[tpm2] Re: tpm2_nvdefine fails with inconsistent attributes...
Steven Clark <davolfman at gmail.com>
| Newsgroups | dev.linux.lists.tpm2 |
|---|---|
| Message-ID | <CAOCvsSn8G6j=EvYeWK9=sjqesdg4Ho4j_DvLPEgFRKC36W3Mug@mail.gmail.com> |
It might also just be attempting to use platform authorization on real hardware while not being the system firmware. UEFI tends to lock out the platform on every boot because that's what it's supposed to do? On Fri, Dec 3, 2021, 6:52 AM Kenneth Goldman <kgoldman(a)us.ibm.com> wrote: > My guess is that you do not set the TPMA_NVA_PLATFORMCREATE attribute. > > The IBM utility sets it for you when the platform hierarchy authorizes the > command, since it must be set. > > -- > Ken Goldman kgoldman(a)us.ibm.com > 914-945-2415 (862-2415) > > > [image: Inactive hide details for "Sievert, James" ---12/03/2021 09:37:25 > AM---Hi, I’m using tpm2-tools 4.1.1 on Ubuntu 20.04. I’m i]"Sievert, > James" ---12/03/2021 09:37:25 AM---Hi, I’m using tpm2-tools 4.1.1 on Ubuntu > 20.04. I’m issuing the following command which is returnin > > From: "Sievert, James" <james.sievert(a)bsci.com> > To: "tpm2(a)lists.01.org" <tpm2(a)lists.01.org> > Date: 12/03/2021 09:37 AM > Subject: [EXTERNAL] [tpm2] tpm2_nvdefine fails with inconsistent > attributes... > ------------------------------ > > > > Hi, I’m using tpm2-tools 4.1.1 on Ubuntu 20.04. I’m issuing the following > command which is returning an inconsistent attributes error: > bsci(a)ip-10-132-42-225:~$ tpm2_nvdefine 0x1000025 -C p -s 1 > > Hi, > > I’m using tpm2-tools 4.1.1 on Ubuntu 20.04. I’m issuing the following > command which is returning an inconsistent attributes error: > > bsci(a)ip-10-132-42-225:~$ tpm2_nvdefine 0x1000025 -C p -s 1 > WARNING:esys:src/tss2-esys/api/Esys_NV_DefineSpace.c:333:Esys_NV_DefineSpace_Finish() > Received TPM Error > ERROR:esys:src/tss2-esys/api/Esys_NV_DefineSpace.c:122:Esys_NV_DefineSpace() > Esys Finish ErrorCode (0x00000182) > ERROR: Failed to define NV area at index 0x1000025 > ERROR: Esys_NV_DefineSpace(0x182) - tpm:handle(1):inconsistent attributes > ERROR: Unable to run tpm2_nvdefine > > and yes, I am attempting to define the index using the platform hierarchy. > ? This does work using the IBM utilities. > > Here are the current properties: > > bsci(a)ip-10-132-42-225:~$ tpm2_getcap properties-variable > TPM2_PT_PERSISTENT: > ownerAuthSet: 0 > endorsementAuthSet: 0 > lockoutAuthSet: 0 > reserved1: 0 > disableClear: 0 > inLockout: 0 > tpmGeneratedEPS: 0 > reserved2: 0 > TPM2_PT_STARTUP_CLEAR: > phEnable: 1 > shEnable: 1 > ehEnable: 1 > phEnableNV: 1 > reserved1: 0 > orderly: 0 > TPM2_PT_HR_NV_INDEX: 0x6 > TPM2_PT_HR_LOADED: 0x0 > TPM2_PT_HR_LOADED_AVAIL: 0x3 > TPM2_PT_HR_ACTIVE: 0x0 > TPM2_PT_HR_ACTIVE_AVAIL: 0x40 > TPM2_PT_HR_TRANSIENT_AVAIL: 0x3 > TPM2_PT_HR_PERSISTENT: 0x0 > TPM2_PT_HR_PERSISTENT_AVAIL: 0x11 > TPM2_PT_NV_COUNTERS: 0x0 > TPM2_PT_NV_COUNTERS_AVAIL: 0xD > TPM2_PT_ALGORITHM_SET: 0x0 > TPM2_PT_LOADED_CURVES: 0x2 > TPM2_PT_LOCKOUT_COUNTER: 0x0 > TPM2_PT_MAX_AUTH_FAIL: 0x20 > TPM2_PT_LOCKOUT_INTERVAL: 0x1C20 > TPM2_PT_LOCKOUT_RECOVERY: 0x15180 > TPM2_PT_AUDIT_COUNTER_0: 0x0 > TPM2_PT_AUDIT_COUNTER_1: 0x0 > > Any insight would be appreciated. > Thanks!_______________________________________________ > tpm2 mailing list -- tpm2(a)lists.01.org > To unsubscribe send an email to tpm2-leave(a)lists.01.org > %(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s > > > > _______________________________________________ > tpm2 mailing list -- tpm2(a)lists.01.org > To unsubscribe send an email to tpm2-leave(a)lists.01.org > %(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s
attachment.htm
(text/html, 7.6 KB)
<div dir="auto">It might also just be attempting to use platform authorization on real hardware while not being the system firmware. UEFI tends to lock out the platform on every boot because that's what it's supposed to do?</div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, Dec 3, 2021, 6:52 AM Kenneth Goldman <<a href="mailto:[email protected]">[email protected]</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><p><font size="2" face="sans-serif">My guess is that you do not set the TPMA_NVA_PLATFORMCREATE attribute.</font><br><br><font size="2" face="sans-serif">The IBM utility sets it for you when the platform hierarchy authorizes the command, since it must be set.<br><br>--<br>Ken Goldman <a href="mailto:[email protected]" target="_blank" rel="noreferrer">[email protected]</a> <br>914-945-2415 (862-2415)<br></font><br><br><img width="16" height="16" src="cid:[email protected]" border="0" alt="Inactive hide details for "Sievert, James" ---12/03/2021 09:37:25 AM---Hi, I’m using tpm2-tools 4.1.1 on Ubuntu 20.04. I’m i"><font size="2" color="#424282" face="sans-serif">"Sievert, James" ---12/03/2021 09:37:25 AM---Hi, I’m using tpm2-tools 4.1.1 on Ubuntu 20.04. I’m issuing the following command which is returnin</font><br><br><font size="1" color="#5F5F5F" face="sans-serif">From: </font><font size="1" face="sans-serif">"Sievert, James" <<a href="mailto:[email protected]" target="_blank" rel="noreferrer">[email protected]</a>></font><br><font size="1" color="#5F5F5F" face="sans-serif">To: </font><font size="1" face="sans-serif">"<a href="mailto:[email protected]" target="_blank" rel="noreferrer">[email protected]</a>" <<a href="mailto:[email protected]" target="_blank" rel="noreferrer">[email protected]</a>></font><br><font size="1" color="#5F5F5F" face="sans-serif">Date: </font><font size="1" face="sans-serif">12/03/2021 09:37 AM</font><br><font size="1" color="#5F5F5F" face="sans-serif">Subject: </font><font size="1" face="sans-serif">[EXTERNAL] [tpm2] tpm2_nvdefine fails with inconsistent attributes...</font><br><hr width="100%" size="2" align="left" noshade style="color:#8091a5"><br><br><br><font size="1" color="#FFFFFF" face="serif">Hi, I’m using tpm2-tools 4.1.1 on Ubuntu 20.04. I’m issuing the following command which is returning an inconsistent attributes error: bsci@ip-10-132-42-225:~$ tpm2_nvdefine 0x1000025 -C p -s 1 </font><br><font size="2" face="Calibri">Hi,</font><br><font size="2" face="Calibri"> </font><br><font size="2" face="Calibri">I’m using tpm2-tools 4.1.1 on Ubuntu 20.04. I’m issuing the following command which is returning an inconsistent attributes error:</font><br><font size="2" face="Calibri"> </font><br><font size="2" face="Calibri">bsci@ip-10-132-42-225:~$ tpm2_nvdefine 0x1000025 -C p -s 1</font><br><font size="2" face="Calibri">WARNING:esys:src/tss2-esys/api/Esys_NV_DefineSpace.c:333:Esys_NV_DefineSpace_Finish() Received TPM Error</font><br><font size="2" face="Calibri">ERROR:esys:src/tss2-esys/api/Esys_NV_DefineSpace.c:122:Esys_NV_DefineSpace() Esys Finish ErrorCode (0x00000182)</font><br><font size="2" face="Calibri">ERROR: Failed to define NV area at index 0x1000025</font><br><font size="2" face="Calibri">ERROR: Esys_NV_DefineSpace(0x182) - tpm:handle(1):inconsistent attributes</font><br><font size="2" face="Calibri">ERROR: Unable to run tpm2_nvdefine</font><br><font size="2" face="Calibri"> </font><br><font size="2" face="Calibri">and yes, I am attempting to define the index using the platform hierarchy. </font><font size="2" face="Segoe UI Emoji">?</font><font size="2" face="Calibri"> This does work using the IBM utilities. </font><br><font size="2" face="Calibri"> </font><br><font size="2" face="Calibri">Here are the current properties:</font><br><font size="2" face="Calibri"> </font><br><font size="2" face="Calibri">bsci@ip-10-132-42-225:~$ tpm2_getcap properties-variable</font><br><font size="2" face="Calibri">TPM2_PT_PERSISTENT:</font><br><font size="2" face="Calibri"> ownerAuthSet: 0</font><br><font size="2" face="Calibri"> endorsementAuthSet: 0</font><br><font size="2" face="Calibri"> lockoutAuthSet: 0</font><br><font size="2" face="Calibri"> reserved1: 0</font><br><font size="2" face="Calibri"> disableClear: 0</font><br><font size="2" face="Calibri"> inLockout: 0</font><br><font size="2" face="Calibri"> tpmGeneratedEPS: 0</font><br><font size="2" face="Calibri"> reserved2: 0</font><br><font size="2" face="Calibri">TPM2_PT_STARTUP_CLEAR:</font><br><font size="2" face="Calibri"> phEnable: 1</font><br><font size="2" face="Calibri"> shEnable: 1</font><br><font size="2" face="Calibri"> ehEnable: 1</font><br><font size="2" face="Calibri"> phEnableNV: 1</font><br><font size="2" face="Calibri"> reserved1: 0</font><br><font size="2" face="Calibri"> orderly: 0</font><br><font size="2" face="Calibri">TPM2_PT_HR_NV_INDEX: 0x6</font><br><font size="2" face="Calibri">TPM2_PT_HR_LOADED: 0x0</font><br><font size="2" face="Calibri">TPM2_PT_HR_LOADED_AVAIL: 0x3</font><br><font size="2" face="Calibri">TPM2_PT_HR_ACTIVE: 0x0</font><br><font size="2" face="Calibri">TPM2_PT_HR_ACTIVE_AVAIL: 0x40</font><br><font size="2" face="Calibri">TPM2_PT_HR_TRANSIENT_AVAIL: 0x3</font><br><font size="2" face="Calibri">TPM2_PT_HR_PERSISTENT: 0x0</font><br><font size="2" face="Calibri">TPM2_PT_HR_PERSISTENT_AVAIL: 0x11</font><br><font size="2" face="Calibri">TPM2_PT_NV_COUNTERS: 0x0</font><br><font size="2" face="Calibri">TPM2_PT_NV_COUNTERS_AVAIL: 0xD</font><br><font size="2" face="Calibri">TPM2_PT_ALGORITHM_SET: 0x0</font><br><font size="2" face="Calibri">TPM2_PT_LOADED_CURVES: 0x2</font><br><font size="2" face="Calibri">TPM2_PT_LOCKOUT_COUNTER: 0x0</font><br><font size="2" face="Calibri">TPM2_PT_MAX_AUTH_FAIL: 0x20</font><br><font size="2" face="Calibri">TPM2_PT_LOCKOUT_INTERVAL: 0x1C20</font><br><font size="2" face="Calibri">TPM2_PT_LOCKOUT_RECOVERY: 0x15180</font><br><font size="2" face="Calibri">TPM2_PT_AUDIT_COUNTER_0: 0x0</font><br><font size="2" face="Calibri">TPM2_PT_AUDIT_COUNTER_1: 0x0</font><br><font size="2" face="Calibri"> </font><br><font size="2" face="Calibri">Any insight would be appreciated. </font><br><font size="2" face="Calibri">Thanks!</font><tt><font size="2">_______________________________________________<br>tpm2 mailing list -- <a href="mailto:[email protected]" target="_blank" rel="noreferrer">[email protected]</a><br>To unsubscribe send an email to <a href="mailto:[email protected]" target="_blank" rel="noreferrer">[email protected]</a><br>%(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s</font></tt><br><br><br> <br> </p></div> _______________________________________________<br> tpm2 mailing list -- <a href="mailto:[email protected]" target="_blank" rel="noreferrer">[email protected]</a><br> To unsubscribe send an email to <a href="mailto:[email protected]" target="_blank" rel="noreferrer">[email protected]</a><br> %(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s</blockquote></div>
graycol.gif
(image/gif, 105 B) - not displayed
graycol.gif
(image/gif, 105 B) - not displayed