diff --git a/src/lib/tpm2_marshaling.c b/src/lib/tpm2_marshaling.c
index ab9a928..f4fd3cb 100644
--- a/src/lib/tpm2_marshaling.c
+++ b/src/lib/tpm2_marshaling.c
@@ -4,6 +4,7 @@
  * found in the LICENSE file.
  */
 
+#include <arch/early_variables.h>
 #include <commonlib/endian.h>
 #include <console/console.h>
 #include <stdlib.h>
@@ -11,7 +12,7 @@
 
 #include "tpm2_marshaling.h"
 
-static uint16_t tpm_tag;  /* Depends on the command type. */
+static uint16_t tpm_tag CAR_GLOBAL;  /* Depends on the command type. */
 
 /*
  * Each unmarshaling function receives a pointer to the buffer pointer and a
@@ -268,7 +269,7 @@
 	int i;
 	struct tpm2_session_header session_header;
 
-	tpm_tag = TPM_ST_SESSIONS;
+	car_set_var(tpm_tag, TPM_ST_SESSIONS);
 
 	for (i = 0; i < handle_count; i++)
 		marshal_TPM_HANDLE(buffer, handles[i], buffer_space);
@@ -380,7 +381,7 @@
 	size_t body_size = max_body_size;
 
 	/* Will be modified when marshaling some commands. */
-	tpm_tag = TPM_ST_NO_SESSIONS;
+	car_set_var(tpm_tag, TPM_ST_NO_SESSIONS);
 
 	switch (command) {
 	case TPM2_Startup:
@@ -437,7 +438,9 @@
 		/* Total size includes the header size. */
 		marshaled_size += sizeof(struct tpm_header);
 
-		marshal_u16(&buffer, tpm_tag, &header_room);
+		uint16_t tpm_tag_value = car_get_var(tpm_tag);
+
+		marshal_u16(&buffer, tpm_tag_value, &header_room);
 		marshal_u32(&buffer, marshaled_size, &header_room);
 		marshal_u32(&buffer, command, &header_room);
 		return marshaled_size;
diff --git a/src/lib/tpm2_tlcl.c b/src/lib/tpm2_tlcl.c
index c8e7e90..7bfd40d 100644
--- a/src/lib/tpm2_tlcl.c
+++ b/src/lib/tpm2_tlcl.c
@@ -4,6 +4,7 @@
  * found in the LICENSE file.
  */
 
+#include <arch/early_variables.h>
 #include <console/console.h>
 #include <endian.h>
 #include <lib/tpm2_tlcl_structures.h>
@@ -24,10 +25,12 @@
 	ssize_t out_size;
 	size_t in_size;
 	/* Command/response buffer. */
-	static uint8_t cr_buffer[TPM_BUFFER_SIZE];
+	static uint8_t cr_buffer[TPM_BUFFER_SIZE] CAR_GLOBAL;
+
+	uint8_t *cr_buffer_ptr = car_get_var_ptr(cr_buffer);
 
 	out_size = tpm_marshal_command(command, command_body,
-				       cr_buffer, sizeof(cr_buffer));
+				       cr_buffer_ptr, sizeof(cr_buffer));
 	if (out_size < 0) {
 		printk(BIOS_ERR, "command %#x, cr size %zd\n",
 		       command, out_size);
@@ -35,13 +38,13 @@
 	}
 
 	in_size = sizeof(cr_buffer);
-	if (tis_sendrecv(cr_buffer, out_size,
-			 cr_buffer, &in_size)) {
+	if (tis_sendrecv(cr_buffer_ptr, out_size,
+			 cr_buffer_ptr, &in_size)) {
 		printk(BIOS_ERR, "tpm transaction failed\n");
 		return NULL;
 	}
 
-	return tpm_unmarshal_response(command, cr_buffer, in_size);
+	return tpm_unmarshal_response(command, cr_buffer_ptr, in_size);
 }