Re: [PATCH 3/4] OvmfPkg: rework TPM configuration

["Gerd Hoffmann" <kraxel@redhat.com>]

On Thu, Oct 21, 2021 at 11:44:54AM -0400, Stefan Berger wrote:
> 
> On 10/21/21 8:20 AM, Gerd Hoffmann wrote:
> > Rename TPM_ENABLE to TPM2_ENABLE and TPM_CONFIG_ENABLE to
> > TPM2_CONFIG_ENABLE so they are in line with the ArmVirtPkg
> > config option names.
> > 
> > Add separate TPM1_ENABLE option for TPM 1.2 support.
> 
> 
> I tested this on Fedora and attached a TPM 1.2 to the VM after a build
> **without** TPM1_ENABLE. When I run this here inside the VM
> 
> cat /sys/devices/pnp0/00\:04/prcs
> 
> I get measurements in PCRs 0-9 hinting that the TPM 1.2 support isn't
> entirely disabled but somehow it's still measuring into those
> firmware-related PCRs. It is due to this here:
> 
> +  # has no effect unless TPM2_ENABLE == TRUE
> +  DEFINE TPM1_ENABLE             = TRUE
> 
> 
> If you set this to FALSE then it removes TPM 1.2 support if TPM1_ENABLE is
> not passed.

Yes, that is intentional.  By default (when you don't explicitly set
TPM1_ENABLE) behavior doesn't change and TPM 1.2 support continues to
be available like it is the case without this series applied.

When you think it is better to flip the default instead of being
conservative I happily change it in v2.

take care,
  Gerd