9

Wanting to play around with Trusted Platform Module stuff, I installed TrouSerS and tried to start tcsd, but I got this error:

TCSD TDDL ERROR: Could not find a device to open!

However, my kernel has multiple TPM modules loaded:

# lsmod | grep tpm
tpm_crb                16384  0
tpm_tis                16384  0
tpm_tis_core           20480  1 tpm_tis
tpm                    40960  3 tpm_tis,tpm_crb,tpm_tis_core

So, how do I determine if my computer is lacking TPM vs TrouSerS having a bug?

Neither dmidecode nor cpuid output anything about "tpm" or "trust". Looking in /var/log/messages, on the one hand I see rngd: /dev/tpm0: No such file or directory, but on the other hand I see kernel: Initialise system trusted keyrings and according to this kernel doc trusted keys use TPM.

EDIT: My computer's BIOS setup menus mention nothing about TPM.

Also, looking at /proc/keys:

# cat /proc/keys 
******** I--Q---     1 perm 1f3f0000     0 65534 keyring   _uid_ses.0: 1
******** I--Q---     7 perm 3f030000     0     0 keyring   _ses: 1
******** I--Q---     3 perm 1f3f0000     0 65534 keyring   _uid.0: empty
******** I------     2 perm 1f0b0000     0     0 keyring   .builtin_trusted_keys: 1
******** I------     1 perm 1f0b0000     0     0 keyring   .system_blacklist_keyring: empty
******** I------     1 perm 1f0f0000     0     0 keyring   .secondary_trusted_keys: 1
******** I------     1 perm 1f030000     0     0 asymmetri Fedora kernel signing key: 34ae686b57a59c0bf2b8c27b98287634b0f81bf8: X509.rsa b0f81bf8 []
  • Is there an option in your BIOS setup for enabling / disabling TPM? Even if you can't disable it there may be information here about TPM regardless. – airhuff Feb 1 '17 at 1:04
  • Ah, no, I checked and BIOS had nothing about TPM. I'll add that. – Matthew Cline Feb 1 '17 at 1:04
  • 1
    The TPM is typically described by the ACPI tables set up by the bios. If dmesg | grep -w tpm doesn't give messages about initializing a tpm then you haven't got one which is recognised by the kernel. Most laptops and desktops don't have TPMs, they are pretty standard on machines sold as servers (i.e. things big enough to run IPMI), and also on chromebooks where they are part of the security story. – icarus Feb 1 '17 at 1:17
  • 1
    To play, ibm developed a soft tpm you can compile and run, and there is also this easier to use emulator. – meuh Feb 1 '17 at 10:31
12

TPMs don't necessarily appear in the ACPI tables, but the modules do print a message when they find a supported module; for example

[  134.026892] tpm_tis 00:08: 1.2 TPM (device-id 0xB, rev-id 16)

So dmesg | grep -i tpm is a good indicator.

The definitive indicator is your firmware's setup tool: TPMs involve ownership procedures which are managed from the firmware setup. If your setup doesn't mention anything TPM-related then you don't have a TPM.

TPMs are usually found in servers and business laptops (and ChromeBooks, as explained by icarus), they're rare in desktops or "non-business" laptops. Anything supporting Intel TXT has a TPM.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.