linux-kernel - Re: [BUG] Nuvoton NCPT650 TPM 2.0 mode not working

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 18 Nov 2018 15:10:06 +0100
From:   Michael Niewöhner <linux@...ewoehner.de>
To:     Jarkko Sakkinen <jarkko.sakkinen@...ux.intel.com>
Cc:     Mimi Zohar <zohar@...ux.ibm.com>,
        James Bottomley <James.Bottomley@...senPartnership.com>,
        peterhuewe@....de, jgg@...pe.ca, arnd@...db.de,
        linux-integrity@...r.kernel.org,
        linux-kernel <linux-kernel@...r.kernel.org>,
        Nayna Jain <nayna@...ux.ibm.com>
Subject: Re: [BUG] Nuvoton NCPT650 TPM 2.0 mode not working

On Sun, 2018-11-18 at 10:18 +0200, Jarkko Sakkinen wrote:
> On Fri, Nov 16, 2018 at 10:06:28PM +0100, Michael Niewöhner wrote:
> > On Wed, 2018-11-14 at 21:46 +0100, Michael Niewöhner wrote:
> > > Hi all,
> > > 
> > > I tried that patch mentioned by Mimi but it does not change anything for
> > > me.
> > > 
> > > Then I did some more tests with different kernel configs and finally got
> > > TPM
> > > working by
> > > a) compiling TPM as modules and rmmod tpm* and re-modprobe tpm_tis.
> > > 
> > > (initramfs) dmesg | grep -i tpm
> > > [    0.000000] efi:  ACPI 2.0=0x9ea7e000 ACPI=0x9ea7e000 SMBIOS=0x9f5eb000
> > > SMBIOS 3.0=0x9f5ea000 ESRT=0x9c07d918 MEMATTR=0x9bea3018
> > > TPMEventLog=0x97cbb018
> > > [    0.003793] ACPI: TPM2 0x000000009EAB7F70 000034 (v03 LENOVO TC-
> > > S06   00001260 AMI 00000000)
> > > (initramfs) rmmod tpm_crb tpm_tis tpm_tis_core tpm
> > > (initramfs) modprobe tpm_tis
> > > [   44.956905] tpm_tis MSFT0101:00: 2.0 TPM (device-id 0xFE, rev-id 2)
> > > 
> > > b) compiling TPM-support in-kernel and manually bind the ACPI device
> > > 
> > > (initramfs) dmesg | grep -i tpm
> > > [    0.000000] efi: ACPI 2.0=0x9ea7e000 ACPI=0x9ea7e000 SMBIOS=0x9f5eb000
> > > SMBIOS
> > > 3.0=0x9f5ea000 ESRT=0x9c07d918 MEMATTR=0x9bea3018 TPMEventLog=0x97cbb018
> > > [    0.003546] ACPI: TPM2 0x000000009EAB7F70 000034 (v03 LENOVO TC-S06
> > > 00001260
> > > AMI 00000000)
> > > (initramfs) echo MSFT0101:00 >/sys/bus/platform/drivers/tpm_tis/bind
> > > [  233.076079] tpm_tis MSFT0101:00: 2.0 TPM (device-id 0xFE, rev-id 2)
> > > 
> > > 
> > > It seems to me, the kernel tries to enable the TPM to early...
> > > 
> > > 
> > > Michael
> > 
> > Looks like the manual driver bind works more or less but e.g reading hwrng
> > does
> > not work...
> > 
> > # echo MSFT0101:00 >/sys/bus/platform/drivers/tpm_tis/bind
> > [  148.293302] tpm_tis MSFT0101:00: 2.0 TPM (device-id 0xFE, rev-id 2)
> > # cat /sys/devices/virtual/misc/hw_random/rng_current
> > tpm-rng-0
> > # cat /dev/hwrng >/dev/null 
> > cat: /dev/hwrng: Operation not permitted
> 
> Can you check with trace-cmd start -p function -l 'tpm*'?
> 
> /Jarkko


Hi Jarko,

what output do you need exactly?

root@...ian:~# trace-cmd record -p function -l 'tpm*'
  plugin 'function'
Hit Ctrl^C to stop recording
^CCPU0 data recorded at offset=0x464000
    0 bytes in size
CPU1 data recorded at offset=0x464000
    0 bytes in size
CPU2 data recorded at offset=0x464000
    0 bytes in size
CPU3 data recorded at offset=0x464000
    4096 bytes in size
CPU4 data recorded at offset=0x465000
    4096 bytes in size
CPU5 data recorded at offset=0x466000
    0 bytes in size
CPU6 data recorded at offset=0x466000
    0 bytes in size
CPU7 data recorded at offset=0x466000
    0 bytes in size
root@...ian:~# trace-cmd report
CPU 0 is empty
CPU 1 is empty
CPU 2 is empty
CPU 5 is empty
CPU 6 is empty
CPU 7 is empty
cpus=8
             cat-3324  [003]   265.547715: function:             tpm_hwrng_read
             cat-3324  [003]   265.547721: function:             tpm_get_random
             cat-3324  [003]   265.547721:
function:                tpm_find_get_ops
             cat-3324  [003]   265.547721:
function:                   tpm_try_get_ops
             cat-3324  [003]   265.547721:
function:                tpm2_get_random
             cat-3324  [003]   265.547722:
function:                   tpm_transmit_cmd
             cat-3324  [003]   265.547722:
function:                      tpm_transmit
             cat-3324  [003]   265.547722:
function:                         tpm_tis_clkrun_enable
             cat-3324  [003]   265.547723:
function:             tpm_tcg_read_bytes

< snip ... many times the same lines: cat-3324 ... function: tpm_tcg_read_bytes
>

             cat-3324  [004]   266.291087:
function:             tpm_tcg_read_bytes
             cat-3324  [004]   266.296347:
function:             tpm_tis_clkrun_enable
             cat-3324  [004]   266.296349: function:             tpm_put_ops

Michael