diff options
| author | Vadim Bendebury <vbendeb@chromium.org> | 2016-11-11 09:25:20 -0800 |
|---|---|---|
| committer | chrome-bot <chrome-bot@chromium.org> | 2016-11-11 17:20:11 -0800 |
| commit | 11dd2f21307daf384c63977c9035e808bd615c29 (patch) | |
| tree | c33c910a48352ffa806d87146c9c4cdb3ea62c88 | |
| parent | 6d3cb5d9eac572b878ac8e6c9da902d11af8d7c5 (diff) | |
| download | vboot-11dd2f21307daf384c63977c9035e808bd615c29.tar.gz | |
tpm2: do not lock kernel space when locking physical presence
There is no direct concept of physical presence in TPM2, the platform
hierarchy could be used to manage access to various NVRAM spaces
instead. The kernel NVRAM space does not have to be explicitly locked,
disabling platform hierarchy is enough to prevent writes into this
space.
BRANCH=none
BUG=chrome-os-partner:59651
TEST=verified that the system boots fine in both normal and recovery
modes; using tpmc confirmed that the kernel space is readable in
both and writeable only in recovery mode.
Change-Id: I3cd8344ad897d061f6b07424f1589a7b547a161f
Signed-off-by: Vadim Bendebury <vbendeb@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/410127
Reviewed-by: Randall Spangler <rspangler@chromium.org>
Reviewed-by: Andrey Pronin <apronin@chromium.org>
| -rw-r--r-- | firmware/lib/tpm2_lite/tlcl.c | 8 |
1 files changed, 1 insertions, 7 deletions
diff --git a/firmware/lib/tpm2_lite/tlcl.c b/firmware/lib/tpm2_lite/tlcl.c index 84929cfa..bb726f10 100644 --- a/firmware/lib/tpm2_lite/tlcl.c +++ b/firmware/lib/tpm2_lite/tlcl.c @@ -408,16 +408,10 @@ uint32_t TlclSetGlobalLock(void) */ uint32_t TlclLockPhysicalPresence(void) { - uint32_t rv; - if (tpm_is_ph_disabled()) return TPM_SUCCESS; - rv = tlcl_lock_nv_write(KERNEL_NV_INDEX); - if (rv == TPM_SUCCESS) - rv = tlcl_disable_platform_hierarchy(); - - return rv; + return tlcl_disable_platform_hierarchy(); } uint32_t TlclRead(uint32_t index, void* data, uint32_t length) |