<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> <meta name="Generator" content="Microsoft Word 15 (filtered medium)"> <style></style> </head> <body lang="EN-US" link="blue" vlink="#954F72" style="word-wrap:break-word"> <div class="WordSection1"> Oops. Sorry for late response.<o:p></o:p> <o:p> </o:p> The code is NOT in EDKII, but EDKII-platform as example. <a href="https://github.com/tianocore/edk2-platforms/tree/master/Platform/Intel/MinPlatformPkg/Tcg"> https://github.com/tianocore/edk2-platforms/tree/master/Platform/Intel/MinPlatformPkg/Tcg</a><o:p></o:p> <o:p> </o:p> We allow a platform having its own implementation. That is why it is NOT in EDKII.<o:p></o:p> <o:p> </o:p> Thank you<o:p></o:p> Yao Jiewen<o:p></o:p> <o:p> </o:p> <div> <div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in"> From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Bret Barkelew via groups.io Sent: Wednesday, July 28, 2021 12:11 AM To: devel@edk2.groups.io; stefanb@linux.ibm.com; Yao, Jiewen <jiewen.yao@intel.com>; Jeremiah Cox <jerecox@microsoft.com>; Michael Kubacki <Michael.Kubacki@microsoft.com> Cc: Marc-André Lureau <marcandre.lureau@redhat.com> Subject: Re: [EXTERNAL] [edk2-devel] Missing TPM 2 related call to Tpm2HierarchyChangeAuth<o:p></o:p> </div> </div> <o:p> </o:p> Adding <a id="OWAAM57DF552AAA444C9D81C6D190197AAE31" href="mailto:jerecox@microsoft.com"> @Jeremiah</a>…<o:p></o:p> <o:p> </o:p> Jeremiah, weren’t you or <a id="OWAAMF48ECF70C0FF4290BC7C5F323E5081B0" href="mailto:Michael.Kubacki@microsoft.com"> @Michael</a> shopping this change to MinPlatform?<o:p></o:p> <o:p> </o:p> - Bret <o:p></o:p> <o:p> </o:p> <div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in"> From: <a href="mailto:stefanb=linux.ibm.com@groups.io">Stefan Berger via groups.io</a> Sent: Monday, July 26, 2021 7:48 AM To: <a href="mailto:jiewen.yao@intel.com">Yao, Jiewen</a>; <a href="mailto:devel@edk2.groups.io"> devel@edk2.groups.io</a> Cc: <a href="mailto:marcandre.lureau@redhat.com">Marc-André Lureau</a> Subject: [EXTERNAL] [edk2-devel] Missing TPM 2 related call to Tpm2HierarchyChangeAuth<o:p></o:p> </div> <o:p> </o:p> Hello! The TPM 2 code in EDK2 is missing an important call to Tpm2HierarchyChangeAuth for the platform hierarchy. We have to set the password of that hierarchy and discard the password. See also specs section 11: <a href="https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftrustedcomputinggroup.org%2Fwp-content%2Fuploads%2FTCG_PCClient_PFP_r1p05_v22_02dec2020.pdf&data=04%7C01%7Cbret.barkelew%40microsoft.com%7Cf2a2262eee2c44b3760c08d95044601a%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637629077356686202%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000&sdata=N7VQIw87rHqUAFQ54TvhNwcsPFEwJzdZQ9JZrmX1S4E%3D&reserved=0">https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftrustedcomputinggroup.org%2Fwp-content%2Fuploads%2FTCG_PCClient_PFP_r1p05_v22_02dec2020.pdf&data=04%7C01%7Cbret.barkelew%40microsoft.com%7Cf2a2262eee2c44b3760c08d95044601a%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637629077356686202%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000&sdata=N7VQIw87rHqUAFQ54TvhNwcsPFEwJzdZQ9JZrmX1S4E%3D&reserved=0</a> "Platform Firmware MUST protect access to the Platform Hierarchy and prevent access to the platform hierarchy by non-manufacturer-controlled components. " I was wondering where we could put that call so it's invoked after the user has possibly interacted with the menu and before passing control to the next stage such as boot loader. Regards, Stefan <o:p></o:p> <o:p> </o:p> <div> </o:p> </div> </div> </body> </html> <div width="1" style="color:white;clear:both">_._,_._,_</div> <hr> Groups.io Links: You receive all messages sent to this group. <a target="_blank" href="https://edk2.groups.io/g/devel/message/78231">View/Reply Online (#78231)</a> | | <a target="_blank" href="https://groups.io/mt/84485285/1813853">Mute This Topic</a> | <a href="https://edk2.groups.io/g/devel/post">New Topic</a> <a href="https://edk2.groups.io/g/devel/editsub/1813853">Your Subscription</a> | <a href="mailto:devel+owner@edk2.groups.io">Contact Group Owner</a> | <a href="https://edk2.groups.io/g/devel/unsub">Unsubscribe</a> [edk2-devel-archive@redhat.com] <div width="1" style="color:white;clear:both">_._,_._,_</div>