Reland "vboot_logic: Set VB2_CONTEXT_EC_TRUSTED in verstage_main"

This reverts commit adb393bdd6cd6734fa2672bd174aca4588a68016.
This relands commit 6260bf712a836762b18d80082505e981e040f4bc.

Reason for revert:
The original CL did not handle some devices correctly.
With the fixes:
* commit 36721a4 (mb/google/brya: Add GPIO_IN_RW to all variants'
early GPIO tables)
* commit 3bfe46c (mb/google/guybrush: Add GPIO EC in RW to early
GPIO tables)
* commit 3a30cf9 (mb/google/guybrush: Build chromeos.c in verstage

This CL also fix the following platforms:
* Change to always trusted: cyan.
* Add to early GPIO table: dedede, eve, fizz, glados, hatch, octopus,
			   poppy, reef, volteer.
* Add to both Makefile and early GPIO table: zork.

For mb/intel:
* adlrvp: Add support for get_ec_is_trusted().
* glkrvp: Add support for get_ec_is_trusted() with always trusted.
* kblrvp: Add support for get_ec_is_trusted() with always trusted.
* kunimitsu: Add support for get_ec_is_trusted() and initialize it as
	     early GPIO.
* shadowmountain: Add support for get_ec_is_trusted() and initialize
	     it as early GPIO.
* tglrvp: Add support for get_ec_is_trusted() with always trusted.

For qemu-q35: Add support for get_ec_is_trusted() with always trusted.

We could attempt another land.

Change-Id: I66b8b99d6e6bf259b18573f9f6010f9254357bf9
Signed-off-by: Hsuan Ting Chen <roccochen@chromium.org>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/58253
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Karthik Ramasubramanian <kramasub@google.com>
Reviewed-by: Tim Wawrzynczak <twawrzynczak@chromium.org>
Reviewed-by: Yu-Ping Wu <yupingso@google.com>

115 files changed, 541 insertions, 35 deletions

diff --git a/src/include/bootmode.h b/src/include/bootmode.h
index aadecba33404..da2dbf65657b 100644
--- a/src/include/bootmode.h
+++ b/src/include/bootmode.h
@@ -11,6 +11,7 @@ int get_recovery_mode_retrain_switch(void);
 int clear_recovery_mode_switch(void);
 int get_wipeout_mode_switch(void);
 int get_lid_switch(void);
+int get_ec_is_trusted(void);
 
 /* Return 1 if display initialization is required. 0 if not. */
 int display_init_required(void);
diff --git a/src/mainboard/emulation/qemu-q35/chromeos.c b/src/mainboard/emulation/qemu-q35/chromeos.c
index cb904a0656eb..c4770ffd7d37 100644
--- a/src/mainboard/emulation/qemu-q35/chromeos.c
+++ b/src/mainboard/emulation/qemu-q35/chromeos.c
@@ -24,3 +24,10 @@ void mainboard_chromeos_acpi_generate(void)
 {
 	chromeos_acpi_gpio_generate(cros_gpios, ARRAY_SIZE(cros_gpios));
 }
+
+int get_ec_is_trusted(void)
+{
+	/* Do not have a Chrome EC involved in entering recovery mode;
+	   Always return trusted. */
+	return 1;
+}
diff --git a/src/mainboard/google/asurada/chromeos.c b/src/mainboard/google/asurada/chromeos.c
index 6f8f24281a33..1aa8876ca457 100644
--- a/src/mainboard/google/asurada/chromeos.c
+++ b/src/mainboard/google/asurada/chromeos.c
@@ -40,3 +40,9 @@ int tis_plat_irq_status(void)
 {
 	return gpio_eint_poll(GPIO_H1_AP_INT);
 }
+
+int get_ec_is_trusted(void)
+{
+	/* EC is trusted if not in RW. This is active low. */
+	return !!gpio_get(GPIO_EC_IN_RW);
+}
diff --git a/src/mainboard/google/auron/chromeos.c b/src/mainboard/google/auron/chromeos.c
index 40f98f20eb64..9807acec363e 100644
--- a/src/mainboard/google/auron/chromeos.c
+++ b/src/mainboard/google/auron/chromeos.c
@@ -9,6 +9,13 @@
 
 #include "onboard.h"
 
+/* EC_IN_RW is GPIO 25 in samus and 14 otherwise */
+#if CONFIG(BOARD_GOOGLE_SAMUS)
+#define EC_IN_RW_GPIO	25
+#else
+#define EC_IN_RW_GPIO	14
+#endif
+
 void fill_lb_gpios(struct lb_gpios *gpios)
 {
 	struct lb_gpio chromeos_gpios[] = {
@@ -33,3 +40,9 @@ void mainboard_chromeos_acpi_generate(void)
 {
 	chromeos_acpi_gpio_generate(cros_gpios, ARRAY_SIZE(cros_gpios));
 }
+
+int get_ec_is_trusted(void)
+{
+	/* EC is trusted if not in RW. */
+	return !get_gpio(EC_IN_RW_GPIO);
+}
diff --git a/src/mainboard/google/beltino/chromeos.c b/src/mainboard/google/beltino/chromeos.c
index ce3030daf572..db646495deb9 100644
--- a/src/mainboard/google/beltino/chromeos.c
+++ b/src/mainboard/google/beltino/chromeos.c
@@ -74,3 +74,10 @@ void mainboard_chromeos_acpi_generate(void)
 {
 	chromeos_acpi_gpio_generate(cros_gpios, ARRAY_SIZE(cros_gpios));
 }
+
+int get_ec_is_trusted(void)
+{
+	/* Do not have a Chrome EC involved in entering recovery mode;
+	   Always return trusted. */
+	return 1;
+}
diff --git a/src/mainboard/google/brya/chromeos.c b/src/mainboard/google/brya/chromeos.c
index bf7f9eb21f07..cb636c616ae8 100644
--- a/src/mainboard/google/brya/chromeos.c
+++ b/src/mainboard/google/brya/chromeos.c
@@ -31,3 +31,9 @@ void mainboard_chromeos_acpi_generate(void)
 	gpios = variant_cros_gpios(&num);
 	chromeos_acpi_gpio_generate(gpios, num);
 }
+
+int get_ec_is_trusted(void)
+{
+	/* EC is trusted if not in RW. */
+	return !gpio_get(GPIO_EC_IN_RW);
+}
diff --git a/src/mainboard/google/butterfly/chromeos.c b/src/mainboard/google/butterfly/chromeos.c
index 83b6ba04c4ae..a7d56aee4aa3 100644
--- a/src/mainboard/google/butterfly/chromeos.c
+++ b/src/mainboard/google/butterfly/chromeos.c
@@ -64,3 +64,10 @@ void mainboard_chromeos_acpi_generate(void)
 
 	chromeos_acpi_gpio_generate(cros_gpios, ARRAY_SIZE(cros_gpios));
 }
+
+int get_ec_is_trusted(void)
+{
+	/* Do not have a Chrome EC involved in entering recovery mode;
+	   Always return trusted. */
+	return 1;
+}
diff --git a/src/mainboard/google/cherry/chromeos.c b/src/mainboard/google/cherry/chromeos.c
index 748e06e28d42..13b673cf07c7 100644
--- a/src/mainboard/google/cherry/chromeos.c
+++ b/src/mainboard/google/cherry/chromeos.c
@@ -59,3 +59,9 @@ int tis_plat_irq_status(void)
 {
 	return gpio_eint_poll(GPIO_GSC_AP_INT);
 }
+
+int get_ec_is_trusted(void)
+{
+	/* EC is trusted if not in RW. This is active low. */
+	return !!gpio_get(GPIO_EC_IN_RW);
+}
diff --git a/src/mainboard/google/cyan/chromeos.c b/src/mainboard/google/cyan/chromeos.c
index f0c144616011..a11b6f9f63ba 100644
--- a/src/mainboard/google/cyan/chromeos.c
+++ b/src/mainboard/google/cyan/chromeos.c
@@ -64,3 +64,10 @@ void mainboard_chromeos_acpi_generate(void)
 {
 	chromeos_acpi_gpio_generate(cros_gpios, ARRAY_SIZE(cros_gpios));
 }
+
+int get_ec_is_trusted(void)
+{
+	/* Do not have a Chrome EC involved in entering recovery mode;
+	   Always return trusted. */
+	return 1;
+}
diff --git a/src/mainboard/google/daisy/chromeos.c b/src/mainboard/google/daisy/chromeos.c
index 00fa126434cf..c32c3b0f1edf 100644
--- a/src/mainboard/google/daisy/chromeos.c
+++ b/src/mainboard/google/daisy/chromeos.c
@@ -38,3 +38,9 @@ int get_write_protect_state(void)
 {
 	return !gpio_get_value(GPIO_D16);
 }
+
+int get_ec_is_trusted(void)
+{
+	/* EC is trusted if not in RW. */
+	return !gpio_get_value(GPIO_D17);
+}
diff --git a/src/mainboard/google/dedede/chromeos.c b/src/mainboard/google/dedede/chromeos.c
index e5ae163809ce..ad37b204bbf6 100644
--- a/src/mainboard/google/dedede/chromeos.c
+++ b/src/mainboard/google/dedede/chromeos.c
@@ -32,3 +32,9 @@ void mainboard_chromeos_acpi_generate(void)
 	gpios = variant_cros_gpios(&num);
 	chromeos_acpi_gpio_generate(gpios, num);
 }
+
+int get_ec_is_trusted(void)
+{
+	/* EC is trusted if not in RW. */
+	return !gpio_get(GPIO_EC_IN_RW);
+}
diff --git a/src/mainboard/google/dedede/variants/baseboard/gpio.c b/src/mainboard/google/dedede/variants/baseboard/gpio.c
index 864bb29cf745..3bee32074a3e 100644
--- a/src/mainboard/google/dedede/variants/baseboard/gpio.c
+++ b/src/mainboard/google/dedede/variants/baseboard/gpio.c
@@ -423,6 +423,9 @@ static const struct pad_config early_gpio_table[] = {
 	/* C5  : RAM_STRAP_3 */
 	PAD_CFG_GPI(GPP_C5, NONE, DEEP),
 
+	/* C14 : EC_IN_RW_OD */
+	PAD_CFG_GPI(GPP_C14, NONE, DEEP),
+
 	/* C20 : UART2 RX */
 	PAD_CFG_NF(GPP_C20, NONE, DEEP, NF1),
 	/* C21 : UART2 TX */
diff --git a/src/mainboard/google/deltaur/chromeos.c b/src/mainboard/google/deltaur/chromeos.c
index 7083c802fb95..2be529511726 100644
--- a/src/mainboard/google/deltaur/chromeos.c
+++ b/src/mainboard/google/deltaur/chromeos.c
@@ -98,3 +98,10 @@ void mainboard_prepare_cr50_reset(void)
 	if (ENV_RAMSTAGE)
 		pmc_soc_set_afterg3_en(true);
 }
+
+int get_ec_is_trusted(void)
+{
+	/* Do not have a Chrome EC involved in entering recovery mode;
+	   Always return trusted. */
+	return 1;
+}
diff --git a/src/mainboard/google/drallion/chromeos.c b/src/mainboard/google/drallion/chromeos.c
index 726736a5cfd5..58ad3c32c2b6 100644
--- a/src/mainboard/google/drallion/chromeos.c
+++ b/src/mainboard/google/drallion/chromeos.c
@@ -97,3 +97,10 @@ void mainboard_prepare_cr50_reset(void)
 	pmc_soc_set_afterg3_en(true);
 #endif
 }
+
+int get_ec_is_trusted(void)
+{
+	/* Do not have a Chrome EC involved in entering recovery mode;
+	   Always return trusted. */
+	return 1;
+}
diff --git a/src/mainboard/google/eve/chromeos.c b/src/mainboard/google/eve/chromeos.c
index 7c0cc96b3bed..bc458dea7712 100644
--- a/src/mainboard/google/eve/chromeos.c
+++ b/src/mainboard/google/eve/chromeos.c
@@ -36,3 +36,9 @@ void mainboard_chromeos_acpi_generate(void)
 {
 	chromeos_acpi_gpio_generate(cros_gpios, ARRAY_SIZE(cros_gpios));
 }
+
+int get_ec_is_trusted(void)
+{
+	/* EC is trusted if not in RW. */
+	return !gpio_get(GPIO_EC_IN_RW);
+}
diff --git a/src/mainboard/google/eve/gpio.h b/src/mainboard/google/eve/gpio.h
index 607486be4ccf..ad77eb5ffa49 100644
--- a/src/mainboard/google/eve/gpio.h
+++ b/src/mainboard/google/eve/gpio.h
@@ -225,6 +225,9 @@ static const struct pad_config early_gpio_table[] = {
 /* Ensure UART pins are in native mode for H1 */
 /* UART2_RXD */		PAD_CFG_NF(GPP_C20, NONE, DEEP, NF1), /* SERVO */
 /* UART2_TXD */		PAD_CFG_NF(GPP_C21, NONE, DEEP, NF1), /* SERVO */
+
+/* SM1CLK */		PAD_CFG_GPI_GPIO_DRIVER(GPP_C6, UP_20K,
+						DEEP), /* EC_IN_RW */
 };
 
 #endif
diff --git a/src/mainboard/google/fizz/chromeos.c b/src/mainboard/google/fizz/chromeos.c
index 5ee822c22ab0..d10a59f61098 100644
--- a/src/mainboard/google/fizz/chromeos.c
+++ b/src/mainboard/google/fizz/chromeos.c
@@ -36,3 +36,9 @@ void mainboard_chromeos_acpi_generate(void)
 	gpios = variant_cros_gpios(&num);
 	chromeos_acpi_gpio_generate(gpios, num);
 }
+
+int get_ec_is_trusted(void)
+{
+	/* EC is trusted if not in RW. */
+	return !gpio_get(GPIO_EC_IN_RW);
+}
diff --git a/src/mainboard/google/fizz/variants/baseboard/gpio.c b/src/mainboard/google/fizz/variants/baseboard/gpio.c
index 71546aaeba02..4787d2df5aaf 100644
--- a/src/mainboard/google/fizz/variants/baseboard/gpio.c
+++ b/src/mainboard/google/fizz/variants/baseboard/gpio.c
@@ -241,6 +241,9 @@ static const struct pad_config early_gpio_table[] = {
 /* SATAXPCIE1 */       PAD_CFG_NF(GPP_E1, NONE, DEEP,
 				  NF1), /* MB_PCIE_SATA#_DET */
 /* SATA_DEVSLP1 */     PAD_CFG_NF(GPP_E5, NONE, DEEP, NF1), /* DEVSLP1_MB */
+
+/* SM1CLK */		PAD_CFG_GPI_GPIO_DRIVER(GPP_C6, UP_20K,
+						DEEP), /* EC_IN_RW */
 };
 
 const struct pad_config * __weak variant_gpio_table(size_t *num)
diff --git a/src/mainboard/google/fizz/variants/karma/gpio.c b/src/mainboard/google/fizz/variants/karma/gpio.c
index 2735fed671b4..8b88f23640dd 100644
--- a/src/mainboard/google/fizz/variants/karma/gpio.c
+++ b/src/mainboard/google/fizz/variants/karma/gpio.c
@@ -245,6 +245,9 @@ static const struct pad_config early_gpio_table[] = {
 /* SATAXPCIE1 */       PAD_CFG_NF(GPP_E1, NONE, DEEP,
 				  NF1), /* MB_PCIE_SATA#_DET */
 /* SATA_DEVSLP1 */     PAD_CFG_NF(GPP_E5, NONE, DEEP, NF1), /* DEVSLP1_MB */
+
+/* SM1CLK */		PAD_CFG_GPI_GPIO_DRIVER(GPP_C6, UP_20K,
+						DEEP), /* EC_IN_RW */
 };
 
 const struct pad_config *variant_gpio_table(size_t *num)
diff --git a/src/mainboard/google/foster/chromeos.c b/src/mainboard/google/foster/chromeos.c
index 4e744f116fdb..9ac4cf0168c6 100644
--- a/src/mainboard/google/foster/chromeos.c
+++ b/src/mainboard/google/foster/chromeos.c
@@ -26,3 +26,10 @@ int get_write_protect_state(void)
 {
 	return 0;
 }
+
+int get_ec_is_trusted(void)
+{
+	/* Do not have a Chrome EC involved in entering recovery mode;
+	   Always return trusted. */
+	return 1;
+}
diff --git a/src/mainboard/google/gale/chromeos.c b/src/mainboard/google/gale/chromeos.c
index 2987e91d0639..54646406b9c2 100644
--- a/src/mainboard/google/gale/chromeos.c
+++ b/src/mainboard/google/gale/chromeos.c
@@ -157,3 +157,10 @@ int get_write_protect_state(void)
 {
 	return !read_gpio(get_wp_status_gpio_pin());
 }
+
+int get_ec_is_trusted(void)
+{
+	/* Do not have a Chrome EC involved in entering recovery mode;
+	   Always return trusted. */
+	return 1;
+}
diff --git a/src/mainboard/google/glados/chromeos.c b/src/mainboard/google/glados/chromeos.c
index 1dff1caba6a7..1adaed412f7a 100644
--- a/src/mainboard/google/glados/chromeos.c
+++ b/src/mainboard/google/glados/chromeos.c
@@ -35,3 +35,9 @@ void mainboard_chromeos_acpi_generate(void)
 {
 	chromeos_acpi_gpio_generate(cros_gpios, ARRAY_SIZE(cros_gpios));
 }
+
+int get_ec_is_trusted(void)
+{
+	/* EC is trusted if not in RW. */
+	return !gpio_get(GPIO_EC_IN_RW);
+}
diff --git a/src/mainboard/google/glados/variants/asuka/include/variant/gpio.h b/src/mainboard/google/glados/variants/asuka/include/variant/gpio.h
index 17c24a2ed72d..d21d9e756ae3 100644
--- a/src/mainboard/google/glados/variants/asuka/include/variant/gpio.h
+++ b/src/mainboard/google/glados/variants/asuka/include/variant/gpio.h
@@ -219,6 +219,7 @@ static const struct pad_config early_gpio_table[] = {
 /* SPI_WP_STATUS */	PAD_CFG_GPI_GPIO_DRIVER(GPP_C23, UP_20K, DEEP),
 /* GD_UART2_RXD */	PAD_CFG_NF(GPP_C20, NONE, DEEP, NF1),
 /* GD_UART2_TXD */	PAD_CFG_NF(GPP_C21, NONE, DEEP, NF1),
+/* EC_IN_RW */		PAD_CFG_GPI_GPIO_DRIVER(GPP_C6, NONE, DEEP),
 };
 
 #endif
diff --git a/src/mainboard/google/glados/variants/caroline/include/variant/gpio.h b/src/mainboard/google/glados/variants/caroline/include/variant/gpio.h
index f570006180a7..95d2d043b7ed 100644
--- a/src/mainboard/google/glados/variants/caroline/include/variant/gpio.h
+++ b/src/mainboard/google/glados/variants/caroline/include/variant/gpio.h
@@ -236,6 +236,7 @@ static const struct pad_config early_gpio_table[] = {
 /* UART2_CTS# */	PAD_CFG_GPI_GPIO_DRIVER(GPP_C23, UP_20K, DEEP), /* PCH_WP */
 /* GD_UART2_RXD */	PAD_CFG_NF(GPP_C20, NONE, DEEP, NF1),
 /* GD_UART2_TXD */	PAD_CFG_NF(GPP_C21, NONE, DEEP, NF1),
+/* SM1CLK */		PAD_CFG_GPI_GPIO_DRIVER(GPP_C6, UP_20K, DEEP), /* EC_IN_RW */
 };
 
 #endif
diff --git a/src/mainboard/google/glados/variants/cave/include/variant/gpio.h b/src/mainboard/google/glados/variants/cave/include/variant/gpio.h
index 45e1f6753163..cd71ebac2f09 100644
--- a/src/mainboard/google/glados/variants/cave/include/variant/gpio.h
+++ b/src/mainboard/google/glados/variants/cave/include/variant/gpio.h
@@ -228,6 +228,7 @@ static const struct pad_config early_gpio_table[] = {
 /* UART2_CTS# */	PAD_CFG_GPI_GPIO_DRIVER(GPP_C23, UP_20K, DEEP), /* PCH_WP */
 /* GD_UART2_RXD */	PAD_CFG_NF(GPP_C20, NONE, DEEP, NF1),
 /* GD_UART2_TXD */	PAD_CFG_NF(GPP_C21, NONE, DEEP, NF1),
+/* SM1CLK */		PAD_CFG_GPI_GPIO_DRIVER(GPP_C6, UP_20K, DEEP), /* EC_IN_RW */
 };
 
 #endif
diff --git a/src/mainboard/google/glados/variants/chell/include/variant/gpio.h b/src/mainboard/google/glados/variants/chell/include/variant/gpio.h
index 1c92e51df92f..ce78ed3856ba 100644
--- a/src/mainboard/google/glados/variants/chell/include/variant/gpio.h
+++ b/src/mainboard/google/glados/variants/chell/include/variant/gpio.h
@@ -224,6 +224,7 @@ static const struct pad_config early_gpio_table[] = {
 /* UART2_CTS# */	PAD_CFG_GPI_GPIO_DRIVER(GPP_C23, UP_20K, DEEP), /* PCH_WP */
 /* GD_UART2_RXD */	PAD_CFG_NF(GPP_C20, NONE, DEEP, NF1),
 /* GD_UART2_TXD */	PAD_CFG_NF(GPP_C21, NONE, DEEP, NF1),
+/* SM1CLK */		PAD_CFG_GPI_GPIO_DRIVER(GPP_C6, UP_20K, DEEP), /* EC_IN_RW */
 };
 
 #endif
diff --git a/src/mainboard/google/glados/variants/glados/include/variant/gpio.h b/src/mainboard/google/glados/variants/glados/include/variant/gpio.h
index a7bcdd743574..fc4eebde0af9 100644
--- a/src/mainboard/google/glados/variants/glados/include/variant/gpio.h
+++ b/src/mainboard/google/glados/variants/glados/include/variant/gpio.h
@@ -226,6 +226,8 @@ static const struct pad_config early_gpio_table[] = {
 /* UART0_CTS# */	PAD_CFG_GPO(GPP_C11, 0, DEEP), /* EN_PP3300_KEPLER */
 /* GD_UART2_RXD */	PAD_CFG_NF(GPP_C20, NONE, DEEP, NF1),
 /* GD_UART2_TXD */	PAD_CFG_NF(GPP_C21, NONE, DEEP, NF1),
+/* SM1CLK */		PAD_CFG_GPI_GPIO_DRIVER(GPP_C6, UP_20K,
+						DEEP), /* EC_IN_RW */
 };
 
 #endif
diff --git a/src/mainboard/google/glados/variants/lars/include/variant/gpio.h b/src/mainboard/google/glados/variants/lars/include/variant/gpio.h
index acbf157ac0a0..51514b22d910 100644
--- a/src/mainboard/google/glados/variants/lars/include/variant/gpio.h
+++ b/src/mainboard/google/glados/variants/lars/include/variant/gpio.h
@@ -215,6 +215,7 @@ static const struct pad_config early_gpio_table[] = {
 /* SPI_WP_STATUS */	PAD_CFG_GPI_GPIO_DRIVER(GPP_C23, UP_20K, DEEP),
 /* GD_UART2_RXD */	PAD_CFG_NF(GPP_C20, NONE, DEEP, NF1),
 /* GD_UART2_TXD */	PAD_CFG_NF(GPP_C21, NONE, DEEP, NF1),
+/* EC_IN_RW */		PAD_CFG_GPI_GPIO_DRIVER(GPP_C6, NONE, DEEP),
 };
 
 #endif
diff --git a/src/mainboard/google/glados/variants/sentry/include/variant/gpio.h b/src/mainboard/google/glados/variants/sentry/include/variant/gpio.h
index a2052a3379a5..b4011c705bff 100644
--- a/src/mainboard/google/glados/variants/sentry/include/variant/gpio.h
+++ b/src/mainboard/google/glados/variants/sentry/include/variant/gpio.h
@@ -223,6 +223,7 @@ static const struct pad_config early_gpio_table[] = {
 /* UART0_CTS# */	PAD_CFG_GPO(GPP_C11, 0, DEEP), /* EN_PP3300_KEPLER */
 /* GD_UART2_RXD */	PAD_CFG_NF(GPP_C20, NONE, DEEP, NF1),
 /* GD_UART2_TXD */	PAD_CFG_NF(GPP_C21, NONE, DEEP, NF1),
+/* EC_IN_RW */		PAD_CFG_GPI_GPIO_DRIVER(GPP_C6, NONE, DEEP),
 };
 
 #endif
diff --git a/src/mainboard/google/gru/chromeos.c b/src/mainboard/google/gru/chromeos.c
index 688c0dd27aaf..479ca3d85d44 100644
--- a/src/mainboard/google/gru/chromeos.c
+++ b/src/mainboard/google/gru/chromeos.c
@@ -49,3 +49,9 @@ int tis_plat_irq_status(void)
 	return gpio_irq_status(GPIO_TPM_IRQ);
 }
 #endif
+
+int get_ec_is_trusted(void)
+{
+	/* EC is trusted if not in RW. */
+	return !gpio_get(GPIO_EC_IN_RW);
+}
diff --git a/src/mainboard/google/guybrush/chromeos.c b/src/mainboard/google/guybrush/chromeos.c
index 3e54fa4964db..9875554d643f 100644
--- a/src/mainboard/google/guybrush/chromeos.c
+++ b/src/mainboard/google/guybrush/chromeos.c
@@ -1,6 +1,7 @@
 /* SPDX-License-Identifier: GPL-2.0-or-later */
 
 #include <baseboard/gpio.h>
+#include <boardid.h>
 #include <bootmode.h>
 #include <boot/coreboot_tables.h>
 #include <gpio.h>
@@ -26,3 +27,14 @@ void mainboard_chromeos_acpi_generate(void)
 {
 	chromeos_acpi_gpio_generate(cros_gpios, ARRAY_SIZE(cros_gpios));
 }
+
+int get_ec_is_trusted(void)
+{
+	/* Board versions 1 & 2 support H1 DB, but the EC_IN_RW signal is not
+	   routed. So emulate EC is trusted. */
+	if (CONFIG(BOARD_GOOGLE_GUYBRUSH) &&
+	    (board_id() == UNDEFINED_STRAPPING_ID || board_id() < 3))
+		return 1;
+	/* EC is trusted if not in RW. */
+	return !gpio_get(GPIO_EC_IN_RW);
+}
diff --git a/src/mainboard/google/hatch/chromeos.c b/src/mainboard/google/hatch/chromeos.c
index 3401b82d97d1..3f585c9ebedb 100644
--- a/src/mainboard/google/hatch/chromeos.c
+++ b/src/mainboard/google/hatch/chromeos.c
@@ -36,3 +36,9 @@ void mainboard_chromeos_acpi_generate(void)
 
 	chromeos_acpi_gpio_generate(cros_gpios, num_gpios);
 }
+
+int get_ec_is_trusted(void)
+{
+	/* EC is trusted if not in RW. */
+	return !gpio_get(GPIO_EC_IN_RW);
+}
diff --git a/src/mainboard/google/hatch/variants/akemi/gpio.c b/src/mainboard/google/hatch/variants/akemi/gpio.c
index b08f062186e2..d7fe09e26410 100644
--- a/src/mainboard/google/hatch/variants/akemi/gpio.c
+++ b/src/mainboard/google/hatch/variants/akemi/gpio.c
@@ -162,6 +162,8 @@ static const struct pad_config early_gpio_table[] = {
 	PAD_CFG_GPI(GPP_C20, NONE, DEEP),
 	/* C21 : H1_PCH_INT_ODL */
 	PAD_CFG_GPI_APIC(GPP_C21, NONE, PLTRST, LEVEL, INVERT),
+	/* C22 : EC_IN_RW_OD */
+	PAD_CFG_GPI(GPP_C22, NONE, DEEP),
 	/* C23 : WLAN_PE_RST# */
 	PAD_CFG_GPO(GPP_C23, 1, DEEP),
 	/* E1  : M2_SSD_PEDET */
diff --git a/src/mainboard/google/hatch/variants/ambassador/gpio.c b/src/mainboard/google/hatch/variants/ambassador/gpio.c
index 5a911fc4f97e..996edc4fc7e0 100644
--- a/src/mainboard/google/hatch/variants/ambassador/gpio.c
+++ b/src/mainboard/google/hatch/variants/ambassador/gpio.c
@@ -100,6 +100,8 @@ static const struct pad_config early_gpio_table[] = {
 	PAD_CFG_GPI(GPP_C20, NONE, DEEP),
 	/* C21 : H1_PCH_INT_ODL */
 	PAD_CFG_GPI_APIC(GPP_C21, NONE, PLTRST, LEVEL, INVERT),
+	/* C22 : EC_IN_RW_OD */
+	PAD_CFG_GPI(GPP_C22, NONE, DEEP),
 	/* C23 : WLAN_PE_RST# */
 	PAD_CFG_GPO(GPP_C23, 1, DEEP),
 	/* E1  : M2_SSD_PEDET */
diff --git a/src/mainboard/google/hatch/variants/dooly/gpio.c b/src/mainboard/google/hatch/variants/dooly/gpio.c
index d28f1fe86bee..37cd08cdaeb3 100644
--- a/src/mainboard/google/hatch/variants/dooly/gpio.c
+++ b/src/mainboard/google/hatch/variants/dooly/gpio.c
@@ -137,6 +137,8 @@ static const struct pad_config early_gpio_table[] = {
 	PAD_CFG_GPI(GPP_C20, NONE, DEEP),
 	/* C21 : H1_PCH_INT_ODL */
 	PAD_CFG_GPI_APIC(GPP_C21, NONE, PLTRST, LEVEL, INVERT),
+	/* C22 : EC_IN_RW_OD */
+	PAD_CFG_GPI(GPP_C22, NONE, DEEP),
 	/* C23 : WLAN_PE_RST# */
 	PAD_CFG_GPO(GPP_C23, 1, DEEP),
 	/* E1  : M2_SSD_PEDET */
diff --git a/src/mainboard/google/hatch/variants/dratini/gpio.c b/src/mainboard/google/hatch/variants/dratini/gpio.c
index 712a9185d0c1..02555a036904 100644
--- a/src/mainboard/google/hatch/variants/dratini/gpio.c
+++ b/src/mainboard/google/hatch/variants/dratini/gpio.c
@@ -86,6 +86,8 @@ static const struct pad_config early_gpio_table[] = {
 	PAD_CFG_GPI(GPP_C20, NONE, DEEP),
 	/* C21 : H1_PCH_INT_ODL */
 	PAD_CFG_GPI_APIC(GPP_C21, NONE, PLTRST, LEVEL, INVERT),
+	/* C22 : EC_IN_RW_OD */
+	PAD_CFG_GPI(GPP_C22, NONE, DEEP),
 	/* C23 : WLAN_PE_RST# */
 	PAD_CFG_GPO(GPP_C23, 1, DEEP),
 	/* E1  : M2_SSD_PEDET */
diff --git a/src/mainboard/google/hatch/variants/duffy/gpio.c b/src/mainboard/google/hatch/variants/duffy/gpio.c
index 5a911fc4f97e..996edc4fc7e0 100644
--- a/src/mainboard/google/hatch/variants/duffy/gpio.c
+++ b/src/mainboard/google/hatch/variants/duffy/gpio.c
@@ -100,6 +100,8 @@ static const struct pad_config early_gpio_table[] = {
 	PAD_CFG_GPI(GPP_C20, NONE, DEEP),
 	/* C21 : H1_PCH_INT_ODL */
 	PAD_CFG_GPI_APIC(GPP_C21, NONE, PLTRST, LEVEL, INVERT),
+	/* C22 : EC_IN_RW_OD */
+	PAD_CFG_GPI(GPP_C22, NONE, DEEP),
 	/* C23 : WLAN_PE_RST# */
 	PAD_CFG_GPO(GPP_C23, 1, DEEP),
 	/* E1  : M2_SSD_PEDET */
diff --git a/src/mainboard/google/hatch/variants/faffy/gpio.c b/src/mainboard/google/hatch/variants/faffy/gpio.c
index 5a911fc4f97e..996edc4fc7e0 100644
--- a/src/mainboard/google/hatch/variants/faffy/gpio.c
+++ b/src/mainboard/google/hatch/variants/faffy/gpio.c
@@ -100,6 +100,8 @@ static const struct pad_config early_gpio_table[] = {
 	PAD_CFG_GPI(GPP_C20, NONE, DEEP),
 	/* C21 : H1_PCH_INT_ODL */
 	PAD_CFG_GPI_APIC(GPP_C21, NONE, PLTRST, LEVEL, INVERT),
+	/* C22 : EC_IN_RW_OD */
+	PAD_CFG_GPI(GPP_C22, NONE, DEEP),
 	/* C23 : WLAN_PE_RST# */
 	PAD_CFG_GPO(GPP_C23, 1, DEEP),
 	/* E1  : M2_SSD_PEDET */
diff --git a/src/mainboard/google/hatch/variants/genesis/gpio.c b/src/mainboard/google/hatch/variants/genesis/gpio.c
index cb5c89b89e65..66a1b8aec16d 100644
--- a/src/mainboard/google/hatch/variants/genesis/gpio.c
+++ b/src/mainboard/google/hatch/variants/genesis/gpio.c
@@ -128,6 +128,8 @@ static const struct pad_config early_gpio_table[] = {
 	PAD_CFG_GPI(GPP_C20, NONE, DEEP),
 	/* C21 : H1_PCH_INT_ODL */
 	PAD_CFG_GPI_APIC(GPP_C21, NONE, PLTRST, LEVEL, INVERT),
+	/* C22 : EC_IN_RW_OD */
+	PAD_CFG_GPI(GPP_C22, NONE, DEEP),
 	/* C23 : WLAN_PE_RST# */
 	PAD_CFG_GPO(GPP_C23, 1, DEEP),
 	/* E1  : M2_SSD_PEDET */
diff --git a/src/mainboard/google/hatch/variants/hatch/gpio.c b/src/mainboard/google/hatch/variants/hatch/gpio.c
index cfd324892d0f..dbe72dd8880c 100644
--- a/src/mainboard/google/hatch/variants/hatch/gpio.c
+++ b/src/mainboard/google/hatch/variants/hatch/gpio.c
@@ -60,6 +60,8 @@ static const struct pad_config early_gpio_table[] = {
 	PAD_CFG_GPI(GPP_C20, NONE, DEEP),
 	/* C21 : H1_PCH_INT_ODL */
 	PAD_CFG_GPI_APIC(GPP_C21, NONE, PLTRST, LEVEL, INVERT),
+	/* C22 : EC_IN_RW_OD */
+	PAD_CFG_GPI(GPP_C22, NONE, DEEP),
 	/* C23 : WLAN_PE_RST# */
 	PAD_CFG_GPO(GPP_C23, 1, DEEP),
 	/* E1  : M2_SSD_PEDET */
diff --git a/src/mainboard/google/hatch/variants/helios/gpio.c b/src/mainboard/google/hatch/variants/helios/gpio.c
index 988580214037..f7c5e8f59a16 100644
--- a/src/mainboard/google/hatch/variants/helios/gpio.c
+++ b/src/mainboard/google/hatch/variants/helios/gpio.c
@@ -124,6 +124,8 @@ static const struct pad_config early_gpio_table[] = {
 	PAD_CFG_GPI(GPP_C20, NONE, DEEP),
 	/* C21 : H1_PCH_INT_ODL */
 	PAD_CFG_GPI_APIC(GPP_C21, NONE, PLTRST, LEVEL, INVERT),
+	/* C22 : EC_IN_RW_OD */
+	PAD_CFG_GPI(GPP_C22, NONE, DEEP),
 	/* E1  : M2_SSD_PEDET */
 	PAD_CFG_NF(GPP_E1, NONE, DEEP, NF1),
 	/* E5  : SATA_DEVSLP1 */
diff --git a/src/mainboard/google/hatch/variants/jinlon/gpio.c b/src/mainboard/google/hatch/variants/jinlon/gpio.c
index a0658b091a57..1020dd6ecfdc 100644
--- a/src/mainboard/google/hatch/variants/jinlon/gpio.c
+++ b/src/mainboard/google/hatch/variants/jinlon/gpio.c
@@ -90,6 +90,8 @@ static const struct pad_config early_gpio_table[] = {
 	PAD_CFG_GPI(GPP_C20, NONE, DEEP),
 	/* C21 : H1_PCH_INT_ODL */
 	PAD_CFG_GPI_APIC(GPP_C21, NONE, PLTRST, LEVEL, INVERT),
+	/* C22 : EC_IN_RW_OD */
+	PAD_CFG_GPI(GPP_C22, NONE, DEEP),
 	/* C23 : WLAN_PE_RST# */
 	PAD_CFG_GPO(GPP_C23, 1, DEEP),
 	/* E1  : M2_SSD_PEDET */
diff --git a/src/mainboard/google/hatch/variants/kaisa/gpio.c b/src/mainboard/google/hatch/variants/kaisa/gpio.c
index 5a911fc4f97e..996edc4fc7e0 100644
--- a/src/mainboard/google/hatch/variants/kaisa/gpio.c
+++ b/src/mainboard/google/hatch/variants/kaisa/gpio.c
@@ -100,6 +100,8 @@ static const struct pad_config early_gpio_table[] = {
 	PAD_CFG_GPI(GPP_C20, NONE, DEEP),
 	/* C21 : H1_PCH_INT_ODL */
 	PAD_CFG_GPI_APIC(GPP_C21, NONE, PLTRST, LEVEL, INVERT),
+	/* C22 : EC_IN_RW_OD */
+	PAD_CFG_GPI(GPP_C22, NONE, DEEP),
 	/* C23 : WLAN_PE_RST# */
 	PAD_CFG_GPO(GPP_C23, 1, DEEP),
 	/* E1  : M2_SSD_PEDET */
diff --git a/src/mainboard/google/hatch/variants/kindred/gpio.c b/src/mainboard/google/hatch/variants/kindred/gpio.c
index b147e41118fc..0d5573007685 100644
--- a/src/mainboard/google/hatch/variants/kindred/gpio.c
+++ b/src/mainboard/google/hatch/variants/kindred/gpio.c
@@ -220,6 +220,8 @@ static const struct pad_config early_gpio_table[] = {
 	PAD_CFG_GPI(GPP_C20, NONE, DEEP),
 	/* C21 : H1_PCH_INT_ODL */
 	PAD_CFG_GPI_APIC(GPP_C21, NONE, PLTRST, LEVEL, INVERT),
+	/* C22 : EC_IN_RW_OD */
+	PAD_CFG_GPI(GPP_C22, NONE, DEEP),
 	/* C23 : WLAN_PE_RST# */
 	PAD_CFG_GPO(GPP_C23, 1, DEEP),
 	/* E1  : M2_SSD_PEDET */
diff --git a/src/mainboard/google/hatch/variants/kohaku/gpio.c b/src/mainboard/google/hatch/variants/kohaku/gpio.c
index d45e9cb0ffff..aa8693242637 100644
--- a/src/mainboard/google/hatch/variants/kohaku/gpio.c
+++ b/src/mainboard/google/hatch/variants/kohaku/gpio.c
@@ -106,6 +106,8 @@ static const struct pad_config early_gpio_table[] = {
 	PAD_CFG_GPI(GPP_C20, NONE, DEEP),
 	/* C21 : H1_PCH_INT_ODL */
 	PAD_CFG_GPI_APIC(GPP_C21, NONE, PLTRST, LEVEL, INVERT),
+	/* C22 : EC_IN_RW_OD */
+	PAD_CFG_GPI(GPP_C22, NONE, DEEP),
 	/* E1  : M2_SSD_PEDET */
 	PAD_CFG_NF(GPP_E1, NONE, DEEP, NF1),
 	/* E5  : SATA_DEVSLP1 */
diff --git a/src/mainboard/google/hatch/variants/moonbuggy/gpio.c b/src/mainboard/google/hatch/variants/moonbuggy/gpio.c
index 759768b3c864..ba75fb768dc2 100644
--- a/src/mainboard/google/hatch/variants/moonbuggy/gpio.c
+++ b/src/mainboard/google/hatch/variants/moonbuggy/gpio.c
@@ -126,6 +126,8 @@ static const struct pad_config early_gpio_table[] = {
 	PAD_CFG_GPI(GPP_C20, NONE, DEEP),
 	/* C21 : H1_PCH_INT_ODL */
 	PAD_CFG_GPI_APIC(GPP_C21, NONE, PLTRST, LEVEL, INVERT),
+	/* C22 : EC_IN_RW_OD */
+	PAD_CFG_GPI(GPP_C22, NONE, DEEP),
 	/* C23 : WLAN_PE_RST# */
 	PAD_CFG_GPO(GPP_C23, 1, DEEP),
 	/* E1  : M2_SSD_PEDET */
diff --git a/src/mainboard/google/hatch/variants/mushu/gpio.c b/src/mainboard/google/hatch/variants/mushu/gpio.c
index 582d68e6a295..4ead952c144a 100644
--- a/src/mainboard/google/hatch/variants/mushu/gpio.c
+++ b/src/mainboard/google/hatch/variants/mushu/gpio.c
@@ -64,6 +64,8 @@ static const struct pad_config early_gpio_table[] = {
 	PAD_CFG_GPI(GPP_C20, NONE, DEEP),
 	/* C21 : H1_PCH_INT_ODL */
 	PAD_CFG_GPI_APIC(GPP_C21, NONE, PLTRST, LEVEL, INVERT),
+	/* C22 : EC_IN_RW_OD */
+	PAD_CFG_GPI(GPP_C22, NONE, DEEP),
 	/* C23 : WLAN_PE_RST# */
 	PAD_CFG_GPO(GPP_C23, 1, DEEP),
 	/* E1  : M2_SSD_PEDET */
diff --git a/src/mainboard/google/hatch/variants/nightfury/gpio.c b/src/mainboard/google/hatch/variants/nightfury/gpio.c
index 1ab10a84af93..a813dfa5772b 100644
--- a/src/mainboard/google/hatch/variants/nightfury/gpio.c
+++ b/src/mainboard/google/hatch/variants/nightfury/gpio.c
@@ -120,6 +120,8 @@ static const struct pad_config early_gpio_table[] = {
 	PAD_CFG_GPI(GPP_C20, NONE, DEEP),
 	/* C21 : H1_PCH_INT_ODL */
 	PAD_CFG_GPI_APIC(GPP_C21, NONE, PLTRST, LEVEL, INVERT),
+	/* C22 : EC_IN_RW_OD */
+	PAD_CFG_GPI(GPP_C22, NONE, DEEP),
 	/* E1  : M2_SSD_PEDET */
 	PAD_CFG_NF(GPP_E1, NONE, DEEP, NF1),
 	/* E5  : SATA_DEVSLP1 */
diff --git a/src/mainboard/google/hatch/variants/noibat/gpio.c b/src/mainboard/google/hatch/variants/noibat/gpio.c
index 5a911fc4f97e..996edc4fc7e0 100644
--- a/src/mainboard/google/hatch/variants/noibat/gpio.c
+++ b/src/mainboard/google/hatch/variants/noibat/gpio.c
@@ -100,6 +100,8 @@ static const struct pad_config early_gpio_table[] = {
 	PAD_CFG_GPI(GPP_C20, NONE, DEEP),
 	/* C21 : H1_PCH_INT_ODL */
 	PAD_CFG_GPI_APIC(GPP_C21, NONE, PLTRST, LEVEL, INVERT),
+	/* C22 : EC_IN_RW_OD */
+	PAD_CFG_GPI(GPP_C22, NONE, DEEP),
 	/* C23 : WLAN_PE_RST# */
 	PAD_CFG_GPO(GPP_C23, 1, DEEP),
 	/* E1  : M2_SSD_PEDET */
diff --git a/src/mainboard/google/hatch/variants/palkia/gpio.c b/src/mainboard/google/hatch/variants/palkia/gpio.c
index c4d6f50dd7db..58ec12b582db 100644
--- a/src/mainboard/google/hatch/variants/palkia/gpio.c
+++ b/src/mainboard/google/hatch/variants/palkia/gpio.c
@@ -128,6 +128,8 @@ static const struct pad_config early_gpio_table[] = {
 	PAD_CFG_GPI(GPP_C20, NONE, DEEP),
 	/* C21 : H1_PCH_INT_ODL */
 	PAD_CFG_GPI_APIC(GPP_C21, NONE, PLTRST, LEVEL, INVERT),
+	/* C22 : EC_IN_RW_OD */
+	PAD_CFG_GPI(GPP_C22, NONE, DEEP),
 	/* E1  : M2_SSD_PEDET */
 	PAD_CFG_NF(GPP_E1, NONE, DEEP, NF1),
 	/* E5  : SATA_DEVSLP1 */
diff --git a/src/mainboard/google/hatch/variants/puff/gpio.c b/src/mainboard/google/hatch/variants/puff/gpio.c
index 5a911fc4f97e..996edc4fc7e0 100644
--- a/src/mainboard/google/hatch/variants/puff/gpio.c
+++ b/src/mainboard/google/hatch/variants/puff/gpio.c
@@ -100,6 +100,8 @@ static const struct pad_config early_gpio_table[] = {
 	PAD_CFG_GPI(GPP_C20, NONE, DEEP),
 	/* C21 : H1_PCH_INT_ODL */
 	PAD_CFG_GPI_APIC(GPP_C21, NONE, PLTRST, LEVEL, INVERT),
+	/* C22 : EC_IN_RW_OD */
+	PAD_CFG_GPI(GPP_C22, NONE, DEEP),
 	/* C23 : WLAN_PE_RST# */
 	PAD_CFG_GPO(GPP_C23, 1, DEEP),
 	/* E1  : M2_SSD_PEDET */
diff --git a/src/mainboard/google/hatch/variants/scout/gpio.c b/src/mainboard/google/hatch/variants/scout/gpio.c
index 5491efef9dce..218d3db698e2 100644
--- a/src/mainboard/google/hatch/variants/scout/gpio.c
+++ b/src/mainboard/google/hatch/variants/scout/gpio.c
@@ -160,6 +160,8 @@ static const struct pad_config early_gpio_table[] = {
 	PAD_CFG_GPI(GPP_C20, NONE, DEEP),
 	/* C21 : H1_PCH_INT_ODL */
 	PAD_CFG_GPI_APIC(GPP_C21, NONE, PLTRST, LEVEL, INVERT),
+	/* C22 : EC_IN_RW_OD */
+	PAD_CFG_GPI(GPP_C22, NONE, DEEP),
 	/* C23 : WLAN_PE_RST# */
 	PAD_CFG_GPO(GPP_C23, 1, DEEP),
 	/* E1  : M2_SSD_PEDET */
diff --git a/src/mainboard/google/hatch/variants/stryke/gpio.c b/src/mainboard/google/hatch/variants/stryke/gpio.c
index fd8a55c09db6..2734629efb0c 100644
--- a/src/mainboard/google/hatch/variants/stryke/gpio.c
+++ b/src/mainboard/google/hatch/variants/stryke/gpio.c
@@ -80,6 +80,8 @@ static const struct pad_config early_gpio_table[] = {
 	PAD_CFG_GPI(GPP_C20, NONE, DEEP),
 	/* C21 : H1_PCH_INT_ODL */
 	PAD_CFG_GPI_APIC(GPP_C21, NONE, PLTRST, LEVEL, INVERT),
+	/* C22 : EC_IN_RW_OD */
+	PAD_CFG_GPI(GPP_C22, NONE, DEEP),
 	/* C23 : WLAN_PE_RST# */
 	PAD_CFG_GPO(GPP_C23, 1, DEEP),
 	/* E1  : M2_SSD_PEDET */
diff --git a/src/mainboard/google/hatch/variants/wyvern/gpio.c b/src/mainboard/google/hatch/variants/wyvern/gpio.c
index 5a911fc4f97e..996edc4fc7e0 100644
--- a/src/mainboard/google/hatch/variants/wyvern/gpio.c
+++ b/src/mainboard/google/hatch/variants/wyvern/gpio.c
@@ -100,6 +100,8 @@ static const struct pad_config early_gpio_table[] = {
 	PAD_CFG_GPI(GPP_C20, NONE, DEEP),
 	/* C21 : H1_PCH_INT_ODL */
 	PAD_CFG_GPI_APIC(GPP_C21, NONE, PLTRST, LEVEL, INVERT),
+	/* C22 : EC_IN_RW_OD */
+	PAD_CFG_GPI(GPP_C22, NONE, DEEP),
 	/* C23 : WLAN_PE_RST# */
 	PAD_CFG_GPO(GPP_C23, 1, DEEP),
 	/* E1  : M2_SSD_PEDET */
diff --git a/src/mainboard/google/herobrine/chromeos.c b/src/mainboard/google/herobrine/chromeos.c
index a11667586bb8..9faf4baf5f9a 100644
--- a/src/mainboard/google/herobrine/chromeos.c
+++ b/src/mainboard/google/herobrine/chromeos.c
@@ -24,3 +24,9 @@ void fill_lb_gpios(struct lb_gpios *gpios)
 
 	lb_add_gpios(gpios, chromeos_gpios, ARRAY_SIZE(chromeos_gpios));
 }
+
+int get_ec_is_trusted(void)
+{
+	/* Stub GPIO. */
+	return 0;
+}
diff --git a/src/mainboard/google/jecht/chromeos.c b/src/mainboard/google/jecht/chromeos.c
index 807e37fcb26c..239134bc5f0a 100644
--- a/src/mainboard/google/jecht/chromeos.c
+++ b/src/mainboard/google/jecht/chromeos.c
@@ -76,3 +76,10 @@ void mainboard_chromeos_acpi_generate(void)
 {
 	chromeos_acpi_gpio_generate(cros_gpios, ARRAY_SIZE(cros_gpios));
 }
+
+int get_ec_is_trusted(void)
+{
+	/* Do not have a Chrome EC involved in entering recovery mode;
+	   Always return trusted. */
+	return 1;
+}
diff --git a/src/mainboard/google/kahlee/chromeos.c b/src/mainboard/google/kahlee/chromeos.c
index 0a465c98a459..690a9e3af3bf 100644
--- a/src/mainboard/google/kahlee/chromeos.c
+++ b/src/mainboard/google/kahlee/chromeos.c
@@ -34,3 +34,9 @@ void mainboard_chromeos_acpi_generate(void)
 {
 	chromeos_acpi_gpio_generate(cros_gpios, ARRAY_SIZE(cros_gpios));
 }
+
+int get_ec_is_trusted(void)
+{
+	/* EC is trusted if not in RW. */
+	return !gpio_get(GPIO_EC_IN_RW);
+}
diff --git a/src/mainboard/google/kukui/chromeos.c b/src/mainboard/google/kukui/chromeos.c
index 3f15a3fb9131..4c4a8bec03fd 100644
--- a/src/mainboard/google/kukui/chromeos.c
+++ b/src/mainboard/google/kukui/chromeos.c
@@ -37,3 +37,9 @@ int tis_plat_irq_status(void)
 {
 	return gpio_eint_poll(CR50_IRQ);
 }
+
+int get_ec_is_trusted(void)
+{
+	/* EC is trusted if not in RW. */
+	return !gpio_get(EC_IN_RW);
+}
diff --git a/src/mainboard/google/link/chromeos.c b/src/mainboard/google/link/chromeos.c
index f77c822f6c56..f5441677dbcc 100644
--- a/src/mainboard/google/link/chromeos.c
+++ b/src/mainboard/google/link/chromeos.c
@@ -8,6 +8,8 @@
 #include <vendorcode/google/chromeos/chromeos.h>
 #include "onboard.h"
 
+#define GPIO_EC_IN_RW 21
+
 void fill_lb_gpios(struct lb_gpios *gpios)
 {
 	struct lb_gpio chromeos_gpios[] = {
@@ -39,3 +41,9 @@ void mainboard_chromeos_acpi_generate(void)
 {
 	chromeos_acpi_gpio_generate(cros_gpios, ARRAY_SIZE(cros_gpios));
 }
+
+int get_ec_is_trusted(void)
+{
+	/* EC is trusted if not in RW. */
+	return !get_gpio(GPIO_EC_IN_RW);
+}
diff --git a/src/mainboard/google/mistral/chromeos.c b/src/mainboard/google/mistral/chromeos.c
index c827c7d13dbd..7ffcd57c51b4 100644
--- a/src/mainboard/google/mistral/chromeos.c
+++ b/src/mainboard/google/mistral/chromeos.c
@@ -1,8 +1,16 @@
 /* SPDX-License-Identifier: GPL-2.0-only */
 
 #include <boot/coreboot_tables.h>
+#include <bootmode.h>
 
 void fill_lb_gpios(struct lb_gpios *gpios)
 {
 
 }
+
+int get_ec_is_trusted(void)
+{
+	/* Do not have a Chrome EC involved in entering recovery mode;
+	   Always return trusted. */
+	return 1;
+}
diff --git a/src/mainboard/google/nyan/chromeos.c b/src/mainboard/google/nyan/chromeos.c
index 7fe877bff04a..9aaad2f191f3 100644
--- a/src/mainboard/google/nyan/chromeos.c
+++ b/src/mainboard/google/nyan/chromeos.c
@@ -19,3 +19,9 @@ int get_write_protect_state(void)
 {
 	return !gpio_get(GPIO(R1));
 }
+
+int get_ec_is_trusted(void)
+{
+	/* EC is trusted if not in RW. */
+	return !gpio_get(GPIO(U4));
+}
diff --git a/src/mainboard/google/nyan_big/chromeos.c b/src/mainboard/google/nyan_big/chromeos.c
index 7fe877bff04a..9aaad2f191f3 100644
--- a/src/mainboard/google/nyan_big/chromeos.c
+++ b/src/mainboard/google/nyan_big/chromeos.c
@@ -19,3 +19,9 @@ int get_write_protect_state(void)
 {
 	return !gpio_get(GPIO(R1));
 }
+
+int get_ec_is_trusted(void)
+{
+	/* EC is trusted if not in RW. */
+	return !gpio_get(GPIO(U4));
+}
diff --git a/src/mainboard/google/nyan_blaze/chromeos.c b/src/mainboard/google/nyan_blaze/chromeos.c
index 7fe877bff04a..9aaad2f191f3 100644
--- a/src/mainboard/google/nyan_blaze/chromeos.c
+++ b/src/mainboard/google/nyan_blaze/chromeos.c
@@ -19,3 +19,9 @@ int get_write_protect_state(void)
 {
 	return !gpio_get(GPIO(R1));
 }
+
+int get_ec_is_trusted(void)
+{
+	/* EC is trusted if not in RW. */
+	return !gpio_get(GPIO(U4));
+}
diff --git a/src/mainboard/google/oak/chromeos.c b/src/mainboard/google/oak/chromeos.c
index 9e7af2738219..739df2e25bc2 100644
--- a/src/mainboard/google/oak/chromeos.c
+++ b/src/mainboard/google/oak/chromeos.c
@@ -34,3 +34,9 @@ int get_write_protect_state(void)
 {
 	return !gpio_get(WRITE_PROTECT);
 }
+
+int get_ec_is_trusted(void)
+{
+	/* EC is trusted if not in RW. */
+	return !gpio_get(EC_IN_RW);
+}
diff --git a/src/mainboard/google/octopus/chromeos.c b/src/mainboard/google/octopus/chromeos.c
index 9c260ab60ac6..82599aca734f 100644
--- a/src/mainboard/google/octopus/chromeos.c
+++ b/src/mainboard/google/octopus/chromeos.c
@@ -35,3 +35,9 @@ void mainboard_chromeos_acpi_generate(void)
 	gpios = variant_cros_gpios(&num);
 	chromeos_acpi_gpio_generate(gpios, num);
 }
+
+int get_ec_is_trusted(void)
+{
+	/* EC is trusted if not in RW. */
+	return !gpio_get(GPIO_EC_IN_RW);
+}
diff --git a/src/mainboard/google/octopus/variants/baseboard/gpio.c b/src/mainboard/google/octopus/variants/baseboard/gpio.c
index d16c4e1b129a..61e8e0d9c97b 100644
--- a/src/mainboard/google/octopus/variants/baseboard/gpio.c
+++ b/src/mainboard/google/octopus/variants/baseboard/gpio.c
@@ -344,6 +344,8 @@ static const struct pad_config early_gpio_table[] = {
 	 * stages.
 	 */
 	PAD_CFG_GPO_IOSSTATE_IOSTERM(GPIO_161, 1, DEEP, UP_20K, Tx1RxDCRx0, DISPUPD), /* AVS_I2S1_MCLK -- LTE_OFF_ODL */
+
+	PAD_CFG_GPI(GPIO_189, NONE, DEEP), /* EC_IN_RW */
 };
 
 const struct pad_config *__weak
diff --git a/src/mainboard/google/parrot/chromeos.c b/src/mainboard/google/parrot/chromeos.c
index 4781f7e6221a..01a2d8e31d29 100644
--- a/src/mainboard/google/parrot/chromeos.c
+++ b/src/mainboard/google/parrot/chromeos.c
@@ -64,3 +64,10 @@ void mainboard_chromeos_acpi_generate(void)
 
 	chromeos_acpi_gpio_generate(cros_gpios, ARRAY_SIZE(cros_gpios));
 }
+
+int get_ec_is_trusted(void)
+{
+	/* Do not have a Chrome EC involved in entering recovery mode;
+	   Always return trusted. */
+	return 1;
+}
diff --git a/src/mainboard/google/peach_pit/chromeos.c b/src/mainboard/google/peach_pit/chromeos.c
index 07a13a31b50f..e1d8fa1a9a98 100644
--- a/src/mainboard/google/peach_pit/chromeos.c
+++ b/src/mainboard/google/peach_pit/chromeos.c
@@ -38,3 +38,9 @@ int get_write_protect_state(void)
 {
 	return !gpio_get_value(GPIO_X30);
 }
+
+int get_ec_is_trusted(void)
+{
+	/* EC is trusted if not in RW. */
+	return !gpio_get_value(GPIO_X23);
+}
diff --git a/src/mainboard/google/poppy/chromeos.c b/src/mainboard/google/poppy/chromeos.c
index ff39fbf337f7..4cd9029a830c 100644
--- a/src/mainboard/google/poppy/chromeos.c
+++ b/src/mainboard/google/poppy/chromeos.c
@@ -40,3 +40,9 @@ void mainboard_chromeos_acpi_generate(void)
 	gpios = variant_cros_gpios(&num);
 	chromeos_acpi_gpio_generate(gpios, num);
 }
+
+int get_ec_is_trusted(void)
+{
+	/* EC is trusted if not in RW. */
+	return !gpio_get(GPIO_EC_IN_RW);
+}
diff --git a/src/mainboard/google/poppy/variants/atlas/gpio.c b/src/mainboard/google/poppy/variants/atlas/gpio.c
index d3ea6b537b7f..ffea69491002 100644
--- a/src/mainboard/google/poppy/variants/atlas/gpio.c
+++ b/src/mainboard/google/poppy/variants/atlas/gpio.c
@@ -345,6 +345,9 @@ static const struct pad_config early_gpio_table[] = {
 	/* B18 : GSPI0_MOSI ==> H1_SLAVE_SPI_MOSI */
 	PAD_CFG_NF(GPP_B18, NONE, DEEP, NF1),
 
+	/* C6  : SM1CLK ==> EC_IN_RW_OD */
+	PAD_CFG_GPI_GPIO_DRIVER(GPP_C6, UP_20K, DEEP),
+
 	/* Ensure UART pins are in native mode for H1. */
 	/* C20 : UART2_RXD ==> PCHRX_SERVOTX_UART */
 	PAD_CFG_NF(GPP_C20, NONE, DEEP, NF1),
diff --git a/src/mainboard/google/poppy/variants/baseboard/gpio.c b/src/mainboard/google/poppy/variants/baseboard/gpio.c
index d3df99e44f17..ea9de7aa5443 100644
--- a/src/mainboard/google/poppy/variants/baseboard/gpio.c
+++ b/src/mainboard/google/poppy/variants/baseboard/gpio.c
@@ -341,6 +341,9 @@ static const struct pad_config gpio_table[] = {
 
 /* Early pad configuration in bootblock */
 static const struct pad_config early_gpio_table[] = {
+	/* C6  : SM1CLK ==> EC_IN_RW_OD */
+	PAD_CFG_GPI_GPIO_DRIVER(GPP_C6, UP_20K, DEEP),
+
 	/* C18 : I2C1_SDA ==> PCH_I2C1_H1_3V3_SDA */
 	PAD_CFG_NF(GPP_C18, NONE, DEEP, NF1),
 	/* C19 : I2C1_SCL ==> PCH_I2C1_H1_3V3_SCL */
diff --git a/src/mainboard/google/poppy/variants/nami/gpio.c b/src/mainboard/google/poppy/variants/nami/gpio.c
index 6dba783920a6..b5ec95405e4f 100644
--- a/src/mainboard/google/poppy/variants/nami/gpio.c
+++ b/src/mainboard/google/poppy/variants/nami/gpio.c
@@ -346,6 +346,9 @@ static const struct pad_config early_gpio_table[] = {
 	/* B18 : GSPI0_MOSI ==> PCH_SPI_H1_3V3_MOSI */
 	PAD_CFG_NF(GPP_B18, NONE, DEEP, NF1),
 
+	/* C6  : SM1CLK ==> EC_IN_RW_OD */
+	PAD_CFG_GPI_GPIO_DRIVER(GPP_C6, UP_20K, DEEP),
+
 	/* Ensure UART pins are in native mode for H1. */
 	/* C20 : UART2_RXD ==> PCHRX_SERVOTX_UART */
 	PAD_CFG_NF(GPP_C20, NONE, DEEP, NF1),
diff --git a/src/mainboard/google/poppy/variants/nautilus/gpio.c b/src/mainboard/google/poppy/variants/nautilus/gpio.c
index 37378f93a701..e06355a3b7ba 100644
--- a/src/mainboard/google/poppy/variants/nautilus/gpio.c
+++ b/src/mainboard/google/poppy/variants/nautilus/gpio.c
@@ -331,6 +331,9 @@ static const struct pad_config gpio_table[] = {
 
 /* Early pad configuration in bootblock */
 static const struct pad_config early_gpio_table[] = {
+	/* C6  : SM1CLK ==> EC_IN_RW_OD */
+	PAD_CFG_GPI_GPIO_DRIVER(GPP_C6, UP_20K, DEEP),
+
 	/* C18 : I2C1_SDA ==> PCH_I2C1_H1_3V3_SDA */
 	PAD_CFG_NF(GPP_C18, NONE, DEEP, NF1),
 	/* C19 : I2C1_SCL ==> PCH_I2C1_H1_3V3_SCL */
diff --git a/src/mainboard/google/poppy/variants/nocturne/gpio.c b/src/mainboard/google/poppy/variants/nocturne/gpio.c
index f5344584baae..6324d8fa479c 100644
--- a/src/mainboard/google/poppy/variants/nocturne/gpio.c
+++ b/src/mainboard/google/poppy/variants/nocturne/gpio.c
@@ -352,6 +352,9 @@ static const struct pad_config early_gpio_table[] = {
 	/* B18 : GSPI0_MOSI ==> H1_SLAVE_SPI_MOSI */
 	PAD_CFG_NF(GPP_B18, DN_20K, DEEP, NF1),
 
+	/* C6  : SM1CLK ==> EC_IN_RW_OD */
+	PAD_CFG_GPI_GPIO_DRIVER(GPP_C6, UP_20K, DEEP),
+
 	/* Ensure UART pins are in native mode for H1. */
 	/* C20 : UART2_RXD ==> PCHRX_SERVOTX_UART */
 	PAD_CFG_NF(GPP_C20, NONE, DEEP, NF1),
diff --git a/src/mainboard/google/poppy/variants/rammus/gpio.c b/src/mainboard/google/poppy/variants/rammus/gpio.c
index 8e9e5c01c5ef..c67c560c7088 100644
--- a/src/mainboard/google/poppy/variants/rammus/gpio.c
+++ b/src/mainboard/google/poppy/variants/rammus/gpio.c
@@ -349,6 +349,9 @@ static const struct pad_config early_gpio_table[] = {
 	/* B18 : GSPI0_MOSI ==> PCH_SPI_H1_3V3_MOSI */
 	PAD_CFG_NF(GPP_B18, NONE, DEEP, NF1),
 
+	/* C6  : SM1CLK ==> EC_IN_RW_OD */
+	PAD_CFG_GPI_GPIO_DRIVER(GPP_C6, UP_20K, DEEP),
+
 	/* Ensure UART pins are in native mode for H1. */
 	/* C20 : UART2_RXD ==> PCHRX_SERVOTX_UART */
 	PAD_CFG_NF(GPP_C20, NONE, DEEP, NF1),
diff --git a/src/mainboard/google/poppy/variants/soraka/gpio.c b/src/mainboard/google/poppy/variants/soraka/gpio.c
index 9d5277327138..808ab3b504eb 100644
--- a/src/mainboard/google/poppy/variants/soraka/gpio.c
+++ b/src/mainboard/google/poppy/variants/soraka/gpio.c
@@ -342,6 +342,10 @@ static const struct pad_config gpio_table[] = {
 static const struct pad_config early_gpio_table[] = {
 	/* B8  : SRCCLKREQ3# ==> WLAN_PE_RST */
 	PAD_CFG_GPO(GPP_B8, 0, RSMRST),
+
+	/* C6  : SM1CLK ==> EC_IN_RW_OD */
+	PAD_CFG_GPI_GPIO_DRIVER(GPP_C6, UP_20K, DEEP),
+
 	/* C18 : I2C1_SDA ==> PCH_I2C1_H1_3V3_SDA */
 	PAD_CFG_NF(GPP_C18, NONE, DEEP, NF1),
 	/* C19 : I2C1_SCL ==> PCH_I2C1_H1_3V3_SCL */
diff --git a/src/mainboard/google/rambi/chromeos.c b/src/mainboard/google/rambi/chromeos.c
index 773a807f95ac..d76c5e4c5783 100644
--- a/src/mainboard/google/rambi/chromeos.c
+++ b/src/mainboard/google/rambi/chromeos.c
@@ -9,6 +9,9 @@
 /* The WP status pin lives on GPIO_SSUS_6 which is pad 36 in the SUS well. */
 #define WP_STATUS_PAD	36
 
+/* The EC_IN_RW lives on SCGPIO59 */
+#define EC_IN_RW_PAD	59
+
 void fill_lb_gpios(struct lb_gpios *gpios)
 {
 	struct lb_gpio chromeos_gpios[] = {
@@ -44,3 +47,9 @@ void mainboard_chromeos_acpi_generate(void)
 {
 	chromeos_acpi_gpio_generate(cros_gpios, ARRAY_SIZE(cros_gpios));
 }
+
+int get_ec_is_trusted(void)
+{
+	/* EC is trusted if not in RW. */
+	return !score_get_gpio(EC_IN_RW_PAD);
+}
diff --git a/src/mainboard/google/reef/chromeos.c b/src/mainboard/google/reef/chromeos.c
index d258678d7c4a..1d1c990d7349 100644
--- a/src/mainboard/google/reef/chromeos.c
+++ b/src/mainboard/google/reef/chromeos.c
@@ -35,3 +35,9 @@ void mainboard_chromeos_acpi_generate(void)
 	gpios = variant_cros_gpios(&num);
 	chromeos_acpi_gpio_generate(gpios, num);
 }
+
+int get_ec_is_trusted(void)
+{
+	/* EC is trusted if not in RW. */
+	return !gpio_get(GPIO_EC_IN_RW);
+}
diff --git a/src/mainboard/google/reef/variants/baseboard/gpio.c b/src/mainboard/google/reef/variants/baseboard/gpio.c
index 9bb3e45fe572..826345978978 100644
--- a/src/mainboard/google/reef/variants/baseboard/gpio.c
+++ b/src/mainboard/google/reef/variants/baseboard/gpio.c
@@ -368,6 +368,8 @@ static const struct pad_config early_gpio_table[] = {
 
 	/* WLAN_PE_RST - default to deasserted just in case FSP misbehaves. */
 	PAD_CFG_GPO(GPIO_122, 0, DEEP),		 /* SIO_SPI_2_RXD */
+
+	PAD_CFG_GPI(GPIO_41, NONE, DEEP),	 /* LPSS_UART0_CTS - EC_IN_RW */
 };
 
 const struct pad_config * __weak
diff --git a/src/mainboard/google/reef/variants/coral/gpio.c b/src/mainboard/google/reef/variants/coral/gpio.c
index de54929d4b9e..b60e031af8ee 100644
--- a/src/mainboard/google/reef/variants/coral/gpio.c
+++ b/src/mainboard/google/reef/variants/coral/gpio.c
@@ -369,6 +369,8 @@ static const struct pad_config early_gpio_table[] = {
 
 	/* WLAN_PE_RST - default to deasserted just in case FSP misbehaves. */
 	PAD_CFG_GPO(GPIO_122, 0, DEEP),		 /* SIO_SPI_2_RXD */
+
+	PAD_CFG_GPI(GPIO_41, NONE, DEEP),	 /* LPSS_UART0_CTS - EC_IN_RW */
 };
 
 const struct pad_config *variant_early_gpio_table(size_t *num)
diff --git a/src/mainboard/google/sarien/chromeos.c b/src/mainboard/google/sarien/chromeos.c
index 37fd817a687b..83374157fa9f 100644
--- a/src/mainboard/google/sarien/chromeos.c
+++ b/src/mainboard/google/sarien/chromeos.c
@@ -94,3 +94,10 @@ void mainboard_prepare_cr50_reset(void)
 	if (ENV_RAMSTAGE)
 		pmc_soc_set_afterg3_en(true);
 }
+
+int get_ec_is_trusted(void)
+{
+	/* Do not have a Chrome EC involved in entering recovery mode;
+	   Always return trusted. */
+	return 1;
+}
diff --git a/src/mainboard/google/slippy/chromeos.c b/src/mainboard/google/slippy/chromeos.c
index 0fa78c921fa1..634e5637e3dc 100644
--- a/src/mainboard/google/slippy/chromeos.c
+++ b/src/mainboard/google/slippy/chromeos.c
@@ -32,3 +32,9 @@ void mainboard_chromeos_acpi_generate(void)
 {
 	chromeos_acpi_gpio_generate(cros_gpios, ARRAY_SIZE(cros_gpios));
 }
+
+int get_ec_is_trusted(void)
+{
+	/* EC is trusted if not in RW. */
+	return !get_gpio(14);
+}
diff --git a/src/mainboard/google/smaug/chromeos.c b/src/mainboard/google/smaug/chromeos.c
index 13a69bc0ed29..d74df8267e9d 100644
--- a/src/mainboard/google/smaug/chromeos.c
+++ b/src/mainboard/google/smaug/chromeos.c
@@ -19,3 +19,9 @@ int get_write_protect_state(void)
 {
 	return !gpio_get(WRITE_PROTECT_L);
 }
+
+int get_ec_is_trusted(void)
+{
+	/* EC is trusted if not in RW. */
+	return !gpio_get(EC_IN_RW);
+}
diff --git a/src/mainboard/google/storm/chromeos.c b/src/mainboard/google/storm/chromeos.c
index 69f0fcca2be8..4ecc228385a6 100644
--- a/src/mainboard/google/storm/chromeos.c
+++ b/src/mainboard/google/storm/chromeos.c
@@ -128,3 +128,10 @@ int get_write_protect_state(void)
 {
 	return !read_gpio(WP_SW);
 }
+
+int get_ec_is_trusted(void)
+{
+	/* Do not have a Chrome EC involved in entering recovery mode;
+	   Always return trusted. */
+	return 1;
+}
diff --git a/src/mainboard/google/trogdor/chromeos.c b/src/mainboard/google/trogdor/chromeos.c
index 90de1e4ce0ed..11b38b513d6c 100644
--- a/src/mainboard/google/trogdor/chromeos.c
+++ b/src/mainboard/google/trogdor/chromeos.c
@@ -57,3 +57,9 @@ int tis_plat_irq_status(void)
 {
 	return gpio_irq_status(GPIO_H1_AP_INT);
 }
+
+int get_ec_is_trusted(void)
+{
+	/* EC is trusted if not in RW. This is active low. */
+	return !!gpio_get(GPIO_EC_IN_RW);
+}
diff --git a/src/mainboard/google/veyron/chromeos.c b/src/mainboard/google/veyron/chromeos.c
index cdea2cebe0a3..9374dc4d4a72 100644
--- a/src/mainboard/google/veyron/chromeos.c
+++ b/src/mainboard/google/veyron/chromeos.c
@@ -56,3 +56,9 @@ int get_write_protect_state(void)
 {
 	return !gpio_get(GPIO_WP);
 }
+
+int get_ec_is_trusted(void)
+{
+	/* EC is trusted if not in RW. */
+	return !gpio_get(GPIO_ECINRW);
+}
diff --git a/src/mainboard/google/veyron_mickey/chromeos.c b/src/mainboard/google/veyron_mickey/chromeos.c
index a3fe3f4eb971..c4cd6c64c3cb 100644
--- a/src/mainboard/google/veyron_mickey/chromeos.c
+++ b/src/mainboard/google/veyron_mickey/chromeos.c
@@ -34,3 +34,10 @@ int get_write_protect_state(void)
 {
 	return !gpio_get(GPIO_WP);
 }
+
+int get_ec_is_trusted(void)
+{
+	/* Do not have a Chrome EC involved in entering recovery mode;
+	   Always return trusted. */
+	return 1;
+}
diff --git a/src/mainboard/google/veyron_rialto/chromeos.c b/src/mainboard/google/veyron_rialto/chromeos.c
index 7dcf7dc778d5..f1eb1c3d270a 100644
--- a/src/mainboard/google/veyron_rialto/chromeos.c
+++ b/src/mainboard/google/veyron_rialto/chromeos.c
@@ -43,3 +43,10 @@ int get_write_protect_state(void)
 {
 	return !gpio_get(GPIO_WP);
 }
+
+int get_ec_is_trusted(void)
+{
+	/* Do not have a Chrome EC involved in entering recovery mode;
+	   Always return trusted. */
+	return 1;
+}
diff --git a/src/mainboard/google/volteer/chromeos.c b/src/mainboard/google/volteer/chromeos.c
index 20469d62977a..9b8e2f5296a9 100644
--- a/src/mainboard/google/volteer/chromeos.c
+++ b/src/mainboard/google/volteer/chromeos.c
@@ -34,3 +34,9 @@ void mainboard_chromeos_acpi_generate(void)
 	gpios = variant_cros_gpios(&num);
 	chromeos_acpi_gpio_generate(gpios, num);
 }
+
+int get_ec_is_trusted(void)
+{
+	/* EC is trusted if not in RW. */
+	return !gpio_get(GPIO_EC_IN_RW);
+}
diff --git a/src/mainboard/google/volteer/variants/baseboard/gpio.c b/src/mainboard/google/volteer/variants/baseboard/gpio.c
index ac8c5c27066c..05c757ce978e 100644
--- a/src/mainboard/google/volteer/variants/baseboard/gpio.c
+++ b/src/mainboard/google/volteer/variants/baseboard/gpio.c
@@ -432,6 +432,9 @@ static const struct pad_config early_gpio_table[] = {
 
 	/* F11 : THC1_SPI2_CLK ==> EN_PP3300_WWAN */
 	PAD_CFG_GPO(GPP_F11, 1, DEEP),
+
+	/* A9  : I2S2_TXD ==> EC_IN_RW_OD */
+	PAD_CFG_GPI(GPP_A9, NONE, DEEP),
 };
 
 const struct pad_config *__weak variant_base_gpio_table(size_t *num)
diff --git a/src/mainboard/google/volteer/variants/collis/gpio.c b/src/mainboard/google/volteer/variants/collis/gpio.c
index 03bd91ef4836..86919b90a2b3 100644
--- a/src/mainboard/google/volteer/variants/collis/gpio.c
+++ b/src/mainboard/google/volteer/variants/collis/gpio.c
@@ -204,6 +204,9 @@ static const struct pad_config early_gpio_table[] = {
 
 	/* E12 : SPI1_MISO_IO1 ==> PEN_ALERT_ODL */
 	PAD_CFG_GPI(GPP_E12, NONE, DEEP),
+
+	/* F17 : WWAN_RF_DISABLE_ODL ==> EC_IN_RW_OD */
+	PAD_CFG_GPI(GPP_F17, NONE, DEEP),
 };
 
 const struct pad_config *variant_early_gpio_table(size_t *num)
diff --git a/src/mainboard/google/volteer/variants/copano/gpio.c b/src/mainboard/google/volteer/variants/copano/gpio.c
index bec58e53e207..933aebb938b8 100644
--- a/src/mainboard/google/volteer/variants/copano/gpio.c
+++ b/src/mainboard/google/volteer/variants/copano/gpio.c
@@ -220,6 +220,9 @@ static const struct pad_config early_gpio_table[] = {
 
 	/* E12 : SPI1_MISO_IO1 ==> PEN_ALERT_ODL */
 	PAD_CFG_GPI(GPP_E12, NONE, DEEP),
+
+	/* F17 : WWAN_RF_DISABLE_ODL ==> EC_IN_RW_OD */
+	PAD_CFG_GPI(GPP_F17, NONE, DEEP),
 };
 
 const struct pad_config *variant_early_gpio_table(size_t *num)
diff --git a/src/mainboard/google/volteer/variants/halvor/gpio.c b/src/mainboard/google/volteer/variants/halvor/gpio.c
index 7d6725a95beb..994df0445264 100644
--- a/src/mainboard/google/volteer/variants/halvor/gpio.c
+++ b/src/mainboard/google/volteer/variants/halvor/gpio.c
@@ -233,6 +233,9 @@ static const struct pad_config early_gpio_table[] = {
 	/* D16 : ISH_UART0_CTS# ==> EN_PP3300_SD */
 	PAD_CFG_GPO(GPP_D16, 1, DEEP),
 
+	/* F17 : WWAN_RF_DISABLE_ODL ==> EC_IN_RW_OD */
+	PAD_CFG_GPI(GPP_F17, NONE, DEEP),
+
 	/* H11 : SRCCLKREQ5# ==> WLAN_PERST_L */
 	PAD_CFG_GPO(GPP_H11, 1, DEEP),
 };
diff --git a/src/mainboard/google/volteer/variants/terrador/gpio.c b/src/mainboard/google/volteer/variants/terrador/gpio.c
index 69760c13ffb8..0febca898f6d 100644
--- a/src/mainboard/google/volteer/variants/terrador/gpio.c
+++ b/src/mainboard/google/volteer/variants/terrador/gpio.c
@@ -221,6 +221,9 @@ static const struct pad_config early_gpio_table[] = {
 
 	/* E12 : SPI1_MISO_IO1 ==> PEN_ALERT_ODL */
 	PAD_CFG_GPI(GPP_E12, NONE, DEEP),
+
+	/* F17 : WWAN_RF_DISABLE_ODL ==> EC_IN_RW_OD */
+	PAD_CFG_GPI(GPP_F17, NONE, DEEP),
 };
 
 const struct pad_config *variant_early_gpio_table(size_t *num)
diff --git a/src/mainboard/google/volteer/variants/todor/gpio.c b/src/mainboard/google/volteer/variants/todor/gpio.c
index 5611ccabae12..e69902732064 100644
--- a/src/mainboard/google/volteer/variants/todor/gpio.c
+++ b/src/mainboard/google/volteer/variants/todor/gpio.c
@@ -231,6 +231,9 @@ static const struct pad_config early_gpio_table[] = {
 
 	/* E12 : SPI1_MISO_IO1 ==> PEN_ALERT_ODL */
 	PAD_CFG_GPI(GPP_E12, NONE, DEEP),
+
+	/* F17 : WWAN_RF_DISABLE_ODL ==> EC_IN_RW_OD */
+	PAD_CFG_GPI(GPP_F17, NONE, DEEP),
 };
 
 const struct pad_config *variant_early_gpio_table(size_t *num)
diff --git a/src/mainboard/google/volteer/variants/voema/gpio.c b/src/mainboard/google/volteer/variants/voema/gpio.c
index 70b7f5234078..4f3f799cffc0 100644
--- a/src/mainboard/google/volteer/variants/voema/gpio.c
+++ b/src/mainboard/google/volteer/variants/voema/gpio.c
@@ -219,6 +219,9 @@ static const struct pad_config early_gpio_table[] = {
 
 	/* E12 : SPI1_MISO_IO1 ==> PEN_ALERT_ODL */
 	PAD_CFG_GPI(GPP_E12, NONE, DEEP),
+
+	/* F17 : WWAN_RF_DISABLE_ODL ==> EC_IN_RW_OD */
+	PAD_CFG_GPI(GPP_F17, NONE, DEEP),
 };
 
 const struct pad_config *variant_early_gpio_table(size_t *num)
diff --git a/src/mainboard/google/zork/Makefile.inc b/src/mainboard/google/zork/Makefile.inc
index ccc163c4dd11..a260b0fd2120 100644
--- a/src/mainboard/google/zork/Makefile.inc
+++ b/src/mainboard/google/zork/Makefile.inc
@@ -10,6 +10,7 @@ ramstage-y += chromeos.c
 ramstage-y += ec.c
 ramstage-y += sku_id.c
 
+verstage-y += chromeos.c
 verstage-y += verstage.c
 
 subdirs-y += variants/baseboard
diff --git a/src/mainboard/google/zork/chromeos.c b/src/mainboard/google/zork/chromeos.c
index 35c002d45ce8..d64919316b37 100644
--- a/src/mainboard/google/zork/chromeos.c
+++ b/src/mainboard/google/zork/chromeos.c
@@ -33,3 +33,9 @@ void mainboard_chromeos_acpi_generate(void)
 {
 	chromeos_acpi_gpio_generate(cros_gpios, ARRAY_SIZE(cros_gpios));
 }
+
+int get_ec_is_trusted(void)
+{
+	/* EC is trusted if not in RW. */
+	return !gpio_get(GPIO_EC_IN_RW);
+}
diff --git a/src/mainboard/google/zork/variants/baseboard/Makefile.inc b/src/mainboard/google/zork/variants/baseboard/Makefile.inc
index 2764a89b08fb..437ba0b52cd5 100644
--- a/src/mainboard/google/zork/variants/baseboard/Makefile.inc
+++ b/src/mainboard/google/zork/variants/baseboard/Makefile.inc
@@ -1,23 +1,19 @@
 # SPDX-License-Identifier: GPL-2.0-or-later
 
-bootblock-y += gpio_baseboard_common.c
 bootblock-y += helpers.c
 bootblock-$(CONFIG_BOARD_GOOGLE_BASEBOARD_TREMBYLE) += gpio_baseboard_trembyle.c
 bootblock-$(CONFIG_BOARD_GOOGLE_BASEBOARD_DALBOZ) += gpio_baseboard_dalboz.c
 
-verstage-y += gpio_baseboard_common.c
 verstage-y += helpers.c
 verstage-$(CONFIG_BOARD_GOOGLE_BASEBOARD_TREMBYLE) += gpio_baseboard_trembyle.c
 verstage-$(CONFIG_BOARD_GOOGLE_BASEBOARD_DALBOZ) += gpio_baseboard_dalboz.c
 verstage-y += tpm_tis.c
 
-romstage-y += gpio_baseboard_common.c
 romstage-y += helpers.c
 romstage-$(CONFIG_BOARD_GOOGLE_BASEBOARD_TREMBYLE) += gpio_baseboard_trembyle.c
 romstage-$(CONFIG_BOARD_GOOGLE_BASEBOARD_DALBOZ) += gpio_baseboard_dalboz.c
 romstage-y += tpm_tis.c
 
-ramstage-y += gpio_baseboard_common.c
 ramstage-$(CONFIG_BOARD_GOOGLE_BASEBOARD_TREMBYLE) += gpio_baseboard_trembyle.c
 ramstage-$(CONFIG_BOARD_GOOGLE_BASEBOARD_TREMBYLE) += fsps_baseboard_trembyle.c
 ramstage-$(CONFIG_BOARD_GOOGLE_BASEBOARD_DALBOZ) += gpio_baseboard_dalboz.c
diff --git a/src/mainboard/google/zork/variants/baseboard/gpio_baseboard_common.c b/src/mainboard/google/zork/variants/baseboard/gpio_baseboard_common.c
deleted file mode 100644
index 948ce8f9d40f..000000000000
--- a/src/mainboard/google/zork/variants/baseboard/gpio_baseboard_common.c
+++ /dev/null
@@ -1,31 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0-or-later */
-
-#include <baseboard/variants.h>
-#include <soc/gpio.h>
-#include <stdlib.h>
-#include <variant/gpio.h>
-
-static const struct soc_amd_gpio early_gpio_table[] = {
-	/* H1_FCH_INT_ODL */
-	PAD_INT(GPIO_3, PULL_NONE, EDGE_LOW, STATUS),
-	/* I2C3_SCL - H1 */
-	PAD_NF(GPIO_19, I2C3_SCL, PULL_NONE),
-	/* I2C3_SDA - H1 */
-	PAD_NF(GPIO_20, I2C3_SDA, PULL_NONE),
-	/* PCIE_RST0_L - Fixed timings */
-	PAD_NF(GPIO_26, PCIE_RST_L, PULL_NONE),
-	/* FCH_ESPI_EC_CS_L */
-	PAD_NF(GPIO_30, ESPI_CS_L, PULL_NONE),
-	/* ESPI_ALERT_L */
-	PAD_NF(GPIO_108, ESPI_ALERT_L, PULL_NONE),
-	/* UART0_RXD - DEBUG */
-	PAD_NF(GPIO_136, UART0_RXD, PULL_NONE),
-	/* UART0_TXD - DEBUG */
-	PAD_NF(GPIO_138, UART0_TXD, PULL_NONE),
-};
-
-const __weak struct soc_amd_gpio *variant_early_gpio_table(size_t *size)
-{
-	*size = ARRAY_SIZE(early_gpio_table);
-	return early_gpio_table;
-}
diff --git a/src/mainboard/google/zork/variants/baseboard/gpio_baseboard_dalboz.c b/src/mainboard/google/zork/variants/baseboard/gpio_baseboard_dalboz.c
index 6f8a4166573f..5d3e21ffb2fc 100644
--- a/src/mainboard/google/zork/variants/baseboard/gpio_baseboard_dalboz.c
+++ b/src/mainboard/google/zork/variants/baseboard/gpio_baseboard_dalboz.c
@@ -310,3 +310,30 @@ const __weak struct soc_amd_gpio *variant_sleep_gpio_table(size_t *size, int slp
 	*size = ARRAY_SIZE(gpio_sleep_table);
 	return gpio_sleep_table;
 }
+
+static const struct soc_amd_gpio early_gpio_table[] = {
+	/* H1_FCH_INT_ODL */
+	PAD_INT(GPIO_3, PULL_NONE, EDGE_LOW, STATUS),
+	/* I2C3_SCL - H1 */
+	PAD_NF(GPIO_19, I2C3_SCL, PULL_NONE),
+	/* I2C3_SDA - H1 */
+	PAD_NF(GPIO_20, I2C3_SDA, PULL_NONE),
+	/* PCIE_RST0_L - Fixed timings */
+	PAD_NF(GPIO_26, PCIE_RST_L, PULL_NONE),
+	/* FCH_ESPI_EC_CS_L */
+	PAD_NF(GPIO_30, ESPI_CS_L, PULL_NONE),
+	/* ESPI_ALERT_L */
+	PAD_NF(GPIO_108, ESPI_ALERT_L, PULL_NONE),
+	/* UART0_RXD - DEBUG */
+	PAD_NF(GPIO_136, UART0_RXD, PULL_NONE),
+	/* UART0_TXD - DEBUG */
+	PAD_NF(GPIO_138, UART0_TXD, PULL_NONE),
+	/* EC_IN_RW_OD */
+	PAD_GPI(GPIO_11, PULL_NONE),
+};
+
+const struct soc_amd_gpio *variant_early_gpio_table(size_t *size)
+{
+	*size = ARRAY_SIZE(early_gpio_table);
+	return early_gpio_table;
+}
diff --git a/src/mainboard/google/zork/variants/baseboard/gpio_baseboard_trembyle.c b/src/mainboard/google/zork/variants/baseboard/gpio_baseboard_trembyle.c
index 62935a66a9d6..415c426f157d 100644
--- a/src/mainboard/google/zork/variants/baseboard/gpio_baseboard_trembyle.c
+++ b/src/mainboard/google/zork/variants/baseboard/gpio_baseboard_trembyle.c
@@ -359,3 +359,30 @@ const __weak struct soc_amd_gpio *variant_sleep_gpio_table(size_t *size, int slp
 	*size = ARRAY_SIZE(gpio_sleep_table);
 	return gpio_sleep_table;
 }
+
+static const struct soc_amd_gpio early_gpio_table[] = {
+	/* H1_FCH_INT_ODL */
+	PAD_INT(GPIO_3, PULL_NONE, EDGE_LOW, STATUS),
+	/* I2C3_SCL - H1 */
+	PAD_NF(GPIO_19, I2C3_SCL, PULL_NONE),
+	/* I2C3_SDA - H1 */
+	PAD_NF(GPIO_20, I2C3_SDA, PULL_NONE),
+	/* PCIE_RST0_L - Fixed timings */
+	PAD_NF(GPIO_26, PCIE_RST_L, PULL_NONE),
+	/* FCH_ESPI_EC_CS_L */
+	PAD_NF(GPIO_30, ESPI_CS_L, PULL_NONE),
+	/* ESPI_ALERT_L */
+	PAD_NF(GPIO_108, ESPI_ALERT_L, PULL_NONE),
+	/* UART0_RXD - DEBUG */
+	PAD_NF(GPIO_136, UART0_RXD, PULL_NONE),
+	/* UART0_TXD - DEBUG */
+	PAD_NF(GPIO_138, UART0_TXD, PULL_NONE),
+	/* EC_IN_RW_OD */
+	PAD_GPI(GPIO_130, PULL_NONE),
+};
+
+const struct soc_amd_gpio *variant_early_gpio_table(size_t *size)
+{
+	*size = ARRAY_SIZE(early_gpio_table);
+	return early_gpio_table;
+}
diff --git a/src/mainboard/intel/adlrvp/chromeos.c b/src/mainboard/intel/adlrvp/chromeos.c
index 5fe89af99c20..fce365d37f7a 100644
--- a/src/mainboard/intel/adlrvp/chromeos.c
+++ b/src/mainboard/intel/adlrvp/chromeos.c
@@ -49,3 +49,11 @@ void mainboard_chromeos_acpi_generate(void)
 	gpios = variant_cros_gpios(&num);
 	chromeos_acpi_gpio_generate(gpios, num);
 }
+
+#if (CONFIG(BOARD_INTEL_ADLRVP_P_EXT_EC) || CONFIG(BOARD_INTEL_ADLRVP_M_EXT_EC))
+int get_ec_is_trusted(void)
+{
+	/* EC is trusted if not in RW. */
+	return !gpio_get(GPIO_EC_IN_RW);
+}
+#endif
diff --git a/src/mainboard/intel/glkrvp/chromeos.c b/src/mainboard/intel/glkrvp/chromeos.c
index dfdb66da84f8..7a14c86bd269 100644
--- a/src/mainboard/intel/glkrvp/chromeos.c
+++ b/src/mainboard/intel/glkrvp/chromeos.c
@@ -39,3 +39,10 @@ int __weak get_lid_switch(void)
 {
 	return -1;
 }
+
+int get_ec_is_trusted(void)
+{
+	/* Do not have a Chrome EC involved in entering recovery mode;
+	   Always return trusted. */
+	return 1;
+}
diff --git a/src/mainboard/intel/kblrvp/chromeos.c b/src/mainboard/intel/kblrvp/chromeos.c
index 902cb194fdae..afc27cd6d5df 100644
--- a/src/mainboard/intel/kblrvp/chromeos.c
+++ b/src/mainboard/intel/kblrvp/chromeos.c
@@ -64,3 +64,10 @@ void mainboard_chromeos_acpi_generate(void)
 {
 	chromeos_acpi_gpio_generate(cros_gpios, ARRAY_SIZE(cros_gpios));
 }
+
+int get_ec_is_trusted(void)
+{
+	/* Do not have a Chrome EC involved in entering recovery mode;
+	   Always return trusted. */
+	return 1;
+}
diff --git a/src/mainboard/intel/kunimitsu/chromeos.c b/src/mainboard/intel/kunimitsu/chromeos.c
index 09e9b7e44f0a..87a0e01b4185 100644
--- a/src/mainboard/intel/kunimitsu/chromeos.c
+++ b/src/mainboard/intel/kunimitsu/chromeos.c
@@ -35,3 +35,9 @@ void mainboard_chromeos_acpi_generate(void)
 {
 	chromeos_acpi_gpio_generate(cros_gpios, ARRAY_SIZE(cros_gpios));
 }
+
+int get_ec_is_trusted(void)
+{
+	/* EC is trusted if not in RW. */
+	return !gpio_get(GPIO_EC_IN_RW);
+}
diff --git a/src/mainboard/intel/kunimitsu/gpio.h b/src/mainboard/intel/kunimitsu/gpio.h
index 2cd019613790..439bd8992ba3 100644
--- a/src/mainboard/intel/kunimitsu/gpio.h
+++ b/src/mainboard/intel/kunimitsu/gpio.h
@@ -222,6 +222,7 @@ static const struct pad_config early_gpio_table[] = {
 /* SRCCLKREQ2# */	PAD_CFG_NF(GPP_B7, NONE, DEEP, NF1), /* KEPLER */
 /* SPI_WP_STATUS */	PAD_CFG_GPI_GPIO_DRIVER(GPP_C23, UP_20K, DEEP),
 /* UART0_CTS# */	PAD_CFG_GPO(GPP_C11, 0, DEEP), /* EN_PP3300_KEPLER */
+/* EC_IN_RW */		PAD_CFG_GPI_GPIO_DRIVER(GPP_C6, NONE, DEEP),
 };
 
 #endif
diff --git a/src/mainboard/intel/shadowmountain/chromeos.c b/src/mainboard/intel/shadowmountain/chromeos.c
index e71314ffe07e..085875443690 100644
--- a/src/mainboard/intel/shadowmountain/chromeos.c
+++ b/src/mainboard/intel/shadowmountain/chromeos.c
@@ -34,3 +34,9 @@ void mainboard_chromeos_acpi_generate(void)
 	gpios = variant_cros_gpios(&num);
 	chromeos_acpi_gpio_generate(gpios, num);
 }
+
+int get_ec_is_trusted(void)
+{
+	/* EC is trusted if not in RW. */
+	return !gpio_get(GPIO_EC_IN_RW);
+}
diff --git a/src/mainboard/intel/shadowmountain/variants/baseboard/early_gpio.c b/src/mainboard/intel/shadowmountain/variants/baseboard/early_gpio.c
index 80a42646fcab..6a74468c2fef 100644
--- a/src/mainboard/intel/shadowmountain/variants/baseboard/early_gpio.c
+++ b/src/mainboard/intel/shadowmountain/variants/baseboard/early_gpio.c
@@ -13,6 +13,8 @@ static const struct pad_config early_gpio_table[] = {
 	PAD_CFG_NF(GPP_H11, NONE, DEEP, NF2),
 	/* A7 : MEM_STRAP_0 */
 	PAD_CFG_GPI(GPP_A7, NONE, DEEP),
+	/* A8 : EC_IN_RW_OD */
+	PAD_CFG_GPI(GPP_A8, NONE, DEEP),
 	/* A17 : MEM_CH_SEL */
 	PAD_CFG_GPI(GPP_A17, NONE, DEEP),
 	/* A19 : MEM_STRAP_2 */
diff --git a/src/mainboard/intel/tglrvp/chromeos.c b/src/mainboard/intel/tglrvp/chromeos.c
index 4eeb679ac935..dd6c6667941a 100644
--- a/src/mainboard/intel/tglrvp/chromeos.c
+++ b/src/mainboard/intel/tglrvp/chromeos.c
@@ -47,3 +47,10 @@ void mainboard_chromeos_acpi_generate(void)
 	gpios = variant_cros_gpios(&num);
 	chromeos_acpi_gpio_generate(gpios, num);
 }
+
+int get_ec_is_trusted(void)
+{
+	/* Do not have a Chrome EC involved in entering recovery mode;
+	   Always return trusted. */
+	return 1;
+}
diff --git a/src/security/vboot/bootmode.c b/src/security/vboot/bootmode.c
index 6c051093ea9c..3c50e4ef83d4 100644
--- a/src/security/vboot/bootmode.c
+++ b/src/security/vboot/bootmode.c
@@ -57,6 +57,16 @@ int __weak get_recovery_mode_retrain_switch(void)
 	return 0;
 }
 
+int __weak get_ec_is_trusted(void)
+{
+	/*
+	 * If board doesn't override this, by default we always assume EC is in
+	 * RW and untrusted. However, newer platforms are supposed to use cr50
+	 * BOOT_MODE to report this and won't need to override this anymore.
+	 */
+	return 0;
+}
+
 #if CONFIG(VBOOT_NO_BOARD_SUPPORT)
 /**
  * TODO: Create flash protection interface which implements get_write_protect_state.
diff --git a/src/security/vboot/vboot_logic.c b/src/security/vboot/vboot_logic.c
index 2973934b9903..91d42b2c7f8d 100644
--- a/src/security/vboot/vboot_logic.c
+++ b/src/security/vboot/vboot_logic.c
@@ -306,6 +306,9 @@ void verstage_main(void)
 	if (CONFIG(TPM_CR50))
 		check_boot_mode(ctx);
 
+	if (get_ec_is_trusted())
+		ctx->flags |= VB2_CONTEXT_EC_TRUSTED;
+
 	/* Do early init (set up secdata and NVRAM, load GBB) */
 	printk(BIOS_INFO, "Phase 1\n");
 	rv = vb2api_fw_phase1(ctx);
diff --git a/src/soc/intel/alderlake/Makefile.inc b/src/soc/intel/alderlake/Makefile.inc
index d857e8b59b11..00d857c9f6d8 100644
--- a/src/soc/intel/alderlake/Makefile.inc
+++ b/src/soc/intel/alderlake/Makefile.inc
@@ -44,6 +44,8 @@ ramstage-y += vr_config.c
 ramstage-y += xhci.c
 ramstage-$(CONFIG_SOC_INTEL_CRASHLOG) += crashlog.c
 
+verstage-y += gpio.c
+
 smm-y += elog.c
 smm-y += gpio.c
 smm-y += p2sb.c
diff --git a/src/soc/intel/apollolake/Makefile.inc b/src/soc/intel/apollolake/Makefile.inc
index a557d1ea401d..133509063a2b 100644
--- a/src/soc/intel/apollolake/Makefile.inc
+++ b/src/soc/intel/apollolake/Makefile.inc
@@ -89,11 +89,13 @@ bootblock-y += gpio_glk.c
 romstage-y += gpio_glk.c
 smm-y += gpio_glk.c
 ramstage-y += gpio_glk.c
+verstage-y += gpio_glk.c
 else
 bootblock-y += gpio_apl.c
 romstage-y += gpio_apl.c
 smm-y += gpio_apl.c
 ramstage-y += gpio_apl.c
+verstage-y += gpio_apl.c
 endif
 
 CPPFLAGS_common += -I$(src)/soc/intel/apollolake/include
diff --git a/src/soc/intel/skylake/Makefile.inc b/src/soc/intel/skylake/Makefile.inc
index ea96caada7af..369f324243c8 100644
--- a/src/soc/intel/skylake/Makefile.inc
+++ b/src/soc/intel/skylake/Makefile.inc
@@ -18,6 +18,7 @@ bootblock-y += spi.c
 bootblock-y += lpc.c
 bootblock-y += uart.c
 
+verstage-y += gpio.c
 verstage-y += gspi.c
 verstage-y += pmutil.c
 verstage-y += i2c.c