-----BEGIN PGP SIGNED MESSAGE-----
On 2016-05-17 10:01, jpalc...@gmail.com
> On Tuesday, May 17, 2016 at 6:17:13 PM UTC+2, Chris Laprise wrote:
>> On 05/17/2016 04:24 AM, Andrew David Wong wrote:
>>> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512
>>> On 2016-05-17 00:01, Alex Guzman wrote:
>>>> I’ve removed Qubes from the laptop at this point, but I never
>>>> had this behavior.
>>>> For reference, my setup had an internal /boot, TPM SRK key
>>>> set, using legacy boot. I never encountered the stuff you’re
>>> Thanks for the feedback, Alex! I'm beginning to suspect that
>>> it's due to an AEM installer change since then.
>> After using AEM for years, I tried to install a second copy a few
>> weeks ago and failed. So I am thinking the installer became
>> broken as well. When I get a chance I intend to retrace my steps
>> and file an issue for it.
> I managed to install AEM on thinkpad x220 yesterday(TXT enabled,
> UEFI disabled, secret is txt file, VT-d is enabled), so the
> installer is rather working now, but I had few problems with TPM -
> I wasn't able to take ownership - after disabling TPM -> restart
> -> enabling security chip even the option to clear keys
> disappeared from BIOS.
I didn't encounter any problems with taking ownership of the TPM. I
did, however, discover that Lenovos (or at least this model) requires
a cold boot (rather than a warm boot) in order for the option to clear
the TPM to be available in the BIOS.
> The solution was simple: In Lenovo's laptops, the "Physical
> Presence" thing mentioned i.e. in tpm_clear tool is related with
> pressing fn before power button - in that case the option appeared
> again in bios and I hadn't met any other problems.
Interesting. As mentioned above, I didn't have to press Fn before the
power button in order to clear or take ownership of the TPM even
though I have the "require physical presence" option enabled in the
BIOS. Perhaps this issue is model-specific or BIOS-specific.
Just to clarify, when you say "pressing fn before power button," do
you mean the following?
1. System is completely powered off.
2. Press and hold the Fn key.
3. Press and release the power button.
4. Release the Fn key.
In your case, this caused the "clear TPM" option to be available in
the BIOS, whereas before it was not? Did it have any other effects?
-----END PGP SIGNATURE-----