linux-kernel - Re: [PATCH] tpm: Don't make vendor check required for probe

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZODFE7ngbLAo2vCx@ncase>
Date:   Sat, 19 Aug 2023 15:35:15 +0200
From:   Patrick Steinhardt <ps@....im>
To:     "Limonciello, Mario" <mario.limonciello@....com>
Cc:     Jarkko Sakkinen <jarkko@...nel.org>,
        linux-integrity@...r.kernel.org, linux-kernel@...r.kernel.org,
        Thorsten Leemhuis <regressions@...mhuis.info>,
        charles.d.prestopine@...el.com, rafael.j.wysocki@...el.com,
        len.brown@...el.com, stable@...r.kernel.org,
        Todd Brandt <todd.e.brandt@...el.com>
Subject: Re: [PATCH] tpm: Don't make vendor check required for probe

On Fri, Aug 18, 2023 at 06:57:57PM -0500, Limonciello, Mario wrote:
> 
> 
> On 8/18/2023 6:44 PM, Jarkko Sakkinen wrote:
> > On Fri Aug 18, 2023 at 10:38 PM UTC, Limonciello, Mario wrote:
> >>
> >>
> >> On 8/18/2023 5:07 PM, Jarkko Sakkinen wrote:
> >>> On Fri Aug 18, 2023 at 6:15 PM UTC, Mario Limonciello wrote:
> >>>> The vendor check introduced by commit 554b841d4703 ("tpm: Disable RNG for
> >>>> all AMD fTPMs") doesn't work properly on Intel fTPM.  The TPM doesn't reply
> >>>> at bootup and returns back the command code.
> >>>
> >>> Is this reproducible with any production hardware? You are stating it
> >>> as it was reproducible categorically with any Intel fTPM.
> >>>
> >>
> >> Yes, it's affecting production hardware too.
> >> Someone came to the kernel bugzilla and reported a regression on 6.4.11
> >> on a Lenovo Intel laptop as well.
> > 
> > Now the description says that cateogrically all Intel fTPM's fail.
> 
> According to Todd this change caused 5 *different* reference Intel 
> systems all to fail.  I know they're not production hardware, but still..

For what it's worth, I can confirm that this issue also occurs on an
ASUS Z170I motherboard with Intel i3 7100U and an integrated fTPM. If it
helps I'm happy to try out the proposed patch -- for now I simply
reverted 554b841d4703 ("tpm: Disable RNG for all AMD fTPMs"), which
resolved the issue for me.

Patrick

Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)