[tpm2] Re: {External} Re: tpm2_nvdefine fails with inconsistent attributes...
Roberts, William C <william.c.roberts at intel.com>
| Newsgroups | dev.linux.lists.tpm2 |
|---|---|
| Message-ID | <SN6PR11MB343741F9F48187B08EA5FB4AB86A9@SN6PR11MB3437.namprd11.prod.outlook.com> |
No reason sounds like an easy enough feature to add. Do you want to send a patch up?
________________________________
From: Sievert, James <james.sievert(a)bsci.com>
Sent: Friday, December 3, 2021 9:10 AM
To: Kenneth Goldman <kgoldman(a)us.ibm.com>
Cc: tpm2(a)lists.01.org <tpm2(a)lists.01.org>
Subject: [tpm2] Re: {External} Re: tpm2_nvdefine fails with inconsistent attributes...
That was it. Thanks, Ken.
According to the documentation for tpm2_nvdefine, the defaults for the platform hierarchy are PPREAD and PPWRITE. Strangely, PLATFORMCREATE is not included. The following is sufficient:
tpm2_nvdefine 0x01000025 -C p -s 1 -a "ppwrite|ppread|platformcreate"
Is there some reason the defaults for the platform hierarchy don’t include PLATFORMCREATE?
From: Kenneth Goldman <kgoldman(a)us.ibm.com>
Sent: Friday, December 3, 2021 9:52 AM
To: Sievert, James <james.sievert(a)bsci.com>
Cc: tpm2(a)lists.01.org
Subject: {External} [tpm2] Re: tpm2_nvdefine fails with inconsistent attributes...
My guess is that you do not set the TPMA_NVA_PLATFORMCREATE attribute.
The IBM utility sets it for you when the platform hierarchy authorizes the command, since it must be set.
--
Ken Goldman kgoldman(a)us.ibm.com<mailto:kgoldman(a)us.ibm.com>
914-945-2415 (862-2415)
[Inactive hide details for "Sievert, James" ---12/03/2021 09:37:25 AM---Hi, I’m using tpm2-tools 4.1.1 on Ubuntu 20.04. I’m i]"Sievert, James" ---12/03/2021 09:37:25 AM---Hi, I’m using tpm2-tools 4.1.1 on Ubuntu 20.04. I’m issuing the following command which is returnin
From: "Sievert, James" <james.sievert(a)bsci.com<mailto:james.sievert(a)bsci.com>>
To: "tpm2(a)lists.01.org<mailto:tpm2(a)lists.01.org>" <tpm2(a)lists.01.org<mailto:tpm2(a)lists.01.org>>
Date: 12/03/2021 09:37 AM
Subject: [EXTERNAL] [tpm2] tpm2_nvdefine fails with inconsistent attributes...
________________________________
Hi, I’m using tpm2-tools 4.1.1 on Ubuntu 20.04. I’m issuing the following command which is returning an inconsistent attributes error: bsci(a)ip-10-132-42-225:~$ tpm2_nvdefine 0x1000025 -C p -s 1
Hi,
I’m using tpm2-tools 4.1.1 on Ubuntu 20.04. I’m issuing the following command which is returning an inconsistent attributes error:
bsci(a)ip-10-132-42-225:~$ tpm2_nvdefine 0x1000025 -C p -s 1
WARNING:esys:src/tss2-esys/api/Esys_NV_DefineSpace.c:333:Esys_NV_DefineSpace_Finish() Received TPM Error
ERROR:esys:src/tss2-esys/api/Esys_NV_DefineSpace.c:122:Esys_NV_DefineSpace() Esys Finish ErrorCode (0x00000182)
ERROR: Failed to define NV area at index 0x1000025
ERROR: Esys_NV_DefineSpace(0x182) - tpm:handle(1):inconsistent attributes
ERROR: Unable to run tpm2_nvdefine
and yes, I am attempting to define the index using the platform hierarchy. ? This does work using the IBM utilities.
Here are the current properties:
bsci(a)ip-10-132-42-225:~$ tpm2_getcap properties-variable
TPM2_PT_PERSISTENT:
ownerAuthSet: 0
endorsementAuthSet: 0
lockoutAuthSet: 0
reserved1: 0
disableClear: 0
inLockout: 0
tpmGeneratedEPS: 0
reserved2: 0
TPM2_PT_STARTUP_CLEAR:
phEnable: 1
shEnable: 1
ehEnable: 1
phEnableNV: 1
reserved1: 0
orderly: 0
TPM2_PT_HR_NV_INDEX: 0x6
TPM2_PT_HR_LOADED: 0x0
TPM2_PT_HR_LOADED_AVAIL: 0x3
TPM2_PT_HR_ACTIVE: 0x0
TPM2_PT_HR_ACTIVE_AVAIL: 0x40
TPM2_PT_HR_TRANSIENT_AVAIL: 0x3
TPM2_PT_HR_PERSISTENT: 0x0
TPM2_PT_HR_PERSISTENT_AVAIL: 0x11
TPM2_PT_NV_COUNTERS: 0x0
TPM2_PT_NV_COUNTERS_AVAIL: 0xD
TPM2_PT_ALGORITHM_SET: 0x0
TPM2_PT_LOADED_CURVES: 0x2
TPM2_PT_LOCKOUT_COUNTER: 0x0
TPM2_PT_MAX_AUTH_FAIL: 0x20
TPM2_PT_LOCKOUT_INTERVAL: 0x1C20
TPM2_PT_LOCKOUT_RECOVERY: 0x15180
TPM2_PT_AUDIT_COUNTER_0: 0x0
TPM2_PT_AUDIT_COUNTER_1: 0x0
Any insight would be appreciated.
Thanks!_______________________________________________
tpm2 mailing list -- tpm2(a)lists.01.org<mailto:tpm2(a)lists.01.org>
To unsubscribe send an email to tpm2-leave(a)lists.01.org<mailto:tpm2-leave(a)lists.01.org>
%(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s
attachment.htm
(text/html, 13.3 KB)
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1256">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
No reason sounds like an easy enough feature to add. Do you want to send a patch up?</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Sievert, James <[email protected]><br>
<b>Sent:</b> Friday, December 3, 2021 9:10 AM<br>
<b>To:</b> Kenneth Goldman <[email protected]><br>
<b>Cc:</b> [email protected] <[email protected]><br>
<b>Subject:</b> [tpm2] Re: {External} Re: tpm2_nvdefine fails with inconsistent attributes...</font>
<div> </div>
</div>
<style>
<!--
@font-face
{font-family:"Cambria Math"}
@font-face
{font-family:Calibri}
@font-face
{font-family:"Segoe UI Emoji"}
p.x_MsoNormal, li.x_MsoNormal, div.x_MsoNormal
{margin:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif}
a:link, span.x_MsoHyperlink
{color:#0563C1;
text-decoration:underline}
tt
{font-family:"Courier New"}
span.x_EmailStyle21
{font-family:"Calibri",sans-serif;
color:windowtext}
.x_MsoChpDefault
{font-size:10.0pt}
@page WordSection1
{margin:1.0in 1.0in 1.0in 1.0in}
div.x_WordSection1
{}
-->
</style>
<div lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="x_WordSection1">
<p class="x_MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif">That was it. Thanks, Ken.</span></p>
<p class="x_MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif"> </span></p>
<p class="x_MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif">According to the documentation for tpm2_nvdefine, the defaults for the platform hierarchy are PPREAD and PPWRITE. Strangely, PLATFORMCREATE is not included. The following
is sufficient:<br>
<br>
tpm2_nvdefine 0x01000025 -C p -s 1 -a "ppwrite|ppread|platformcreate" </span>
</p>
<p class="x_MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif"> </span></p>
<p class="x_MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif">Is there some reason the defaults for the platform hierarchy dont include PLATFORMCREATE?</span></p>
<p class="x_MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif"> </span></p>
<div>
<div style="border:none; border-top:solid #E1E1E1 1.0pt; padding:3.0pt 0in 0in 0in">
<p class="x_MsoNormal"><b><span style="font-size:11.0pt; font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt; font-family:"Calibri",sans-serif"> Kenneth Goldman <[email protected]>
<br>
<b>Sent:</b> Friday, December 3, 2021 9:52 AM<br>
<b>To:</b> Sievert, James <[email protected]><br>
<b>Cc:</b> [email protected]<br>
<b>Subject:</b> {External} [tpm2] Re: tpm2_nvdefine fails with inconsistent attributes...</span></p>
</div>
</div>
<p class="x_MsoNormal"> </p>
<p><span style="font-size:10.0pt; font-family:"Arial",sans-serif">My guess is that you do not set the TPMA_NVA_PLATFORMCREATE attribute.</span><br>
<br>
<span style="font-size:10.0pt; font-family:"Arial",sans-serif">The IBM utility sets it for you when the platform hierarchy authorizes the command, since it must be set.<br>
<br>
--<br>
Ken Goldman <a href="mailto:[email protected]">[email protected]</a> <br>
914-945-2415 (862-2415)<br>
</span><br>
<br>
<img border="0" width="16" height="16" id="x_Picture_x0020_1" alt="Inactive hide details for "Sievert, James" ---12/03/2021 09:37:25 AM---Hi, Im using tpm2-tools 4.1.1 on Ubuntu 20.04. Im i" style="width:.1666in; height:.1666in" data-outlook-trace="F:1|T:1" src="cid:[email protected]"><span style="font-size:10.0pt; font-family:"Arial",sans-serif; color:#424282">"Sievert,
James" ---12/03/2021 09:37:25 AM---Hi, Im using tpm2-tools 4.1.1 on Ubuntu 20.04. Im issuing the following command which is returnin</span><br>
<br>
<span style="font-size:7.5pt; font-family:"Arial",sans-serif; color:#5F5F5F">From:
</span><span style="font-size:7.5pt; font-family:"Arial",sans-serif">"Sievert, James" <<a href="mailto:[email protected]">[email protected]</a>></span><br>
<span style="font-size:7.5pt; font-family:"Arial",sans-serif; color:#5F5F5F">To: </span>
<span style="font-size:7.5pt; font-family:"Arial",sans-serif">"<a href="mailto:[email protected]">[email protected]</a>" <<a href="mailto:[email protected]">[email protected]</a>></span><br>
<span style="font-size:7.5pt; font-family:"Arial",sans-serif; color:#5F5F5F">Date:
</span><span style="font-size:7.5pt; font-family:"Arial",sans-serif">12/03/2021 09:37 AM</span><br>
<span style="font-size:7.5pt; font-family:"Arial",sans-serif; color:#5F5F5F">Subject:
</span><span style="font-size:7.5pt; font-family:"Arial",sans-serif">[EXTERNAL] [tpm2] tpm2_nvdefine fails with inconsistent attributes...</span></p>
<div class="x_MsoNormal">
<hr size="2" width="100%" noshade="" align="left" style="color:#8091A5">
</div>
<p class="x_MsoNormal" style="margin-bottom:12.0pt"><br>
<br>
<br>
<span style="font-size:7.5pt; color:white">Hi, Im using tpm2-tools 4.1.1 on Ubuntu 20.04. Im issuing the following command which is returning an inconsistent attributes error: bsci@ip-10-132-42-225:~$ tpm2_nvdefine 0x1000025 -C p -s 1 </span><br>
<span style="font-size:10.0pt; font-family:"Calibri",sans-serif">Hi,</span><br>
<span style="font-size:10.0pt; font-family:"Calibri",sans-serif"> </span><br>
<span style="font-size:10.0pt; font-family:"Calibri",sans-serif">Im using tpm2-tools 4.1.1 on Ubuntu 20.04. Im issuing the following command which is returning an inconsistent attributes error:</span><br>
<span style="font-size:10.0pt; font-family:"Calibri",sans-serif"> </span><br>
<span style="font-size:10.0pt; font-family:"Calibri",sans-serif">bsci@ip-10-132-42-225:~$ tpm2_nvdefine 0x1000025 -C p -s 1</span><br>
<span style="font-size:10.0pt; font-family:"Calibri",sans-serif">WARNING:esys:src/tss2-esys/api/Esys_NV_DefineSpace.c:333:Esys_NV_DefineSpace_Finish() Received TPM Error</span><br>
<span style="font-size:10.0pt; font-family:"Calibri",sans-serif">ERROR:esys:src/tss2-esys/api/Esys_NV_DefineSpace.c:122:Esys_NV_DefineSpace() Esys Finish ErrorCode (0x00000182)</span><br>
<span style="font-size:10.0pt; font-family:"Calibri",sans-serif">ERROR: Failed to define NV area at index 0x1000025</span><br>
<span style="font-size:10.0pt; font-family:"Calibri",sans-serif">ERROR: Esys_NV_DefineSpace(0x182) - tpm:handle(1):inconsistent attributes</span><br>
<span style="font-size:10.0pt; font-family:"Calibri",sans-serif">ERROR: Unable to run tpm2_nvdefine</span><br>
<span style="font-size:10.0pt; font-family:"Calibri",sans-serif"> </span><br>
<span style="font-size:10.0pt; font-family:"Calibri",sans-serif">and yes, I am attempting to define the index using the platform hierarchy. </span><span style="font-size:10.0pt; font-family:"Segoe UI Emoji",sans-serif">?</span><span style="font-size:10.0pt; font-family:"Calibri",sans-serif">
This does work using the IBM utilities. </span><br>
<span style="font-size:10.0pt; font-family:"Calibri",sans-serif"> </span><br>
<span style="font-size:10.0pt; font-family:"Calibri",sans-serif">Here are the current properties:</span><br>
<span style="font-size:10.0pt; font-family:"Calibri",sans-serif"> </span><br>
<span style="font-size:10.0pt; font-family:"Calibri",sans-serif">bsci@ip-10-132-42-225:~$ tpm2_getcap properties-variable</span><br>
<span style="font-size:10.0pt; font-family:"Calibri",sans-serif">TPM2_PT_PERSISTENT:</span><br>
<span style="font-size:10.0pt; font-family:"Calibri",sans-serif"> ownerAuthSet: 0</span><br>
<span style="font-size:10.0pt; font-family:"Calibri",sans-serif"> endorsementAuthSet: 0</span><br>
<span style="font-size:10.0pt; font-family:"Calibri",sans-serif"> lockoutAuthSet: 0</span><br>
<span style="font-size:10.0pt; font-family:"Calibri",sans-serif"> reserved1: 0</span><br>
<span style="font-size:10.0pt; font-family:"Calibri",sans-serif"> disableClear: 0</span><br>
<span style="font-size:10.0pt; font-family:"Calibri",sans-serif"> inLockout: 0</span><br>
<span style="font-size:10.0pt; font-family:"Calibri",sans-serif"> tpmGeneratedEPS: 0</span><br>
<span style="font-size:10.0pt; font-family:"Calibri",sans-serif"> reserved2: 0</span><br>
<span style="font-size:10.0pt; font-family:"Calibri",sans-serif">TPM2_PT_STARTUP_CLEAR:</span><br>
<span style="font-size:10.0pt; font-family:"Calibri",sans-serif"> phEnable: 1</span><br>
<span style="font-size:10.0pt; font-family:"Calibri",sans-serif"> shEnable: 1</span><br>
<span style="font-size:10.0pt; font-family:"Calibri",sans-serif"> ehEnable: 1</span><br>
<span style="font-size:10.0pt; font-family:"Calibri",sans-serif"> phEnableNV: 1</span><br>
<span style="font-size:10.0pt; font-family:"Calibri",sans-serif"> reserved1: 0</span><br>
<span style="font-size:10.0pt; font-family:"Calibri",sans-serif"> orderly: 0</span><br>
<span style="font-size:10.0pt; font-family:"Calibri",sans-serif">TPM2_PT_HR_NV_INDEX: 0x6</span><br>
<span style="font-size:10.0pt; font-family:"Calibri",sans-serif">TPM2_PT_HR_LOADED: 0x0</span><br>
<span style="font-size:10.0pt; font-family:"Calibri",sans-serif">TPM2_PT_HR_LOADED_AVAIL: 0x3</span><br>
<span style="font-size:10.0pt; font-family:"Calibri",sans-serif">TPM2_PT_HR_ACTIVE: 0x0</span><br>
<span style="font-size:10.0pt; font-family:"Calibri",sans-serif">TPM2_PT_HR_ACTIVE_AVAIL: 0x40</span><br>
<span style="font-size:10.0pt; font-family:"Calibri",sans-serif">TPM2_PT_HR_TRANSIENT_AVAIL: 0x3</span><br>
<span style="font-size:10.0pt; font-family:"Calibri",sans-serif">TPM2_PT_HR_PERSISTENT: 0x0</span><br>
<span style="font-size:10.0pt; font-family:"Calibri",sans-serif">TPM2_PT_HR_PERSISTENT_AVAIL: 0x11</span><br>
<span style="font-size:10.0pt; font-family:"Calibri",sans-serif">TPM2_PT_NV_COUNTERS: 0x0</span><br>
<span style="font-size:10.0pt; font-family:"Calibri",sans-serif">TPM2_PT_NV_COUNTERS_AVAIL: 0xD</span><br>
<span style="font-size:10.0pt; font-family:"Calibri",sans-serif">TPM2_PT_ALGORITHM_SET: 0x0</span><br>
<span style="font-size:10.0pt; font-family:"Calibri",sans-serif">TPM2_PT_LOADED_CURVES: 0x2</span><br>
<span style="font-size:10.0pt; font-family:"Calibri",sans-serif">TPM2_PT_LOCKOUT_COUNTER: 0x0</span><br>
<span style="font-size:10.0pt; font-family:"Calibri",sans-serif">TPM2_PT_MAX_AUTH_FAIL: 0x20</span><br>
<span style="font-size:10.0pt; font-family:"Calibri",sans-serif">TPM2_PT_LOCKOUT_INTERVAL: 0x1C20</span><br>
<span style="font-size:10.0pt; font-family:"Calibri",sans-serif">TPM2_PT_LOCKOUT_RECOVERY: 0x15180</span><br>
<span style="font-size:10.0pt; font-family:"Calibri",sans-serif">TPM2_PT_AUDIT_COUNTER_0: 0x0</span><br>
<span style="font-size:10.0pt; font-family:"Calibri",sans-serif">TPM2_PT_AUDIT_COUNTER_1: 0x0</span><br>
<span style="font-size:10.0pt; font-family:"Calibri",sans-serif"> </span><br>
<span style="font-size:10.0pt; font-family:"Calibri",sans-serif">Any insight would be appreciated. </span><br>
<span style="font-size:10.0pt; font-family:"Calibri",sans-serif">Thanks!</span><tt><span style="font-size:10.0pt">_______________________________________________</span></tt><span style="font-size:10.0pt; font-family:"Courier New""><br>
<tt>tpm2 mailing list -- <a href="mailto:[email protected]">[email protected]</a></tt><br>
<tt>To unsubscribe send an email to <a href="mailto:[email protected]">[email protected]</a></tt><br>
<tt>%(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s</tt></span><br>
<br>
<br>
</p>
</div>
</div>
</body>
</html>
image001.gif
(image/gif, 105 B) - not displayed