diff options
| author | Arthur Heymans <arthur@aheymans.xyz> | 2021-03-29 14:23:53 +0200 |
|---|---|---|
| committer | Arthur Heymans <arthur@aheymans.xyz> | 2021-05-06 08:26:41 +0000 |
| commit | 6f8e9443aa55ad27045fb437fd8df3386d66ba3e (patch) | |
| tree | 32d21070ab5343979b6f95bae77567d26d6230d6 /src/drivers | |
| parent | 59a621abc70464352eaf540bd6cb896935b9ba72 (diff) | |
| download | coreboot-6f8e9443aa55ad27045fb437fd8df3386d66ba3e.tar.xz | |
security/tpm: Add option to init TPM in bootblock
When using a hardware assisted root of trust measurement, like Intel
TXT/CBnT, the TPM init needs to happen inside the bootblock to form a
proper chain of trust.
Change-Id: Ifacba5d9ab19b47968b4f2ed5731ded4aac55022
Signed-off-by: Arthur Heymans <arthur@aheymans.xyz>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/51923
Reviewed-by: Christian Walter <christian.walter@9elements.com>
Reviewed-by: Angel Pons <th3fanbus@gmail.com>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Diffstat (limited to 'src/drivers')
| -rw-r--r-- | src/drivers/pc80/tpm/Makefile.inc | 1 | ||||
| -rw-r--r-- | src/drivers/tpm/Kconfig | 3 |
2 files changed, 3 insertions, 1 deletions
diff --git a/src/drivers/pc80/tpm/Makefile.inc b/src/drivers/pc80/tpm/Makefile.inc index a16f6afdc4..8b2a864ecb 100644 --- a/src/drivers/pc80/tpm/Makefile.inc +++ b/src/drivers/pc80/tpm/Makefile.inc @@ -1,3 +1,4 @@ +bootblock-$(CONFIG_MAINBOARD_HAS_LPC_TPM) += tis.c verstage-$(CONFIG_MAINBOARD_HAS_LPC_TPM) += tis.c romstage-$(CONFIG_MAINBOARD_HAS_LPC_TPM) += tis.c ramstage-$(CONFIG_MAINBOARD_HAS_LPC_TPM) += tis.c diff --git a/src/drivers/tpm/Kconfig b/src/drivers/tpm/Kconfig index 128f9bfecd..79b860f89b 100644 --- a/src/drivers/tpm/Kconfig +++ b/src/drivers/tpm/Kconfig @@ -1,7 +1,8 @@ config TPM_INIT_RAMSTAGE bool default y if TPM1 || TPM2 - depends on !VBOOT && !VENDORCODE_ELTAN_VBOOT && !VENDORCODE_ELTAN_MBOOT + depends on !VBOOT && !VENDORCODE_ELTAN_VBOOT && !VENDORCODE_ELTAN_MBOOT \ + && !TPM_MEASURED_BOOT_INIT_BOOTBLOCK help This driver automatically initializes the TPM if vboot is not used. The TPM driver init is done during the ramstage chip init phase. |