Make TPM dependency optional and controlled by flag CONFIG_TPM

if "CONFIG_TPM=y" is not present in the config file, functionalities
needing TPM could be disabled, while leaving other functionalities intact.

This will make Heads a more general-usage bootloader payload atop coreboot.

boards/x230.config

@@ -17,6 +17,7 @@ CONFIG_TPMTOTP=y
 CONFIG_XEN=y
 CONFIG_XEN_VERSION=4.8
 CONFIG_DROPBEAR=y
+CONFIG_TPM=y
 
 CONFIG_LINUX_USB=y
 CONFIG_LINUX_E1000E=y

initrd/bin/kexec-save-default

@@ -1,6 +1,7 @@
 #!/bin/sh
 # Save these options to be the persistent default
 set -e -o pipefail
+. /etc/config
 . /etc/functions
 
 while getopts "b:d:p:i:" arg; do
@@ -44,7 +45,8 @@ fi
 KEY_DEVICES="$paramsdir/kexec_key_devices.txt"
 KEY_LVM="$paramsdir/kexec_key_lvm.txt"
 save_key="n"
-if [ ! -r "$KEY_DEVICES" ]; then
+if [ "$CONFIG_TPM" = "y" ]; then
+	if [ ! -r "$KEY_DEVICES" ]; then
 		read \
 			-n 1 \
 			-p "Do you wish to add a disk encryption to the TPM [y/N]: " \
@@ -52,13 +54,12 @@ if [ ! -r "$KEY_DEVICES" ]; then
 		echo
 
 		if [ "$add_key_confirm" = "y" \
-		-o "$add_key_confirm" = "Y" ] \
-	; then
+			-o "$add_key_confirm" = "Y" ]; then
 			lvm_suggest="e.g. qubes_dom0 or blank"
 			devices_suggest="e.g. /dev/sda2 or blank"
 			save_key="y"
 		fi
-else
+	else
 		read \
 			-n 1 \
 			-p "Do you want to reseal a disk key to the TPM [y/N]: " \
@@ -66,24 +67,26 @@ else
 		echo
 
 		if [ "$change_key_confirm" = "y" \
-		-o "$change_key_confirm" = "Y" ] \
-	; then
+			-o "$change_key_confirm" = "Y" ]; then
 			old_lvm_volume_group=""
 			if [ -r "$KEY_LVM" ]; then
 				old_lvm_volume_group=`cat $KEY_LVM` || true
-			old_key_devices=`cat $KEY_DEVICES | cut -d\  -f1 \
-				| grep -v "$old_lvm_volume_group" | xargs` || true
+				old_key_devices=`cat $KEY_DEVICES \
+				| cut -d\  -f1 \
+				| grep -v "$old_lvm_volume_group" \
+				| xargs` || true
 			else
-			old_key_devices=`cat $KEY_DEVICES | cut -d\  -f1 | xargs` || true
+				old_key_devices=`cat $KEY_DEVICES \
+				| cut -d\  -f1 | xargs` || true
 			fi
 
 			lvm_suggest="was '$old_lvm_volume_group'"
 			devices_suggest="was '$old_key_devices'"
 			save_key="y"
 		fi
-fi
+	fi
 
-if [ "$save_key" = "y" ]; then
+	if [ "$save_key" = "y" ]; then
 		echo "+++ LVM volume groups (lvm vgscan): "
 		lvm vgscan || true
 
@@ -107,6 +110,7 @@ if [ "$save_key" = "y" ]; then
 		echo "Running kexec-save-key with params: $save_key_params"
 		kexec-save-key $save_key_params \
 			|| die "Failed to save the disk key"
+	fi
 fi
 
 # try to switch to rw mode
@@ -126,7 +130,11 @@ if [ ! -r $ENTRY_FILE -o ! -r $HASH_FILE ]; then
 fi
 
 # sign and auto-roll config counter
-kexec-sign-config -p $paramsdir -u \
+extparam=
+if [ "$CONFIG_TPM" = "y" ]; then
+	extparam=-u
+fi
+kexec-sign-config -p $paramsdir $extparam \
 || die "Failed to sign default config"
 
 # switch back to ro mode

initrd/bin/kexec-select-boot

@@ -232,7 +232,8 @@ do_boot()
 		die "!!! Missing required boot hashes"
 	fi
 
-	if [ -r "$TMP_KEY_DEVICES" ]; then
+	if [ "$CONFIG_TPM" = "y" \
+		-a -r "$TMP_KEY_DEVICES" ]; then
 		INITRD=`kexec-boot -b "$bootdir" -e "$option" -i` \
 		|| die "!!! Failed to extract the initrd from boot option"
 		if [ -z "$INITRD" ]; then
@@ -261,7 +262,8 @@ while true; do
 	TMP_KEY_DEVICES="/tmp/kexec/kexec_key_devices.txt"
 	TMP_KEY_LVM="/tmp/kexec/kexec_key_lvm.txt"
 
-	if [ ! -r "$TMP_KEY_DEVICES" ]; then
+	if [ "$CONFIG_TPM" = "y" \
+		-a ! -r "$TMP_KEY_DEVICES" ]; then
 		# Extend PCR4 as soon as possible
 		tpm extend -ix 4 -ic generic \
 		|| die "Failed to extend PCR 4"
@@ -272,6 +274,7 @@ while true; do
 		scan_options
 	fi
 
+	if [ "$CONFIG_TPM" = "y" ]; then
 		# Optionally enforce device file hashes
 		if [ -r "$TMP_HASH_FILE" ]; then
 			valid_global_hash="n"
@@ -289,6 +292,7 @@ while true; do
 
 			verify_rollback_counter
 		fi
+	fi
 
 	if [ "$default_failed" != "y" \
 		-a "$force_menu" = "n" \

initrd/bin/usb-init

@@ -4,8 +4,10 @@
 . /etc/functions
 . /etc/config
 
-# Extend PCR4 as soon as possible
-tpm extend -ix 4 -ic usb
+if [ "$CONFIG_TPM" = "y" ]; then
+	# Extend PCR4 as soon as possible
+	tpm extend -ix 4 -ic usb
+fi
 
 usb-scan
 recovery "Something failed during USB boot"

initrd/etc/functions

@@ -17,8 +17,9 @@ recovery() {
 	# but recreate the directory so that new tools can use it.
 	rm -rf /tmp/secret
 	mkdir -p /tmp/secret
+	if [ "$CONFIG_TPM" = y ]; then
 		tpm extend -ix 4 -ic recovery
-
+	fi
 	echo >&2 "!!!!! Starting recovery shell"
 	sleep 1
 	exec /bin/ash
@@ -41,7 +42,7 @@ confirm_totp()
 		date=`date "+%Y-%m-%d %H:%M:%S"`
 		seconds=`date "+%s"`
 		half=`expr \( $seconds % 60 \) / 30`
-		if [ "$CONFIG_TPM" = n ]; then
+		if [ "$CONFIG_TPM" != y ]; then
 			TOTP="NO TPM"
 		elif [ "$half" != "$last_half" ]; then
 			last_half=$half;