[meta-gbmc-staging] Initialize TPM before running bios_validator

Use 'htool --transport dbus security startup' to initialize the TPM before invoking bios_validator in gbmc_sysinit.sh.in so that measurements land in PCR 17.

Tested: n/a
Fusion-Link: fusion2 n/a
Google-Bug-Id: 534708592
Change-Id: Ib08b625d80ed18a2ad5065fc88549e81f07d0167
Signed-off-by: Collin Wright <collinwright@google.com>

recipes-google/gbmc-sysinit/server2/gbmc_sysinit.sh.in

diff --git a/recipes-google/gbmc-sysinit/server2/gbmc_sysinit.sh.in b/recipes-google/gbmc-sysinit/server2/gbmc_sysinit.sh.in
index e505156..bea066f 100644
--- a/recipes-google/gbmc-sysinit/server2/gbmc_sysinit.sh.in
+++ b/recipes-google/gbmc-sysinit/server2/gbmc_sysinit.sh.in
@@ -53,6 +53,11 @@
 
   # Make sure the bios version does not persist reboots.
   rm -f "${BIOS_PERSIST_FILE}"
+
+  # Start the TPM to ensure measurements go to PCR 17
+  echo "Initializing Hoth TPM..."
+  htool --transport dbus security startup || echo "Failed to start TPM, continuing..."
+
   # bios_validator will freeze the secondary token on failure
   bios_validator validate "/dev/${bios_mtd}ro" @BIOS_SIZE@ \
     @BIOS_KEY@ --send_tokens --rtm_hoth "" --write_version "${BIOS_PERSIST_FILE}"