security/tpm: Add option to init TPM in bootblock
When using a hardware assisted root of trust measurement, like Intel
TXT/CBnT, the TPM init needs to happen inside the bootblock to form a
proper chain of trust.
Change-Id: Ifacba5d9ab19b47968b4f2ed5731ded4aac55022
Signed-off-by: Arthur Heymans <arthur@aheymans.xyz>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/51923
Reviewed-by: Christian Walter <christian.walter@9elements.com>
Reviewed-by: Angel Pons <th3fanbus@gmail.com>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
diff --git a/src/security/tpm/tspi/tspi.c b/src/security/tpm/tspi/tspi.c
index 6ef0138..7a8e2be 100644
--- a/src/security/tpm/tspi/tspi.c
+++ b/src/security/tpm/tspi/tspi.c
@@ -1,5 +1,6 @@
/* SPDX-License-Identifier: GPL-2.0-only */
+#include <rules.h>
#include <console/cbmem_console.h>
#include <console/console.h>
#include <security/tpm/tspi/crtm.h>
@@ -104,6 +105,9 @@
return vboot_logic_executed();
}
+ if (CONFIG(TPM_MEASURED_BOOT_INIT_BOOTBLOCK))
+ return ENV_BOOTBLOCK ? tpm_is_setup : 1;
+
if (ENV_RAMSTAGE)
return tpm_is_setup;
@@ -180,7 +184,7 @@
#if CONFIG(TPM1)
result = tpm1_invoke_state_machine();
#endif
- if (CONFIG(TPM_MEASURED_BOOT))
+ if (CONFIG(TPM_MEASURED_BOOT) && !CONFIG(TPM_MEASURED_BOOT_INIT_BOOTBLOCK))
result = tspi_measure_cache_to_pcr();
tpm_is_setup = 1;