models: Enable coreboot measured boot

All the laptops contain a TPM 2.0 chip. Enable the measured boot
security feature by default.

Link: https://doc.coreboot.org/security/vboot/measured_boot.html
Signed-off-by: Tim Crawford <tcrawford@system76.com>

CHANGELOG.md

@@ -7,6 +7,7 @@ date followed by an underscore and a short git revision.
 ## unreleased
 
 - Added support to enable/disable Intel ME via the CMOS option `me_state`
+- Enabled coreboot measured boot
 - Updated Rust toolchain to nightly-2021-06-15
 - Updated coreboot to 4.15
 - Updated EDK2 to edk2-stabke202108

models/addw1/coreboot.config

@@ -15,6 +15,7 @@ CONFIG_POST_IO=n
 CONFIG_RUN_FSP_GOP=y
 CONFIG_SMMSTORE=y
 CONFIG_SMMSTORE_V2=y
+CONFIG_TPM_MEASURED_BOOT=y
 CONFIG_USE_OPTION_TABLE=y
 CONFIG_VALIDATE_INTEL_DESCRIPTOR=y
 #CONFIG_CONSOLE_SYSTEM76_EC=y

models/addw2/coreboot.config

@@ -15,6 +15,7 @@ CONFIG_POST_IO=n
 CONFIG_RUN_FSP_GOP=y
 CONFIG_SMMSTORE=y
 CONFIG_SMMSTORE_V2=y
+CONFIG_TPM_MEASURED_BOOT=y
 CONFIG_USE_OPTION_TABLE=y
 CONFIG_VALIDATE_INTEL_DESCRIPTOR=y
 #CONFIG_CONSOLE_SYSTEM76_EC=y

models/bonw14/coreboot.config

@@ -15,6 +15,7 @@ CONFIG_PCIEXP_HOTPLUG_PREFETCH_MEM=0x20000000
 CONFIG_POST_IO=n
 CONFIG_SMMSTORE=y
 CONFIG_SMMSTORE_V2=y
+CONFIG_TPM_MEASURED_BOOT=y
 CONFIG_USE_OPTION_TABLE=y
 CONFIG_VALIDATE_INTEL_DESCRIPTOR=y
 #CONFIG_CONSOLE_SYSTEM76_EC=y

models/darp5/coreboot.config

@@ -15,6 +15,7 @@ CONFIG_POST_IO=n
 CONFIG_RUN_FSP_GOP=y
 CONFIG_SMMSTORE=y
 CONFIG_SMMSTORE_V2=y
+CONFIG_TPM_MEASURED_BOOT=y
 CONFIG_USE_OPTION_TABLE=y
 CONFIG_VALIDATE_INTEL_DESCRIPTOR=y
 #CONFIG_CONSOLE_SYSTEM76_EC=y

models/darp6/coreboot.config

@@ -15,6 +15,7 @@ CONFIG_POST_IO=n
 CONFIG_RUN_FSP_GOP=y
 CONFIG_SMMSTORE=y
 CONFIG_SMMSTORE_V2=y
+CONFIG_TPM_MEASURED_BOOT=y
 CONFIG_USE_OPTION_TABLE=y
 CONFIG_VALIDATE_INTEL_DESCRIPTOR=y
 #CONFIG_CONSOLE_SYSTEM76_EC=y

models/darp7/coreboot.config

@@ -16,6 +16,7 @@ CONFIG_POST_IO=n
 CONFIG_RUN_FSP_GOP=y
 CONFIG_SMMSTORE=y
 CONFIG_SMMSTORE_V2=y
+CONFIG_TPM_MEASURED_BOOT=y
 CONFIG_USE_OPTION_TABLE=y
 CONFIG_VALIDATE_INTEL_DESCRIPTOR=y
 #CONFIG_CONSOLE_SYSTEM76_EC=y

models/galp2/coreboot.config

@@ -14,6 +14,7 @@ CONFIG_POST_IO=n
 CONFIG_RUN_FSP_GOP=y
 CONFIG_SMMSTORE=y
 CONFIG_SMMSTORE_V2=y
+CONFIG_TPM_MEASURED_BOOT=y
 CONFIG_USE_ME_CLEANER=y
 CONFIG_USE_OPTION_TABLE=y
 CONFIG_VALIDATE_INTEL_DESCRIPTOR=y

models/galp3-b/coreboot.config

@@ -14,6 +14,7 @@ CONFIG_POST_IO=n
 CONFIG_RUN_FSP_GOP=y
 CONFIG_SMMSTORE=y
 CONFIG_SMMSTORE_V2=y
+CONFIG_TPM_MEASURED_BOOT=y
 CONFIG_USE_ME_CLEANER=y
 CONFIG_USE_OPTION_TABLE=y
 CONFIG_VALIDATE_INTEL_DESCRIPTOR=y

models/galp3-c/coreboot.config

@@ -15,6 +15,7 @@ CONFIG_POST_IO=n
 CONFIG_RUN_FSP_GOP=y
 CONFIG_SMMSTORE=y
 CONFIG_SMMSTORE_V2=y
+CONFIG_TPM_MEASURED_BOOT=y
 CONFIG_USE_OPTION_TABLE=y
 CONFIG_VALIDATE_INTEL_DESCRIPTOR=y
 #CONFIG_CONSOLE_SYSTEM76_EC=y

models/galp3/coreboot.config

@@ -14,6 +14,7 @@ CONFIG_POST_IO=n
 CONFIG_RUN_FSP_GOP=y
 CONFIG_SMMSTORE=y
 CONFIG_SMMSTORE_V2=y
+CONFIG_TPM_MEASURED_BOOT=y
 CONFIG_USE_ME_CLEANER=y
 CONFIG_USE_OPTION_TABLE=y
 CONFIG_VALIDATE_INTEL_DESCRIPTOR=y

models/galp4/coreboot.config

@@ -15,6 +15,7 @@ CONFIG_POST_IO=n
 CONFIG_RUN_FSP_GOP=y
 CONFIG_SMMSTORE=y
 CONFIG_SMMSTORE_V2=y
+CONFIG_TPM_MEASURED_BOOT=y
 CONFIG_USE_OPTION_TABLE=y
 CONFIG_VALIDATE_INTEL_DESCRIPTOR=y
 #CONFIG_CONSOLE_SYSTEM76_EC=y

models/galp5/coreboot.config

@@ -16,6 +16,7 @@ CONFIG_POST_IO=n
 CONFIG_RUN_FSP_GOP=y
 CONFIG_SMMSTORE=y
 CONFIG_SMMSTORE_V2=y
+CONFIG_TPM_MEASURED_BOOT=y
 CONFIG_USE_OPTION_TABLE=y
 CONFIG_VALIDATE_INTEL_DESCRIPTOR=y
 #CONFIG_CONSOLE_SYSTEM76_EC=y

models/gaze14_1650/coreboot.config

@@ -12,6 +12,7 @@ CONFIG_PAYLOAD_FILE="$(FIRMWARE_OPEN_UEFIPAYLOAD)"
 CONFIG_RUN_FSP_GOP=y
 CONFIG_SMMSTORE=y
 CONFIG_SMMSTORE_V2=y
+CONFIG_TPM_MEASURED_BOOT=y
 CONFIG_USE_OPTION_TABLE=y
 CONFIG_VALIDATE_INTEL_DESCRIPTOR=y
 #CONFIG_CONSOLE_SYSTEM76_EC=y

models/gaze14_1660ti/coreboot.config

@@ -12,6 +12,7 @@ CONFIG_PAYLOAD_FILE="$(FIRMWARE_OPEN_UEFIPAYLOAD)"
 CONFIG_RUN_FSP_GOP=y
 CONFIG_SMMSTORE=y
 CONFIG_SMMSTORE_V2=y
+CONFIG_TPM_MEASURED_BOOT=y
 CONFIG_USE_OPTION_TABLE=y
 CONFIG_VALIDATE_INTEL_DESCRIPTOR=y
 #CONFIG_CONSOLE_SYSTEM76_EC=y

models/gaze15/coreboot.config

@@ -13,6 +13,7 @@ CONFIG_POST_IO=n
 CONFIG_RUN_FSP_GOP=y
 CONFIG_SMMSTORE=y
 CONFIG_SMMSTORE_V2=y
+CONFIG_TPM_MEASURED_BOOT=y
 CONFIG_USE_OPTION_TABLE=y
 CONFIG_VALIDATE_INTEL_DESCRIPTOR=y
 #CONFIG_CONSOLE_SYSTEM76_EC=y

models/gaze16-3050/coreboot.config

@@ -14,6 +14,7 @@ CONFIG_POST_IO=n
 CONFIG_RUN_FSP_GOP=y
 CONFIG_SMMSTORE=y
 CONFIG_SMMSTORE_V2=y
+CONFIG_TPM_MEASURED_BOOT=y
 CONFIG_USE_OPTION_TABLE=y
 CONFIG_VALIDATE_INTEL_DESCRIPTOR=y
 #CONFIG_CONSOLE_SYSTEM76_EC=y

models/gaze16-3060-b/coreboot.config

@@ -16,6 +16,7 @@ CONFIG_POST_IO=n
 CONFIG_RUN_FSP_GOP=y
 CONFIG_SMMSTORE=y
 CONFIG_SMMSTORE_V2=y
+CONFIG_TPM_MEASURED_BOOT=y
 CONFIG_USE_OPTION_TABLE=y
 CONFIG_VALIDATE_INTEL_DESCRIPTOR=y
 CONFIG_CONSOLE_SYSTEM76_EC=y

models/gaze16-3060/coreboot.config

@@ -14,6 +14,7 @@ CONFIG_POST_IO=n
 CONFIG_RUN_FSP_GOP=y
 CONFIG_SMMSTORE=y
 CONFIG_SMMSTORE_V2=y
+CONFIG_TPM_MEASURED_BOOT=y
 CONFIG_USE_OPTION_TABLE=y
 CONFIG_VALIDATE_INTEL_DESCRIPTOR=y
 #CONFIG_CONSOLE_SYSTEM76_EC=y

models/lemp10/coreboot.config

@@ -16,6 +16,7 @@ CONFIG_POST_IO=n
 CONFIG_RUN_FSP_GOP=y
 CONFIG_SMMSTORE=y
 CONFIG_SMMSTORE_V2=y
+CONFIG_TPM_MEASURED_BOOT=y
 CONFIG_USE_OPTION_TABLE=y
 CONFIG_VALIDATE_INTEL_DESCRIPTOR=y
 #CONFIG_CONSOLE_SYSTEM76_EC=y

models/lemp9/coreboot.config

@@ -13,6 +13,7 @@ CONFIG_POST_IO=n
 CONFIG_RUN_FSP_GOP=y
 CONFIG_SMMSTORE=y
 CONFIG_SMMSTORE_V2=y
+CONFIG_TPM_MEASURED_BOOT=y
 CONFIG_USE_OPTION_TABLE=y
 CONFIG_VALIDATE_INTEL_DESCRIPTOR=y
 #CONFIG_CONSOLE_SYSTEM76_EC=y

models/oryp5/coreboot.config

@@ -13,6 +13,7 @@ CONFIG_POST_IO=n
 CONFIG_RUN_FSP_GOP=y
 CONFIG_SMMSTORE=y
 CONFIG_SMMSTORE_V2=y
+CONFIG_TPM_MEASURED_BOOT=y
 CONFIG_USE_OPTION_TABLE=y
 CONFIG_VALIDATE_INTEL_DESCRIPTOR=y
 #CONFIG_CONSOLE_SYSTEM76_EC=y

models/oryp6/coreboot.config

@@ -14,6 +14,7 @@ CONFIG_POST_IO=n
 CONFIG_RUN_FSP_GOP=y
 CONFIG_SMMSTORE=y
 CONFIG_SMMSTORE_V2=y
+CONFIG_TPM_MEASURED_BOOT=y
 CONFIG_USE_OPTION_TABLE=y
 CONFIG_VALIDATE_INTEL_DESCRIPTOR=y
 #CONFIG_CONSOLE_SYSTEM76_EC=y

models/oryp7/coreboot.config

@@ -14,6 +14,7 @@ CONFIG_POST_IO=n
 CONFIG_RUN_FSP_GOP=y
 CONFIG_SMMSTORE=y
 CONFIG_SMMSTORE_V2=y
+CONFIG_TPM_MEASURED_BOOT=y
 CONFIG_USE_OPTION_TABLE=y
 CONFIG_VALIDATE_INTEL_DESCRIPTOR=y
 #CONFIG_CONSOLE_SYSTEM76_EC=y

models/oryp8/coreboot.config

@@ -17,6 +17,7 @@ CONFIG_POST_IO=n
 CONFIG_RUN_FSP_GOP=y
 CONFIG_SMMSTORE=y
 CONFIG_SMMSTORE_V2=y
+CONFIG_TPM_MEASURED_BOOT=y
 CONFIG_USE_OPTION_TABLE=y
 CONFIG_VALIDATE_INTEL_DESCRIPTOR=y
 #CONFIG_CONSOLE_SYSTEM76_EC=y