TPM2 - modules / tpmx / nitropc-v2 #1109
Conversation
Signed-off-by: Trammell Hudson <[email protected]>
Signed-off-by: Trammell Hudson <[email protected]>
TPM2 cannot extend shell functions, only full binaries. Thus move recovery to its own file in /bin as it's the most common thing to be extended. An alternative is to use the tpm2 pcrextend with a precomputed pcr digest, however that will not allow the use of the generic tpm_extend function. Signed-off-by: Cody Ho <[email protected]>
Used to abstract away all the differences between TPM1.2 and TPM2. Eventually all code should be written to use this abstraction layer. Signed-off-by: Cody Ho <[email protected]>
Board specific scripts (ie t430-flash) have not been modified. Signed-off-by: Cody Ho <[email protected]>
Also remove most of tpm-reset and just call the tpmx code directly. It's being left in because many guides on the internet still have references to tpm-reset in them, so removing it may create unnecessary confusion. Signed-off-by: Cody Ho <[email protected]>
Contains various code cleanups and a note to retrieve USB device branding from USB device info, not just checking vendor id
|
@daringer Does not build?! public key missing?! See CircleCI logs! |
|
I broke my circleci, need to check, but currently does not build yet, it is missing the coreboot hack, although it should build for other platforms but also not tested yet ... |
|
@daringer : converted to draft. Updates? |
|
Why not hardenedvault/vaultboot@4506fc2 |
@daringer @aesrentai We are at a stage, with KVM/QEMU support under #1188 for swtpm HOTP and local testing, to take a leadership decision on what implementation to chose and go forward. Personally, I would take @root-hardenedvault implementation, based on #893 and #907 prior work and go from there, making hardenedvault approach upstream (tested and used in hardware already). @aesrentai @daringer : your input on his approach and why you decided to create/use another one (while similar #1109 ) would be interesting prior of going forward. #1188 board configurations can be reused easily to create I'm asking for your input, since I would take that ball and move it forward under paid grant application work, thanks to Nlnet. Originally posted by @tlaurion in #1031 (comment) |
|
Superseded by #1292 |
tlaurion
added
the
Bounty/Donations expected
nitropc_v2is essentially alibrem_mini_v2/ nitropc + tpm2 (not working due to some missing config-hacks I did inside coreboot, will pack them into a patch soon)expect this to change a lot, this is WIP