[tpm2] Re: tpm2_nvdefine fails with inconsistent attributes...
Kenneth Goldman <kgoldman at us.ibm.com>
| Newsgroups | dev.linux.lists.tpm2 |
|---|---|
| Message-ID | <BN8PR15MB2753226B88CC20D89DE7E23EF2509@BN8PR15MB2753.namprd15.prod.outlook.com> |
Correct. Unless you are the platform firmware, you don't typically have access to the platform hierarchy. It's reserved for use of the platform OEM. Post-OS applications use either the storage or endorsement hierarchy. From: Steven Clark <davolfman(a)gmail.com> Sent: Monday, January 10, 2022 4:09 PM To: Kenneth Goldman <kgoldman(a)us.ibm.com> Cc: Sievert, James <james.sievert(a)bsci.com>; tpm2 <tpm2(a)lists.01.org> Subject: [EXTERNAL] Re: [tpm2] Re: tpm2_nvdefine fails with inconsistent attributes... might also just be attempting to use platform authorization on real hardware while not being the system firmware. UEFI tends to lock out the platform on every boot because that's what it's supposed to do? On Fri, Dec 3, 2021, 6:52 ZjQcmQRYFpfptBannerStart It might also just be attempting to use platform authorization on real hardware while not being the system firmware. UEFI tends to lock out the platform on every boot because that's what it's supposed to do? On Fri, Dec 3, 2021, 6:52 AM Kenneth Goldman <kgoldman(a)us.ibm.com<mailto:kgoldman(a)us.ibm.com>> wrote: My guess is that you do not set the TPMA_NVA_PLATFORMCREATE attribute. The IBM utility sets it for you when the platform hierarchy authorizes the command, since it must be set. -- Ken Goldman kgoldman(a)us.ibm.com<mailto:kgoldman(a)us.ibm.com> 914-945-2415 (862-2415) [Inactive hide details for "Sievert, James" ---12/03/2021 09:37:25 AM---Hi, I’m using tpm2-tools 4.1.1 on Ubuntu 20.04. I’m i]"Sievert, James" ---12/03/2021 09:37:25 AM---Hi, I’m using tpm2-tools 4.1.1 on Ubuntu 20.04. I’m issuing the following command which is returnin From: "Sievert, James" <james.sievert(a)bsci.com<mailto:james.sievert(a)bsci.com>> To: "tpm2(a)lists.01.org<mailto:tpm2(a)lists.01.org>" <tpm2(a)lists.01.org<mailto:tpm2(a)lists.01.org>> Date: 12/03/2021 09:37 AM Subject: [EXTERNAL] [tpm2] tpm2_nvdefine fails with inconsistent attributes... ________________________________ Hi, I’m using tpm2-tools 4.1.1 on Ubuntu 20.04. I’m issuing the following command which is returning an inconsistent attributes error: bsci(a)ip-10-132-42-225:~$ tpm2_nvdefine 0x1000025 -C p -s 1 Hi, I’m using tpm2-tools 4.1.1 on Ubuntu 20.04. I’m issuing the following command which is returning an inconsistent attributes error: bsci(a)ip-10-132-42-225:~$ tpm2_nvdefine 0x1000025 -C p -s 1 WARNING:esys:src/tss2-esys/api/Esys_NV_DefineSpace.c:333:Esys_NV_DefineSpace_Finish() Received TPM Error ERROR:esys:src/tss2-esys/api/Esys_NV_DefineSpace.c:122:Esys_NV_DefineSpace() Esys Finish ErrorCode (0x00000182) ERROR: Failed to define NV area at index 0x1000025 ERROR: Esys_NV_DefineSpace(0x182) - tpm:handle(1):inconsistent attributes ERROR: Unable to run tpm2_nvdefine and yes, I am attempting to define the index using the platform hierarchy. ? This does work using the IBM utilities. Here are the current properties: bsci(a)ip-10-132-42-225:~$ tpm2_getcap properties-variable TPM2_PT_PERSISTENT: ownerAuthSet: 0 endorsementAuthSet: 0 lockoutAuthSet: 0 reserved1: 0 disableClear: 0 inLockout: 0 tpmGeneratedEPS: 0 reserved2: 0 TPM2_PT_STARTUP_CLEAR: phEnable: 1 shEnable: 1 ehEnable: 1 phEnableNV: 1 reserved1: 0 orderly: 0 TPM2_PT_HR_NV_INDEX: 0x6 TPM2_PT_HR_LOADED: 0x0 TPM2_PT_HR_LOADED_AVAIL: 0x3 TPM2_PT_HR_ACTIVE: 0x0 TPM2_PT_HR_ACTIVE_AVAIL: 0x40 TPM2_PT_HR_TRANSIENT_AVAIL: 0x3 TPM2_PT_HR_PERSISTENT: 0x0 TPM2_PT_HR_PERSISTENT_AVAIL: 0x11 TPM2_PT_NV_COUNTERS: 0x0 TPM2_PT_NV_COUNTERS_AVAIL: 0xD TPM2_PT_ALGORITHM_SET: 0x0 TPM2_PT_LOADED_CURVES: 0x2 TPM2_PT_LOCKOUT_COUNTER: 0x0 TPM2_PT_MAX_AUTH_FAIL: 0x20 TPM2_PT_LOCKOUT_INTERVAL: 0x1C20 TPM2_PT_LOCKOUT_RECOVERY: 0x15180 TPM2_PT_AUDIT_COUNTER_0: 0x0 TPM2_PT_AUDIT_COUNTER_1: 0x0 Any insight would be appreciated. Thanks!_______________________________________________ tpm2 mailing list -- tpm2(a)lists.01.org<mailto:tpm2(a)lists.01.org> To unsubscribe send an email to tpm2-leave(a)lists.01.org<mailto:tpm2-leave(a)lists.01.org> %(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s _______________________________________________ tpm2 mailing list -- tpm2(a)lists.01.org<mailto:tpm2(a)lists.01.org> To unsubscribe send an email to tpm2-leave(a)lists.01.org<mailto:tpm2-leave(a)lists.01.org> %(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s
attachment.htm
(text/html, 12.3 KB)
<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Segoe UI Emoji";
panose-1:2 11 5 2 4 2 4 2 2 3;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
tt
{mso-style-priority:99;
font-family:"Courier New";}
span.pfptpreheader1
{mso-style-name:pfptpreheader1;
display:none;}
span.EmailStyle36
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Correct. Unless you are the platform firmware, you don't typically have access to the platform hierarchy. It's reserved for use of the platform OEM.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Post-OS applications use either the storage or endorsement hierarchy.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt">
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> Steven Clark <[email protected]> <br>
<b>Sent:</b> Monday, January 10, 2022 4:09 PM<br>
<b>To:</b> Kenneth Goldman <[email protected]><br>
<b>Cc:</b> Sievert, James <[email protected]>; tpm2 <[email protected]><br>
<b>Subject:</b> [EXTERNAL] Re: [tpm2] Re: tpm2_nvdefine fails with inconsistent attributes...<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><span class="pfptpreheader1"><span style="font-size:1.0pt;color:white">might also just be attempting to use platform authorization on real hardware while not being the system firmware. UEFI tends to lock out the platform on every boot because
that's what it's supposed to do? On Fri, Dec 3, 2021, 6:52 </span></span><span style="font-size:1.0pt;color:white">ZjQcmQRYFpfptBannerStart</span>
<o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:1.0pt;color:white"><br>
<br>
</span><o:p></o:p></p>
<div>
<p class="MsoNormal">It might also just be attempting to use platform authorization on real hardware while not being the system firmware. UEFI tends to lock out the platform on every boot because that's what it's supposed to do?<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Fri, Dec 3, 2021, 6:52 AM Kenneth Goldman <<a href="mailto:[email protected]">[email protected]</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<p><span style="font-size:10.0pt;font-family:"Arial",sans-serif">My guess is that you do not set the TPMA_NVA_PLATFORMCREATE attribute.</span><br>
<br>
<span style="font-size:10.0pt;font-family:"Arial",sans-serif">The IBM utility sets it for you when the platform hierarchy authorizes the command, since it must be set.<br>
<br>
--<br>
Ken Goldman <a href="mailto:[email protected]" target="_blank">[email protected]</a>
<br>
914-945-2415 (862-2415)<br>
</span><br>
<br>
<img border="0" width="16" height="16" style="width:.1666in;height:.1666in" id="_x0000_i1027" src="cid:[email protected]" alt="Inactive hide details for "Sievert, James" ---12/03/2021 09:37:25 AM---Hi, I’m using tpm2-tools 4.1.1 on Ubuntu 20.04. I’m i"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#424282">"Sievert,
James" ---12/03/2021 09:37:25 AM---Hi, I’m using tpm2-tools 4.1.1 on Ubuntu 20.04. I’m issuing the following command which is returnin</span><br>
<br>
<span style="font-size:7.5pt;font-family:"Arial",sans-serif;color:#5F5F5F">From: </span>
<span style="font-size:7.5pt;font-family:"Arial",sans-serif">"Sievert, James" <<a href="mailto:[email protected]" target="_blank">[email protected]</a>></span><br>
<span style="font-size:7.5pt;font-family:"Arial",sans-serif;color:#5F5F5F">To: </span>
<span style="font-size:7.5pt;font-family:"Arial",sans-serif">"<a href="mailto:[email protected]" target="_blank">[email protected]</a>" <<a href="mailto:[email protected]" target="_blank">[email protected]</a>></span><br>
<span style="font-size:7.5pt;font-family:"Arial",sans-serif;color:#5F5F5F">Date: </span>
<span style="font-size:7.5pt;font-family:"Arial",sans-serif">12/03/2021 09:37 AM</span><br>
<span style="font-size:7.5pt;font-family:"Arial",sans-serif;color:#5F5F5F">Subject:
</span><span style="font-size:7.5pt;font-family:"Arial",sans-serif">[EXTERNAL] [tpm2] tpm2_nvdefine fails with inconsistent attributes...</span><o:p></o:p></p>
<div class="MsoNormal">
<hr size="1" width="100%" noshade="" style="color:#8091A5" align="left">
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
<br>
<br>
<span style="font-size:7.5pt;font-family:"Times New Roman",serif;color:white">Hi, I’m using tpm2-tools 4.1.1 on Ubuntu 20.04. I’m issuing the following command which is returning an inconsistent attributes error: bsci@ip-10-132-42-225:~$ tpm2_nvdefine 0x1000025
-C p -s 1 </span><br>
<span style="font-size:10.0pt">Hi,</span><br>
<span style="font-size:10.0pt"> </span><br>
<span style="font-size:10.0pt">I’m using tpm2-tools 4.1.1 on Ubuntu 20.04. I’m issuing the following command which is returning an inconsistent attributes error:</span><br>
<span style="font-size:10.0pt"> </span><br>
<span style="font-size:10.0pt">bsci@ip-10-132-42-225:~$ tpm2_nvdefine 0x1000025 -C p -s 1</span><br>
<span style="font-size:10.0pt">WARNING:esys:src/tss2-esys/api/Esys_NV_DefineSpace.c:333:Esys_NV_DefineSpace_Finish() Received TPM Error</span><br>
<span style="font-size:10.0pt">ERROR:esys:src/tss2-esys/api/Esys_NV_DefineSpace.c:122:Esys_NV_DefineSpace() Esys Finish ErrorCode (0x00000182)</span><br>
<span style="font-size:10.0pt">ERROR: Failed to define NV area at index 0x1000025</span><br>
<span style="font-size:10.0pt">ERROR: Esys_NV_DefineSpace(0x182) - tpm:handle(1):inconsistent attributes</span><br>
<span style="font-size:10.0pt">ERROR: Unable to run tpm2_nvdefine</span><br>
<span style="font-size:10.0pt"> </span><br>
<span style="font-size:10.0pt">and yes, I am attempting to define the index using the platform hierarchy. </span><span style="font-size:10.0pt;font-family:"Segoe UI Emoji",sans-serif">?</span><span style="font-size:10.0pt"> This does work using the IBM utilities.
</span><br>
<span style="font-size:10.0pt"> </span><br>
<span style="font-size:10.0pt">Here are the current properties:</span><br>
<span style="font-size:10.0pt"> </span><br>
<span style="font-size:10.0pt">bsci@ip-10-132-42-225:~$ tpm2_getcap properties-variable</span><br>
<span style="font-size:10.0pt">TPM2_PT_PERSISTENT:</span><br>
<span style="font-size:10.0pt"> ownerAuthSet: 0</span><br>
<span style="font-size:10.0pt"> endorsementAuthSet: 0</span><br>
<span style="font-size:10.0pt"> lockoutAuthSet: 0</span><br>
<span style="font-size:10.0pt"> reserved1: 0</span><br>
<span style="font-size:10.0pt"> disableClear: 0</span><br>
<span style="font-size:10.0pt"> inLockout: 0</span><br>
<span style="font-size:10.0pt"> tpmGeneratedEPS: 0</span><br>
<span style="font-size:10.0pt"> reserved2: 0</span><br>
<span style="font-size:10.0pt">TPM2_PT_STARTUP_CLEAR:</span><br>
<span style="font-size:10.0pt"> phEnable: 1</span><br>
<span style="font-size:10.0pt"> shEnable: 1</span><br>
<span style="font-size:10.0pt"> ehEnable: 1</span><br>
<span style="font-size:10.0pt"> phEnableNV: 1</span><br>
<span style="font-size:10.0pt"> reserved1: 0</span><br>
<span style="font-size:10.0pt"> orderly: 0</span><br>
<span style="font-size:10.0pt">TPM2_PT_HR_NV_INDEX: 0x6</span><br>
<span style="font-size:10.0pt">TPM2_PT_HR_LOADED: 0x0</span><br>
<span style="font-size:10.0pt">TPM2_PT_HR_LOADED_AVAIL: 0x3</span><br>
<span style="font-size:10.0pt">TPM2_PT_HR_ACTIVE: 0x0</span><br>
<span style="font-size:10.0pt">TPM2_PT_HR_ACTIVE_AVAIL: 0x40</span><br>
<span style="font-size:10.0pt">TPM2_PT_HR_TRANSIENT_AVAIL: 0x3</span><br>
<span style="font-size:10.0pt">TPM2_PT_HR_PERSISTENT: 0x0</span><br>
<span style="font-size:10.0pt">TPM2_PT_HR_PERSISTENT_AVAIL: 0x11</span><br>
<span style="font-size:10.0pt">TPM2_PT_NV_COUNTERS: 0x0</span><br>
<span style="font-size:10.0pt">TPM2_PT_NV_COUNTERS_AVAIL: 0xD</span><br>
<span style="font-size:10.0pt">TPM2_PT_ALGORITHM_SET: 0x0</span><br>
<span style="font-size:10.0pt">TPM2_PT_LOADED_CURVES: 0x2</span><br>
<span style="font-size:10.0pt">TPM2_PT_LOCKOUT_COUNTER: 0x0</span><br>
<span style="font-size:10.0pt">TPM2_PT_MAX_AUTH_FAIL: 0x20</span><br>
<span style="font-size:10.0pt">TPM2_PT_LOCKOUT_INTERVAL: 0x1C20</span><br>
<span style="font-size:10.0pt">TPM2_PT_LOCKOUT_RECOVERY: 0x15180</span><br>
<span style="font-size:10.0pt">TPM2_PT_AUDIT_COUNTER_0: 0x0</span><br>
<span style="font-size:10.0pt">TPM2_PT_AUDIT_COUNTER_1: 0x0</span><br>
<span style="font-size:10.0pt"> </span><br>
<span style="font-size:10.0pt">Any insight would be appreciated. </span><br>
<span style="font-size:10.0pt">Thanks!</span><tt><span style="font-size:10.0pt">_______________________________________________</span></tt><span style="font-size:10.0pt;font-family:"Courier New""><br>
<tt>tpm2 mailing list -- <a href="mailto:[email protected]" target="_blank">[email protected]</a></tt><br>
<tt>To unsubscribe send an email to <a href="mailto:[email protected]" target="_blank">
[email protected]</a></tt><br>
<tt>%(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s</tt></span><br>
<br>
<br>
<o:p></o:p></p>
</div>
<p class="MsoNormal">_______________________________________________<br>
tpm2 mailing list -- <a href="mailto:[email protected]" target="_blank">[email protected]</a><br>
To unsubscribe send an email to <a href="mailto:[email protected]" target="_blank">
[email protected]</a><br>
%(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s<o:p></o:p></p>
</blockquote>
</div>
</div>
</div>
</body>
</html>