mirror of
https://github.com/jiazhang0/meta-secure-core.git
synced 2026-07-27 22:38:40 +00:00
Trevor Woerner
089dd7e811
Bitbake will try an ls-remote for any recipe whose SRCREV is AUTOREV, even if that recipe will not ultimately be used for a particular build. Therefore if the user specifies 'BB_NO_NETWORK = "1"', the _git versions of the tpm2 recipes will cause the build to fail even if the _git versions are not going to be built (which they won't be by default on account of their DEFAULT_PREFERENCE being set to "-1"). This fix follows the same pattern as https://github.com/sbabic/meta-swupdate/commit/721fcc89c53debcd6582bd1aa972f75297cf12e9 With this fix, the user can disable networking and successfully build the non-_git versions of the tpm2 recipes. If the user wants to build the _git versions, networking must be enabled. The build is expected to fail if the user asks for the _git versions, but disables networking. Signed-off-by: Trevor Woerner <twoerner@gmail.com>
TPM 2.0
This feature enables Trusted Platform Module (TPM 2.0) support, including kernel option changes to enable tpm drivers, and picking up TPM 2.0 packages.
Trusted Platform Module (TPM 2.0) is a microcontroller that stores keys, passwords, and digital certificates. A TPM 2.0 offers the capabilities as part of the overall platform security requirements.
Clear TPM
For TPM 2.0, the following typical steps can be performed to get the TPM ready for use:
- Clear and enable TPM from the BIOS or set the security jumper on the board.
- Take TPM ownership, setting Owner/Endorsement/Lockout passwords if necessary. These passwords are used for the authorization to certain TPM 2.0 commands.
# tpm2_takeownership -o <ownerPasswd> -e <endorsePasswd> -l <lockPasswd>
Then, you can use the TPM for a specific need, such as key generation, sealing encrypted data, etc.