Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1605752

RE: [tpmdd-devel] [PATCH v3 2/7] tpm: validate TPM 2.0 commands

Show all headers | View raw

> > There are a few special cases that need some thought though. For
> > example, it is possible to use an upgrade to switch the TPM family
> > from 1.2 to 2.0 (or vice versa). In this case it seems useful to let
> > the kernel reinitialize the TPM driver, so it uses the correct
> > timeouts for communication, activates the correct features (resource
> > manager or not?), etc., without needing to reboot the system.
> 
> In practice, would a TPM upgrade from TPM 1.2 to TPM 2.0 even occur
> without a reboot?  Is it an important use case?
> 
> 1 - It would leave the SHA-256 PCRs in the reset state.
> 
> 2 - It's possible that this upgrade would also require a BIOS upgrade.

For a traditional PC and when your goal is platform integrity, a reboot is probably the way to go. But in an embedded environment where there is no BIOS or if you use the TPM more like a smartcard just to store some keys (or generate random numbers), a reboot is unnecessary and it is more comfortable to avoid it.

We probably should inform the kernel before the upgrade anyway, so that it can shut down the TPM gracefully (and maybe switch to the upgrade mode, as Jason suggested). With that infrastructure in place, it does not seem like a lot of effort to also let it switch the TPM back to normal operation mode once the upgrade is complete.

Alexander

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

RE: [tpmdd-devel] [PATCH v3 2/7] tpm: validate TPM 2.0 commands <Alexander.Steffen@infineon.com> - 2017-03-17 17:00 +0100
  Re: [tpmdd-devel] [PATCH v3 2/7] tpm: validate TPM 2.0 commands Jason Gunthorpe <jgunthorpe@obsidianresearch.com> - 2017-03-17 17:20 +0100
    RE: [tpmdd-devel] [PATCH v3 2/7] tpm: validate TPM 2.0 commands <Peter.Huewe@infineon.com> - 2017-03-17 17:40 +0100
      RE: [tpmdd-devel] [PATCH v3 2/7] tpm: validate TPM 2.0 commands <Alexander.Steffen@infineon.com> - 2017-03-20 11:00 +0100
        Re: [tpmdd-devel] [PATCH v3 2/7] tpm: validate TPM 2.0 commands Jason Gunthorpe <jgunthorpe@obsidianresearch.com> - 2017-03-20 18:30 +0100
        Re: [tpmdd-devel] [PATCH v3 2/7] tpm: validate TPM 2.0 commands Ken Goldman <kgold@linux.vnet.ibm.com> - 2017-03-20 23:50 +0100
          RE: [tpmdd-devel] [PATCH v3 2/7] tpm: validate TPM 2.0 commands <Alexander.Steffen@infineon.com> - 2017-03-21 17:00 +0100
  Re: [tpmdd-devel] [PATCH v3 2/7] tpm: validate TPM 2.0 commands Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> - 2017-03-17 21:50 +0100
    RE: [tpmdd-devel] [PATCH v3 2/7] tpm: validate TPM 2.0 commands <Alexander.Steffen@infineon.com> - 2017-03-20 11:00 +0100
      Re: [tpmdd-devel] [PATCH v3 2/7] tpm: validate TPM 2.0 commands Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> - 2017-03-27 07:30 +0200

csiph-web