From: Stefan Berger <stefanb@linux.ibm.com>
To: linux-integrity <linux-integrity@vger.kernel.org>,
James Bottomley <James.Bottomley@HansenPartnership.com>
Cc: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Subject: Stalled /dev/tpmr0 when context size increases to support RSA 3072 bit keys
Date: Tue, 16 Jun 2020 18:30:24 -0400 [thread overview]
Message-ID: <b404211d-f540-d2bd-eaf6-2b616bebb899@linux.ibm.com> (raw)
I am upgrading libtpms's TPM 2 to support RSA 3072 keys (increase
context size to 2680 bytes) and wanted to test an upgrade from previous
version (0.7.2) which only supports RSA 2048 keys to this newer version
(git master). I tried to run this with clevis setting up automatic
decryption via TPM 2, but it doesn't work and it seems the issue is due
to a stall of /dev/tpmr0 that doesn't respond anymore.
So here's a simple sequence with added 'set -x' into clevis-encrypt-tpm2
and clevis-decrypt-tpm2:
All good in the encryption part:
[root@localhost ~]# echo hi | clevis encrypt tpm2 '{"key":"rsa"}' >
hi-rsa3072.jwe
+ case "$TPM2TOOLS_VERSION" in
+ tpm2_createprimary -Q -C o -g sha256 -G rsa -c
/tmp/tmp.cqg0DMjuL4/primary.context
+ set +x
+ case "$TPM2TOOLS_VERSION" in
+ tpm2_create -Q -g sha256 -C /tmp/tmp.cqg0DMjuL4/primary.context -u
/tmp/tmp.cqg0DMjuL4/jwk.pub -r /tmp/tmp.cqg0DMjuL4/jwk.priv -a
'fixedtpm|fixedparent|noda|adminwithpolicy|userwithauth' -i-
+ set +x
The decryption part stalls:
[root@localhost ~]# clevis decrypt < hi-rsa3072.jwe 2>&1 | tee strace.log
+ case "$TPM2TOOLS_VERSION" in
+ tpm2_createprimary -Q -C o -g sha256 -G rsa -c
/tmp/tmp.9W2U5Fw8HX/primary.context
+ set +x
+ case "$TPM2TOOLS_VERSION" in
+ tpm2_load -Q -C /tmp/tmp.9W2U5Fw8HX/primary.context -u
/tmp/tmp.9W2U5Fw8HX/jwk.pub -r /tmp/tmp.9W2U5Fw8HX/jwk.priv -c
/tmp/tmp.9W2U5Fw8HX/load.context -V
INFO on line: "362" in file: "lib/files.c": Assuming tpm context file
INFO on line: "293" in file: "lib/files.c": load:
TPMS_CONTEXT->savedHandle: 0x80000000
^Z
[1]+ Stopped clevis decrypt < hi-rsa3072.jwe 2>&1 | tee
strace.log
Note: I put the tool in the background using ctrl-Z and now I can run
this stalled command and it works!
[root@localhost ~]# tpm2_load -Q -C /tmp/tmp.9W2U5Fw8HX/primary.context
-u /tmp/tmp.9W2U5Fw8HX/jwk.pub -r /tmp/tmp.9W2U5Fw8HX/jwk.priv -c
load.context -V
INFO on line: "362" in file: "lib/files.c": Assuming tpm context file
INFO on line: "293" in file: "lib/files.c": load:
TPMS_CONTEXT->savedHandle: 0x80000000
INFO on line: "190" in file: "lib/files.c": Save
TPMS_CONTEXT->savedHandle: 0x80000000
I know that the above is stalled because I had strace'd it:
openat(AT_FDCWD, "/dev/tpmrm0", O_RDWR|O_NONBLOCK) = 3
[...]
write(3, "\200\1\0\0\0;\0\0\1v@\0\0\7@\0\0\7\0
\316)s\332fV_\177\326\303\221#"..., 59) = 59
poll([{fd=3, events=POLLIN}], 1, -1) = 1 ([{fd=3, revents=POLLIN}])
read(3, "\200\1\0\0\0000\0\0\0\0\2\0\0\0\0
\303cQ\225\0\235F\4-\225:y\353\254\220\247"..., 4096) = 48
openat(AT_FDCWD, "/tmp/tmp.9WItRVOByv/primary.context", O_RDONLY) = 4
fstat(4, {st_mode=S_IFREG|0644, st_size=3036, ...}) = 0
brk(NULL) = 0x55fc8d415000
brk(0x55fc8d436000) = 0x55fc8d436000
read(4,
"\272\334\300\336\0\0\0\1@\0\0\1\200\0\0\0\0\0\0\0\0\0\0B\v\302\0\0\0\0\nr"...,
4096) = 3036
lseek(4, -3036, SEEK_CUR) = 0
write(2, "INFO on line: \"362\" in file: \"li"..., 44INFO on line: "362"
in file: "lib/files.c": ) = 44
write(2, "Assuming tpm context file", 25Assuming tpm context file) = 25
write(2, "\n", 1
) = 1
read(4,
"\272\334\300\336\0\0\0\1@\0\0\1\200\0\0\0\0\0\0\0\0\0\0B\v\302\0\0\0\0\nr"...,
4096) = 3036
write(2, "INFO on line: \"293\" in file: \"li"..., 44INFO on line: "293"
in file: "lib/files.c": ) = 44
write(2, "load: TPMS_CONTEXT->savedHandle:"..., 43load:
TPMS_CONTEXT->savedHandle: 0x80000000) = 43
write(2, "\n", 1
) = 1
write(3,
"\200\1\0\0\n\216\0\0\1a\0\0\0\0\0\0\0B\200\0\0\0@\0\0\1\nr\0@]\234"...,
2702) = 2702
poll([{fd=3, events=POLLIN}], 1, -1) = 1 ([{fd=3, revents=POLLIN}])
read(3, "\200\1\0\0\0\16\0\0\0\0\200\377\377\377", 4096) = 14
close(4) = 0
getpid() = 1591
getpid() = 1591
write(3, "\200\2\0\0\1{\0\0\1W\200\377\377\377\0\0\0I\2\0\0\0\0
\203\33\326qO\214\r\0"..., 379) = 379
poll([{fd=3, events=POLLIN}], 1, -1
It's stuck polling on /dev/tpmrm0.
Any ideas?
Stefan
next reply other threads:[~2020-06-16 22:31 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-06-16 22:30 Stefan Berger [this message]
2020-06-17 16:04 ` Stalled /dev/tpmr0 when context size increases to support RSA 3072 bit keys Stefan Berger
2020-06-19 17:05 ` Stefan Berger
2020-06-23 1:15 ` Jarkko Sakkinen
2020-06-17 23:34 ` Jarkko Sakkinen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=b404211d-f540-d2bd-eaf6-2b616bebb899@linux.ibm.com \
--to=stefanb@linux.ibm.com \
--cc=James.Bottomley@HansenPartnership.com \
--cc=jarkko.sakkinen@linux.intel.com \
--cc=linux-integrity@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.