Modify 'tpmc block' to lock only the FW index
authorAndrey Pronin <apronin@google.com>
Sat, 23 Jul 2016 01:45:37 +0000 (18:45 -0700)
committerchrome-bot <chrome-bot@chromium.org>
Wed, 27 Jul 2016 06:54:28 +0000 (23:54 -0700)
commit3e0a3524898c8d0c633f740a0b715bb9ad32b999
treeb62b4b37c44faf1289d9d73715c039824226dc17
parentc37f0f82056adca65de7b99419663dff437365c1
Modify 'tpmc block' to lock only the FW index

As discussed in https://chromium-review.googlesource.com/#/c/361381/,
instead of being a synonym to 'tpmc pplock', the 'tpmc block' command
should protect just the FW index using WriteLock.

Additionally, both TlclSetGlobalLock and TlclLockPhysicalPresence in
tlcl (which are used by 'tpmc block' and 'tpmc pplock') are updated
to first check if the platform hierarchy is already disabled and
return success, if so. That's needed to prevent command failures
when rollback protection is already on.

BRANCH=none
BUG=chrome-os-partner:55210
BUG=chrome-os-partner:55250
TEST=boot on kevin, verify that 'tpmc block' and 'tpmc pplock'
     work as expected:
     - pplock is possible after block
     - pplock and block succeed both for enabled and disabled PH
     - block locks FW index
     - pplock disables PH

Change-Id: I32bff2b590a51315b11da361b97c684dcce8ab36
Reviewed-on: https://chromium-review.googlesource.com/362772
Commit-Ready: Andrey Pronin <apronin@chromium.org>
Tested-by: Andrey Pronin <apronin@chromium.org>
Reviewed-by: Randall Spangler <rspangler@chromium.org>
firmware/include/tpm2_marshaling.h
firmware/lib/tpm2_lite/marshaling.c
firmware/lib/tpm2_lite/tlcl.c
firmware/linktest/main.c
utility/tpmc.c