<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta name="Generator" content="Microsoft Word 15 (filtered medium)"> <style></style> </head> <body lang="EN-US" link="blue" vlink="purple"> <div class="WordSection1"> Hi Jason:<o:p></o:p> The behavior is defined in PFP spec v0.51 Chapter 8. 2 ACPI measuring points don’t comply with PFP spec. All ACPI DATA for EV_POST_CODE must be measured before fixup.<o:p></o:p> <a name="_MailEndCompose">Tks for pointing it. <o:p></o:p></a> <o:p> </o:p> <div> <div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm"> <a name="_____replyseparator"></a>From: Yao, Jiewen Sent: Wednesday, June 26, 2019 12:08 AM To: devel@edk2.groups.io; jason.spottswood@hpe.com Cc: Zhang, Chao B <chao.b.zhang@intel.com>; Yao, Jiewen <jiewen.yao@intel.com> Subject: RE: [edk2-devel] TPM ACPI HID creation<o:p></o:p> </div> </div> <o:p> </o:p> Thanks Jason.<o:p></o:p> <o:p> </o:p> I think we should NOT measure TPM2 table *after* ACPI table patch.<o:p></o:p> The measurement should happen *before* ACPI table patch.<o:p></o:p> <o:p> </o:p> Hi Chao<o:p></o:p> Do you agree on that?<o:p></o:p> <o:p> </o:p> Thank you<o:p></o:p> Yao Jiewen<o:p></o:p> <o:p> </o:p> <o:p> </o:p> <div style="border:none;border-left:solid blue 1.5pt;padding:0cm 0cm 0cm 4.0pt"> <div> <div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm"> From: <a href="mailto:devel@edk2.groups.io">devel@edk2.groups.io</a> [<a href="mailto:devel@edk2.groups.io">mailto:devel@edk2.groups.io</a>] On Behalf Of <a href="mailto:jason.spottswood@hpe.com">jason.spottswood@hpe.com</a> Sent: Tuesday, June 25, 2019 11:58 PM To: <a href="mailto:devel@edk2.groups.io">devel@edk2.groups.io</a> Subject: [edk2-devel] TPM ACPI HID creation<o:p></o:p> </div> </div> <o:p> </o:p> Tcg2Smm.c has a function "UpdateHID to create the ACPI HID for the TPM. This function uses the TPM vendor ID combined with the firmware version number to create the ACPI HID. The use of the TPM firmware version is not specified in any spec from the TCG or otherwise that I have been able to find. I believe this was a design choice specific to EDK2. However, using the TPM firmware version does not match the intended use case from the TCG PC Client spec, where the HID should be comprised of the vendor ID and device ID. See below. One problem that arises from this design is that the ACPI tables will change when the TPM FW has been updated. Since the ACPI tables are hashed into PCR[0], it consequently means that a TPM FW change will cause a change to PCR[0]. It is not intuitive nor spec'd that TPM FW be included in PCR[0] measurements. In fact, PCR[0] is used only for system FW/UEFI code measurements. If a user does not update UEFI, then there is no expectation of PCR[0] measurement changes. I propose that EDK2 change the UpdateHID function to use the vendor ID and device ID read from register TPM_DID_VID_0 (locality 0 offset 0xF00) in the creation of the ACPI HID. The following was taken from the TCG PC Client Platform Firmware spec:<o:p></o:p> According to the ACPI Specification (version 5, Errata A, Section 6.1.5 and 6.1.3) a<o:p></o:p> hardware ID or compatibility ID is either a PNP ID with format “AAA####” or ACPI ID<o:p></o:p> with format “NNNN####”. The manufacturer ID returned by a TPM2_GetCapability<o:p></o:p> command can be used to set the “AAA” or “NNNN” portion of the ID. The remaining four<o:p></o:p> hexadecimal digits should be set to a value that allows software to differentiate different<o:p></o:p> device classes built by the same manufacturer.<o:p></o:p> <div> </o:p> </div> </div> </div> </body> </html> <div width="1" style="color:white;clear:both">_._,_._,_</div> <hr> Groups.io Links: You receive all messages sent to this group. <a target="_blank" href="https://edk2.groups.io/g/devel/message/42848">View/Reply Online (#42848)</a> | | <a target="_blank" href="https://groups.io/mt/32205028/1813853">Mute This Topic</a> | <a href="https://edk2.groups.io/g/devel/post">New Topic</a> <a href="https://edk2.groups.io/g/devel/editsub/1813853">Your Subscription</a> | <a href="mailto:devel+owner@edk2.groups.io">Contact Group Owner</a> | <a href="https://edk2.groups.io/g/devel/unsub">Unsubscribe</a> [edk2-devel-archive@redhat.com] <div width="1" style="color:white;clear:both">_._,_._,_</div>