linux-kernel - Re: [PATCH 1/3] tpm: Disable TCG_TPM2

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <D1G8FRJFBBAO.X8CAFK3K34VJ@kernel.org>
Date: Wed, 22 May 2024 17:11:11 +0300
From: "Jarkko Sakkinen" <jarkko@...nel.org>
To: "Vitor Soares" <ivitro@...il.com>, "James Bottomley"
 <James.Bottomley@...senPartnership.com>, <linux-integrity@...r.kernel.org>
Cc: <keyrings@...r.kernel.org>, "Peter Huewe" <peterhuewe@....de>, "Jason
 Gunthorpe" <jgg@...pe.ca>, "Mimi Zohar" <zohar@...ux.ibm.com>, "David
 Howells" <dhowells@...hat.com>, "Paul Moore" <paul@...l-moore.com>, "James
 Morris" <jmorris@...ei.org>, "Serge E. Hallyn" <serge@...lyn.com>,
 <linux-kernel@...r.kernel.org>, <linux-security-module@...r.kernel.org>
Subject: Re: [PATCH 1/3] tpm: Disable TCG_TPM2_HMAC by default

On Wed May 22, 2024 at 4:17 PM EEST, Vitor Soares wrote:
> > 1. What is the aarch64 platform you are using?
>
> I was testing this on the Toradex Verdin iMX8MM SoM.
>
> > 2. What kind of TPM you are using and how is it connect?
>
> TPM device is the ATTPM20P connect through the SPI at speed of 36 MHz.
> The bus is shared with a CAN controller (MCP251xFD), so both mues work together.
>
> The dts looks like:
> tpm1: tpm@1 {
>         compatible = "atmel,attpm20p", "tcg,tpm_tis-spi";
>         interrupts-extended = <&gpio1 7 IRQ_TYPE_LEVEL_LOW>;
>         pinctrl-0 = <&pinctrl_can2_int>;
>         pinctrl-names = "default";
>         reg = <1>;
>         spi-max-frequency = <36000000>;
> };

Thank you, this exactly what I was looking for. Don't expect any
improvement to the situation before rc1 is out. It is better to
investigate the situation a bit first.

E.g. some people test with fTPM TEE so this was pretty essential
to know that it is a chip going through.

For tpm_crb we should actually disable HMAC at some point. It is
essentially a performance regression for it.

BR, Jarkko