fe9a6803167c93 Reviewed-on: https://review.coreboot.org/c/coreboot/+/54099 Tested-by: build bot (Jenkins) Reviewed-by: Julius Werner Reviewed-by: Furquan Shaikh --- src/security/vboot/vboot_logic.c | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) diff --git a/src/security/vboot/vboot_logic.c b/src/security/vboot/vboot_logic.c index 70c7d77073..c257d22b8e 100644 --- a/src/security/vboot/vboot_logic.c +++ b/src/security/vboot/vboot_logic.c @@ -212,15 +212,18 @@ static uint32_t extend_pcrs(struct vb2_context *ctx) vboot_extend_pcr(ctx, 1, HWID_DIGEST_PCR); } -#define EC_EFS_BOOT_MODE_NORMAL 0x00 -#define EC_EFS_BOOT_MODE_NO_BOOT 0x01 +#define EC_EFS_BOOT_MODE_TRUSTED_RO 0x00 +#define EC_EFS_BOOT_MODE_UNTRUSTED_RO 0x01 +#define EC_EFS_BOOT_MODE_VERIFIED_RW 0x02 static const char *get_boot_mode_string(uint8_t boot_mode) { - if (boot_mode == EC_EFS_BOOT_MODE_NORMAL) - return "NORMAL"; - else if (boot_mode == EC_EFS_BOOT_MODE_NO_BOOT) - return "NO_BOOT"; + if (boot_mode == EC_EFS_BOOT_MODE_TRUSTED_RO) + return "TRUSTED_RO"; + else if (boot_mode == EC_EFS_BOOT_MODE_UNTRUSTED_RO) + return "UNTRUSTED_RO"; + else if (boot_mode == EC_EFS_BOOT_MODE_VERIFIED_RW) + return "VERIFIED_RW"; else return "UNDEFINED"; } @@ -253,8 +256,10 @@ static void check_boot_mode(struct vb2_context *ctx) printk(BIOS_INFO, "Cr50 says boot_mode is %s(0x%02x).\n", get_boot_mode_string(boot_mode), boot_mode); - if (boot_mode == EC_EFS_BOOT_MODE_NO_BOOT) + if (boot_mode == EC_EFS_BOOT_MODE_UNTRUSTED_RO) ctx->flags |= VB2_CONTEXT_NO_BOOT; + else if (boot_mode == EC_EFS_BOOT_MODE_TRUSTED_RO) + ctx->flags |= VB2_CONTEXT_EC_TRUSTED; } /**