Re: [PATCH v3 2/2] usb: misc: xapea00x: perform platform initialization of TPM

[Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>]

On Tue, May 08, 2018 at 08:25:48AM -0700, James Bottomley wrote:
> On Tue, 2018-05-08 at 13:55 +0300, Jarkko Sakkinen wrote:
> > On Fri, May 04, 2018 at 02:56:25PM -0500, David R. Bild wrote:
> [...]
> > > In particular, it sets the credentials for the platform hierarchy.
> > > The platform hierarchy is essentially the "root" account of the
> > > TPM, so it's critical that those credentials be set before the TPM
> > > is exposed to user-space.  (The platform credentials aren't
> > > persisted in the TPM and must be set by the platform on every
> > > boot.)  If the driver registers the TPM before doing
> > > initialization, there's a chance that something else could access
> > > the TPM before the platform credentials get set.
> > 
> > Maybe. Not sure yet where to draw the line eg should TSS2 daemon to
> > do it for example.
> > 
> > James? Philip?
> 
> I don't see any reason to set an unreachable password for the platform
> hierarchy if the UEFI didn't.  If the desire is to disable the platform
> hierarchy, then it should be disabled, not have a random password set. 
> I'd also say this is probably the job of early boot based on policy.
> 
> James

A valid point.

/Jarkko