Ubuntu – TPM 2.0 on Debian/Ubuntu

driverskerneltpm

We are running one of the newest Intel NUCs with TPM 2.0 chip (what the vendor is, I haven't been able to figure out). At the moment I am just trying to load the drivers to get it visible to the system, but no dice so far

I have tried Linux Kernels 3.2, 3.16 and 4.2. According to kernelnewbies kernel 4.0 is when TPM 2.0 drivers were introduced.

My current steps to load drivers:

ls -la /lib/modules/`uname -r`/kernel/drivers/char/tpm to list available tpm drivers
modprobe <items from above>. Plenty of people say that tpm_tis is the only thing they needed, but no dice for me
Checking /sys/class/tpm on 4.* and /sys/class/misc/on 3.* for tpm0 hardware
Running tcsd -f just gives me a communication error
Triple checked the BIOS to see if TPM is enabled. It was actually enabled out of the box which apparently it isn't supposed to be?

Output of ls -la /lib/modules/`uname -r`/kernel/drivers/char/tpm:

total 248
drwxr-xr-x 3 root root  4096 Dec 10 18:38 .
drwxr-xr-x 7 root root  4096 Dec 10 18:38 ..
drwxr-xr-x 2 root root  4096 Dec 10 18:38 st33zp24
-rw-r--r-- 1 root root 10984 Nov 18 05:26 tpm_atmel.ko
-rw-r--r-- 1 root root 11760 Nov 18 05:26 tpm_crb.ko
-rw-r--r-- 1 root root 11160 Nov 18 05:26 tpm_i2c_atmel.ko
-rw-r--r-- 1 root root 14904 Nov 18 05:26 tpm_i2c_infineon.ko
-rw-r--r-- 1 root root 20816 Nov 18 05:26 tpm_i2c_nuvoton.ko
-rw-r--r-- 1 root root 24808 Nov 18 05:26 tpm_infineon.ko
-rw-r--r-- 1 root root 66552 Nov 18 05:26 tpm.ko
-rw-r--r-- 1 root root 15784 Nov 18 05:26 tpm_nsc.ko
-rw-r--r-- 1 root root 31624 Nov 18 05:26 tpm_tis.ko
-rw-r--r-- 1 root root 14072 Nov 18 05:26 xen-tpmfront.ko

Any additional steps / direction / tips would be greatly appreciated.

Update

I managed to get 4.4 kernel installed, it manages to load up drivers (I see tpm0 in /sys/class/tpm/tpm0 now). But running tcsd -f give me the following error:

TCSD TDDL ioctl: (25) Inappropriate ioctl for device
TCSD TDDL Falling back to Read/Write device support.
TCSD TCS ERROR: TCS GetCapability failed with result = 0x1e

Also to make sure that I have the latest version of Trousers I compiled that from source as well, still no dice. One thing I have noticed is that inside tpm0 there is no pcrs file

Best Answer

I Think your tpm is working (check it with dmesg | grep -i tpm) but tpm-tools is only compatible with tpm 1.2 devices (source).

Some new projects exists, may they help us:

IBM: http://sourceforge.net/projects/ibmtpm20tss/
Intel: https://github.com/01org/TPM2.0-TSS
TSS2 based tpm2-tools: https://github.com/01org/tpm2.0-tools

Related Solutions

Ubuntu – Does Ubuntu use TPM 2.0 chip

The Trusted Platform Module TPM offers facilities for the secure generation of cryptographic keys, and limitation of their use, in addition to a random number generator. It also includes capabilities such as remote attestation and sealed storage.

source

TPM is disabled by default unless you want to use it. To enable do the following:

First login as root

> sudo -s

and install Trousers and the TPM Tools:

> apt-get install tpm-tools trousers

Head to the directory where the Kernel modules are located /lib/modules/#.x.y-z-generic/kernel/drivers/char/tpm, there you'll find the modules you need:

ls -la /lib/modules/`uname -r`/kernel/drivers/char/tpm
total 116
drwxr-xr-x 2 root root  4096 Feb  3 07:00 .
drwxr-xr-x 8 root root  4096 Feb  3 07:00 ..
-rw-r--r-- 1 root root 12248 Jan 30 19:54 tpm_atmel.ko
-rw-r--r-- 1 root root 18104 Jan 30 19:54 tpm_i2c_infineon.ko
-rw-r--r-- 1 root root 24864 Jan 30 19:54 tpm_infineon.ko
-rw-r--r-- 1 root root 13496 Jan 30 19:54 tpm_nsc.ko
-rw-r--r-- 1 root root 30344 Jan 30 19:54 tpm_tis.ko

For my machine it was sufficient to load tpm_tis.ko.

> modprobe tpm_tis.ko

Now you should "see" the TPM (tpm0) in /sys/class/misc/ and be able to print the PCRs

> cat /sys/class/misc/tpm0/device/pcrs
PCR-00: xx 82 F8 37 D6 83 21 56 ff F7 FB 94 25 D8 7A 38 47 57 BF 83
PCR-01: yy 93 6D 55 81 BE 16 99 ff 88 DA D1 D9 B5 67 53 54 A7 41 71
PCR-02: zz DE 58 4D CE F0 3F 6A ff AC 1A 24 0A 83 58 93 89 6F 21 8D
PCR-03: aa 3F 78 0F 11 A4 B4 99 ff FC AA 80 CD 6E 39 57 C3 3B 22 75
PCR-04: bb 0B 67 73 D3 6F B5 AD ff 11 F5 43 C5 DA 92 C9 D4 69 E4 33

If tpm_tis doesn't work on your machine, simply use trial and error for finding the right module. You can't damage stuff. Btw: if you like to load the Kernel module automatically, edit /etc/modules and add "tpm_tis" to the list of modules.

If you've got the right module loaded, start the tcsd. Notice: unlike to other distributions you can't invoke the tcsd in Ubuntu by

> /etc/init.d/tcsd start

You need to type

> tcsd

If you like some debugging info, add -f:

> tcsd -f

Now you're ready to go:

> tpm_version
TPM 1.2 Version Info:
Chip Version:        1.2.11.5
Spec Level:          2
Errata Revision:     0
TPM Vendor ID:       ATML
TPM Version:         01010000
Manufacturer Info:   41544d4c

Now you can take ownership of your TPM:

> tpm_takeownership
Enter owner password: OWNERPASS
Confirm password: OWNERPASS
Enter SRK password: SRKPASS
Confirm password: SRKPASS

more information how to use TPM in linux is founded here and here.

Ubuntu – The TPM 2.0 update

To install the update, you have to clear TPM owner information. In order to do that, go to the BIOS (press F2 during boot), open Settings -> Security -> TPM 2.0 Security. Check Clear option and confirm your action. Once owner information is cleared install the update again. This time it should finish successfully.

Just please note that your system may keep important data in TPM module (as for example, a password to your hard disk) and once you clear it you may lost access to your files...

Best Answer

Related Solutions

Ubuntu – Does Ubuntu use TPM 2.0 chip

Ubuntu – The TPM 2.0 update

Related Question