Max and Burak,
Sorry for the delay in responding (especially to Burak whose much
earlier posting we missed). We don't have an Infineon TPM here to test
with, but the root cause of this error isn't specific to the TPM mfgr.
and we did verify it on our v1.2 TPMs. Attached and inline is a patch
(including Vinnie's existing one) that should fix this problem. You
should delete your /var/vtpm/VTPM file before re-running, but you don't
need to reset your owner.
Let me know how it works. If this solves your problem then I will work
up an official patch that can support both v1.1b and v1.2 TPMs (this
patch will only work with v1.2 TPMs).
Vinnie Scarlata deserves all of the credit for root causing this and
providing the fix.
Joe
Patch:
diff -r 15ff55aab051 tools/vtpm_manager/manager/vtpm_manager.c
--- a/tools/vtpm_manager/manager/vtpm_manager.c Mon Mar 05 15:15:03 2007
-0800
+++ b/tools/vtpm_manager/manager/vtpm_manager.c Thu Apr 05 10:23:46 2007
-0700
@@ -90,22 +90,19 @@ TPM_RESULT VTPM_Create_Manager(){
CRYPTO_INFO ek_cryptoInfo;
status = VTSP_ReadPubek(vtpm_globals->manager_tcs_handle,
&ek_cryptoInfo);
-
+
// If we can read PubEK then there is no owner and we should take it.
// We use the abilty to read the pubEK to flag that the TPM is owned.
// FIXME: Change to just trying to take ownership and react to the
status
if (status == TPM_SUCCESS) {
- TPMTRYRETURN(VTSP_TakeOwnership(vtpm_globals->manager_tcs_handle,
- (const
TPM_AUTHDATA*)&vtpm_globals->owner_usage_auth,
- &SRK_AUTH,
- &ek_cryptoInfo,
- &vtpm_globals->keyAuth));
-
-
TPMTRYRETURN(VTSP_DisablePubekRead(vtpm_globals->manager_tcs_handle,
- (const
TPM_AUTHDATA*)&vtpm_globals->owner_usage_auth,
- &vtpm_globals->keyAuth));
- } else {
- vtpmloginfo(VTPM_LOG_VTPM, "Failed to readEK meaning TPM has an
owner. Creating Keys off existing SRK.\n");
+ status = VTSP_TakeOwnership(vtpm_globals->manager_tcs_handle,
+ (const
TPM_AUTHDATA*)&vtpm_globals->owner_usage_auth,
+ &SRK_AUTH,
+ &ek_cryptoInfo,
+ &vtpm_globals->keyAuth);
+ }
+ if (status != TPM_SUCCESS) {
+ vtpmloginfo(VTPM_LOG_VTPM, "TPM has an owner. Creating Keys off
existing SRK.\n");
}
// Generate storage key's auth
diff -r 15ff55aab051 tools/vtpm_manager/manager/vtsp.c
--- a/tools/vtpm_manager/manager/vtsp.c Mon Mar 05 15:15:03 2007 -0800
+++ b/tools/vtpm_manager/manager/vtsp.c Thu Apr 05 10:24:01 2007 -0700
@@ -596,7 +596,7 @@ TPM_RESULT VTSP_LoadKey(const TCS_CONTEX
vtpmloginfo(VTPM_LOG_VTSP, "Loading Key %s.\n", (!skipTPMLoad ? "into
TPM" : "only into memory"));
TPM_RESULT status = TPM_SUCCESS;
- TPM_COMMAND_CODE command = TPM_ORD_LoadKey;
+ TPM_COMMAND_CODE command = TPM_ORD_LoadKey2;
BYTE *paramText=NULL; // Digest to make Auth.
UINT32 paramTextSize;
@@ -634,10 +634,9 @@ TPM_RESULT VTSP_LoadKey(const TCS_CONTEX
&phKeyHMAC) );
// Verify Auth
- paramTextSize = BSG_PackList(paramText, 3,
+ paramTextSize = BSG_PackList(paramText, 2,
BSG_TPM_RESULT, &status,
- BSG_TPM_COMMAND_CODE, &command,
- BSG_TPM_HANDLE, newKeyHandle);
+ BSG_TPM_COMMAND_CODE, &command);
TPMTRYRETURN( VerifyAuth( paramText, paramTextSize,
parentAuth, auth,
diff -r 15ff55aab051 tools/vtpm_manager/tcs/tcs.c
--- a/tools/vtpm_manager/tcs/tcs.c Mon Mar 05 15:15:03 2007 -0800
+++ b/tools/vtpm_manager/tcs/tcs.c Thu Apr 05 10:24:12 2007 -0700
@@ -901,7 +901,7 @@ TPM_RESULT TCSP_LoadKeyByBlob(TCS_CONTEX
// setup input/output parameters block
TPM_TAG tag = TPM_TAG_RQU_AUTH1_COMMAND;
UINT32 paramSize = 0;
- TPM_COMMAND_CODE ordinal = TPM_ORD_LoadKey;
+ TPM_COMMAND_CODE ordinal = TPM_ORD_LoadKey2;
TPM_RESULT returnCode = TPM_SUCCESS;
// setup the TPM driver input and output buffers
diff -r 15ff55aab051 tools/vtpm_manager/util/tcg.h
--- a/tools/vtpm_manager/util/tcg.h Mon Mar 05 15:15:03 2007 -0800
+++ b/tools/vtpm_manager/util/tcg.h Thu Apr 05 10:24:24 2007 -0700
@@ -250,6 +250,7 @@ typedef struct pack_constbuf_t {
#define TPM_ORD_ReadManuMaintPub (48UL + TPM_PROTECTED_ORDINAL)
#define TPM_ORD_CertifyKey (50UL + TPM_PROTECTED_ORDINAL)
#define TPM_ORD_Sign (60UL + TPM_PROTECTED_ORDINAL)
+#define TPM_ORD_LoadKey2 (65UL + TPM_PROTECTED_ORDINAL)
#define TPM_ORD_GetRandom (70UL + TPM_PROTECTED_ORDINAL)
#define TPM_ORD_StirRandom (71UL + TPM_PROTECTED_ORDINAL)
#define TPM_ORD_SelfTestFull (80UL + TPM_PROTECTED_ORDINAL)
________________________________
From: xense-devel-bounces@xxxxxxxxxxxxxxxxxxx
[mailto:xense-devel-bounces@xxxxxxxxxxxxxxxxxxx] On Behalf Of Maximilian
Loy
Sent: Monday, March 26, 2007 4:40 AM
To: xense-devel@xxxxxxxxxxxxxxxxxxx
Subject: [Xense-devel] vtpm_managerd problem with Infineon TPM
1.2
Hi everybody,
i am having problems to get the vtpm_managerd (Xen 3.0.4.1) to
work with the Infineon TPM 1.2 (platform is a HP nx6325).
I was having the BAD_ORDINAL problems like discussed earlier on
this list, but i could solve them with applying the patch from:
http://lists.xensource.com/archives/html/xense-devel/2006-12/msg00020.ht
ml
This resulted in TPM_AUTHFAIL like in
http://lists.xensource.com/archives/html/xense-devel/2006-12/msg00024.ht
ml
giving me the following output after taking the ownership:
...
INFO[VTSP]: Loading Key into TPM.
ERROR[TCS]: TCSP_LoadKeyByBlob Failed with return code
TPM_AUTHFAIL
ERROR in VTSP_LoadKey at vtsp.c:634 code: TPM_AUTHFAIL.
ERROR in VTPM_Init_Manager at vtpm_manager.c:240 code:
TPM_AUTHFAIL.
ERROR[VTPM]: Closing vtpmd due to error during startup.
Maybe it has something to do with the patch, as the line 634 in
vtsp.c has been modified by it.
Any help would be very appreciated!
Best regards, Max
vtpm-12-patch.diff
Description: vtpm-12-patch.diff
_______________________________________________
Xense-devel mailing list
Xense-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xense-devel
|
Home