diff options
| author | Namyoon Woo <namyoon@chromium.org> | 2018-10-31 17:35:09 -0700 |
|---|---|---|
| committer | chrome-bot <chrome-bot@chromium.org> | 2018-12-05 01:13:31 -0800 |
| commit | 2b9ee186544863f29a84477aa46a80a57d8f09e0 (patch) | |
| tree | 6c07caddb65c4002adf6f3632a0af765d24c6fdb /common/nvmem.c | |
| parent | 6851e82deeedd89bee94560a75a2c7347836bc48 (diff) | |
| download | chrome-ec-2b9ee186544863f29a84477aa46a80a57d8f09e0.tar.gz | |
cr50: revoke key ladder on disabling TPM
Disabling TPM will do revoke H1 key laddder.
Querying TPM_MODE or enabling TPM_MODE will fail if H1 Key
Ladder is already revoked.
BUG=b:118504817
BRANCH=cr50
TEST=Manually tested with TPM disabling and Resume or Warm Reboot.
(1) Resume
$ trunks_send --raw 80 01 00 00 00 0c 00 00 01 45 00 01
80010000000A00000000
$ gsctool -a -m disable
TPM Mode: disabled (2)
$ echo mem > /sys/power/state
(press key on chromebook either after three seconds or in a second.)
(2) Warm Reboot
$ gsctool -a -m disable
(press refresh + power button or run kernel command 'reboot')
Check Chrome os boot ok.
No TPM command failures were observed (in CR50 console).
(3) Windows Warm Reboot or Resume are checked.
Change-Id: I32fffc432a9a6068ea324a97225974c581cb9359
Signed-off-by: Namyoon Woo <namyoon@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/1312197
Reviewed-by: Vadim Bendebury <vbendeb@chromium.org>
Diffstat (limited to 'common/nvmem.c')
| -rw-r--r-- | common/nvmem.c | 20 |
1 files changed, 20 insertions, 0 deletions
diff --git a/common/nvmem.c b/common/nvmem.c index cb4abc3287..b4c82d0154 100644 --- a/common/nvmem.c +++ b/common/nvmem.c @@ -5,6 +5,9 @@ #include "common.h" #include "console.h" +#ifndef TEST_BUILD +#include "dcrypto.h" +#endif #include "flash.h" #include "nvmem.h" #include "task.h" @@ -108,6 +111,13 @@ static int nvmem_save(void) uint8_t sha_comp[NVMEM_SHA_SIZE]; int rv = EC_SUCCESS; +#ifndef TEST_BUILD + if (!DCRYPTO_ladder_is_enabled()) { + CPRINTF("%s: Key ladder is disabled. Skipping flash write\n", + __func__); + goto release_cache; + } +#endif part = (struct nvmem_partition *)nvmem_cache; /* Has anything changed in the cache? */ @@ -601,3 +611,13 @@ int nvmem_commit(void) /* Write active partition to NvMem */ return nvmem_save(); } + +void nvmem_clear_cache(void) +{ + nvmem_lock_cache(); + /* + * TODO(b/119221935): Clear areas that should be protected within + * nvmem_cache. + */ + nvmem_release_cache(); +} |