From b192af12e3e483699f2e75790b2eb6e79b5b4f71 Mon Sep 17 00:00:00 2001 From: Arthur Heymans Date: Thu, 20 May 2021 09:09:56 +0200 Subject: security/tpm/tspi: Always measure the cache to pcr Most of the time when INIT_BOOTBLOCK is selected, the cache should be empty here anyway, so this is a no-op. But when it's not empty that means the bootblock loaded some other file before it got to the TPM init part (which is possible, for example, if hooks like bootblock_soc_init() load something). Change-Id: I4aea86c094abc951d7670838f12371fddaffaa90 Signed-off-by: Arthur Heymans Reviewed-on: https://review.coreboot.org/c/coreboot/+/54717 Tested-by: build bot (Jenkins) Reviewed-by: Angel Pons Reviewed-by: Julius Werner --- src/security/tpm/tspi/tspi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/security/tpm/tspi/tspi.c b/src/security/tpm/tspi/tspi.c index 7a8e2befdf..b1bea4160d 100644 --- a/src/security/tpm/tspi/tspi.c +++ b/src/security/tpm/tspi/tspi.c @@ -184,7 +184,7 @@ uint32_t tpm_setup(int s3flag) #if CONFIG(TPM1) result = tpm1_invoke_state_machine(); #endif - if (CONFIG(TPM_MEASURED_BOOT) && !CONFIG(TPM_MEASURED_BOOT_INIT_BOOTBLOCK)) + if (CONFIG(TPM_MEASURED_BOOT)) result = tspi_measure_cache_to_pcr(); tpm_is_setup = 1; -- cgit v1.2.3