archive mirror
 help / color / mirror / Atom feed
From: Jason Gunthorpe <>
To: "Denis 'GNUtoo' Carikli" <>
Cc: Paul Menzel <>,
	"Maciej S. Szmigiero" <>,,
Subject: Re: [tpmdd-devel] Regression between Linux 3.16 and 4.8/4.9 on Lenovo X60 with coreboot
Date: Sat, 8 Apr 2017 14:25:09 -0600	[thread overview]
Message-ID: <> (raw)
In-Reply-To: <20170408123651.76f18ba4@second-laptop.localdomain>

On Sat, Apr 08, 2017 at 12:40:25PM +0200, Denis 'GNUtoo' Carikli wrote:

> I am working on it[1]. This commit has not been merged and is a work in
> progress. It is however available in coreboot's gerrit.

How did this work on any kernels if there was no PNP or ACPI entry?

FWIW, I wonder if coreboot is missing the code for wait_startup
in drivers/char/tpm/tpm_tis_core.c. If you don't do that step then
the DID/VID might not read properly.

> So far with it and a recent kernel and the patch mentioned above:
> - The linux driver finds the TPM automatically and doesn't require
>   force=1
> - The driver however still require itpm=1 to fully work: without it the
>   tpm is found, but I wasn't able to read the PCRs.

Unless it is an actual broken intel TPM you should never use
itpm=1. Juding by the log messages, it certainly is not.

Intel mode breaks the driver and removes certain error detection, eg
it may erronously succeed.

It is more likely that the failure to read PCRs reflects reality and
itpm=1 just supresses that error detection.

The TPM may need to be setup (eg cleared, EK generated, p/vflags setup
etc, etc) before it will support PCRs.

Usually the BIOS would do these steps when the TPM is first enabled,
you probably need to do them in userspace instead.

WARNING: Failure to provision the TPM properly before first use
could leave it in 'factory test' mode, which basically means it
doesn't work properly at all.

> - I want to make it work without itpm=1 if possible. I'll test with
>   INTC0102 as it is in the driver in the is_itpm function, and it was
>   also suggested to me by someone on IRC.

Don't do this unless it is actually that TPM.


  reply	other threads:[~2017-04-08 20:25 UTC|newest]

Thread overview: 22+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-04-05 11:03 Maciej S. Szmigiero
2017-04-05 13:36 ` Jarkko Sakkinen
2017-04-06  6:18 ` Paul Menzel
2017-04-06 11:52   ` Maciej S. Szmigiero
2017-04-06 16:55   ` Jason Gunthorpe
2017-04-06 18:26     ` Paul Menzel
2017-04-06 19:10       ` Jason Gunthorpe
2017-04-07 20:13         ` Jarkko Sakkinen
2017-04-07 20:58           ` Paul Menzel
2017-04-09 17:34             ` [Regression Linux 4.11] TPM module not loaded anymore (was: Regression between Linux 3.16 and 4.8/4.9 on Lenovo X60 with coreboot) Paul Menzel
2017-04-11 22:57               ` Jarkko Sakkinen
2017-04-12 15:46                 ` Moore, Robert
2017-04-12 15:52                 ` Moore, Robert
2017-04-12 15:54                 ` Moore, Robert
2017-04-12 21:26                   ` [Regression Linux 4.11] TPM module not loaded anymore Paul Menzel
2017-04-12 21:49                     ` Moore, Robert
2017-04-13  7:19                       ` Paul Menzel
2017-04-06 18:58     ` [tpmdd-devel] Regression between Linux 3.16 and 4.8/4.9 on Lenovo X60 with coreboot Jarkko Sakkinen
2017-04-08 10:40     ` Denis 'GNUtoo' Carikli
2017-04-08 20:25       ` Jason Gunthorpe [this message]
  -- strict thread matches above, loose matches on Subject: below --
2017-04-04 16:29 Paul Menzel
2017-04-04 17:15 ` [tpmdd-devel] " Jason Gunthorpe
2017-04-04 17:44   ` Paul Menzel

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \ \ \ \
    --subject='Re: [tpmdd-devel] Regression between Linux 3.16 and 4.8/4.9 on Lenovo X60 with coreboot' \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).