Add physical presence initialization and locking to one-time initializations.

firmware/lib/tpm_lite/tlcl.c

Index: firmware/lib/tpm_lite/tlcl.c
diff --git a/firmware/lib/tpm_lite/tlcl.c b/firmware/lib/tpm_lite/tlcl.c
index 5a28f67b50a41a95f4b2459af32f9e31af273dcf..2bbb20dcd0c8f40cc0e352c65816c64631e0966b 100644
--- a/firmware/lib/tpm_lite/tlcl.c
+++ b/firmware/lib/tpm_lite/tlcl.c
@@ -181,6 +181,11 @@ uint32_t TlclPhysicalPresenceCMDEnable(void) {
   return Send(tpm_ppenable_cmd.buffer);
 }
 
+uint32_t TlclFinalizePhysicalPresence(void) {
+  VBDEBUG(("TPM: Enable PP cmd, disable HW pp, and set lifetime lock\n"));
+  return Send(tpm_finalizepp_cmd.buffer);
+}
+
 uint32_t TlclAssertPhysicalPresenceResult(void) {
   uint8_t response[TPM_LARGE_ENOUGH_COMMAND_SIZE];
   return TlclSendReceive(tpm_ppassert_cmd.buffer, response, sizeof(response));
@@ -199,7 +204,8 @@ uint32_t TlclSetNvLocked(void) {
 int TlclIsOwned(void) {
   uint8_t response[TPM_LARGE_ENOUGH_COMMAND_SIZE + TPM_PUBEK_SIZE];
   uint32_t result;
-  result = TlclSendReceive(tpm_readpubek_cmd.buffer, response, sizeof(response));
+  result = TlclSendReceive(tpm_readpubek_cmd.buffer,
+                           response, sizeof(response));
   return (result != TPM_SUCCESS);
 }