On Mon, Aug 15, 2016 at 03:54:49PM -0700, Julius Werner wrote:
I think the answer is that CONFIG_TPM doesn't do anything by itself (it just compiles extra libraries that offer functions to access TPMs), so there's no point in selecting it directly from menuconfig. Any feature that uses the TPM (like CONFIG_VBOOT) should have its own Kconfig option that you select through menuconfig and which just has a 'select TPM' clause to pull in those libraries.
Ah, I see. That makes more sense.
[...] So if you're adding anything new that wants to use tlcl functions, you should give it its own Kconfig option that does 'select TPM'.
That's what I'll do. Thanks for the insight.
On a related topic, is there a reason to wait to enable the TPM? Looking at src/northbridge/intel/sandybridge/romstage.c, it isn't enabled until after the MRC cache has been read from the read-write portions of the flash chip, which could potentially compromise the root of trust.
On a related topic, is there a reason to wait to enable the TPM? Looking at src/northbridge/intel/sandybridge/romstage.c, it isn't enabled until after the MRC cache has been read from the read-write portions of the flash chip, which could potentially compromise the root of trust.
No, I think that's just the way it grew historically. Note that init_tpm() is part of older code which is not using src/lib/tlcl.c and isn't really part of the way the main vboot code uses the TPM. (Also, in vboot the TPM is just used for lockable NVRAM storage, it's not really part of the root of trust.)
-
Julius Werner -
Trammell Hudson