sravan/system76-coreboot
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

security/tpm: Add option to init TPM in bootblock

Browse Source 
When using a hardware assisted root of trust measurement, like Intel
TXT/CBnT, the TPM init needs to happen inside the bootblock to form a
proper chain of trust.

Change-Id: Ifacba5d9ab19b47968b4f2ed5731ded4aac55022
Signed-off-by: Arthur Heymans <arthur@aheymans.xyz>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/51923
Reviewed-by: Christian Walter <christian.walter@9elements.com>
Reviewed-by: Angel Pons <th3fanbus@gmail.com>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
This commit is contained in:
Arthur Heymans
2021-03-29 14:23:53 +02:00
parent 59a621abc7
commit 6f8e9443aa
6 changed files with 24 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
src/drivers/pc80/tpm/Makefile.inc
View File

@@ -1,3 +1,4 @@
bootblock-$(CONFIG_MAINBOARD_HAS_LPC_TPM) += tis.c
verstage-$(CONFIG_MAINBOARD_HAS_LPC_TPM) += tis.c
romstage-$(CONFIG_MAINBOARD_HAS_LPC_TPM) += tis.c
ramstage-$(CONFIG_MAINBOARD_HAS_LPC_TPM) += tis.c

3
src/drivers/tpm/Kconfig
View File

@@ -1,7 +1,8 @@
config TPM_INIT_RAMSTAGE
bool
default y if TPM1 || TPM2
depends on !VBOOT && !VENDORCODE_ELTAN_VBOOT && !VENDORCODE_ELTAN_MBOOT
depends on !VBOOT && !VENDORCODE_ELTAN_VBOOT && !VENDORCODE_ELTAN_MBOOT \
&& !TPM_MEASURED_BOOT_INIT_BOOTBLOCK
help
This driver automatically initializes the TPM if vboot is not used.
The TPM driver init is done during the ramstage chip init phase.