TPM not working after the mod

[Rawit-git]

The TPM seems to be stuck in MFG mode after the mod. TPM.msc and such claim that it cleared the TPM, but trying to use BitLocker gives me an "internal error detected". In the BIOS the security chip is set to MFG (manufacturing mode) mode, with no other options. Any way to fix this?

[Rawit-git]

I reverted back to 2.60 through IVprep. TPM remained unusable until I cleared the Security Chip from the BIOS. This option appears when you do the following:

• Set a supervisor password;
• Save and boot;
• Turn off machine completely;
• Enter BIOS on cold boot and check the Security Chip section for the option, it will not appear right way;

I reflashed the machine afterwards with the mod. TPM could not be used again by BitLocker. I've tried the steps above to clear the Security Chip, but the option hasn't appeared yet (10+ cold boots).

[n4ru]

Investigating this, but don't hold your breath - might be a side effect of using a custom Lenovo BIOS mod that I might have overlooked. I apologize. Thank you for the information.

[n4ru]

As an aside, you may still use BitLocker with a manually typed password instead of the TPM. If you find any additional information, I'll reopen this thread. For now, it seems like we're stuck unable to use TPM.

[pgera]

I discovered this issue when I did the original PoC. From what I remember, TPM works, but you need to take ownership before the bios is patched. i.e., You can take ownership with a stock bios, but not if it is patched. However, if you provision it in the stock state, the tpm state persists after the mod. I don't use windows or bitlocker, but this can be verified on linux with simple-tpm-pk11.

[pgera]

I should also point out that TPM will work as expected with coreboot. So if you need reliable TPM, coreboot + seabios is always an option. The usability of coreboot across different models and OSes will vary. The nvidia gpu ones are problematic with coreboot, and windows is not as heavily tested.

[n4ru]

Thanks for the information. I'll integrate it into the FAQ.

[pgera]

Btw, I only tested the TPM with the additional patches in that thread that match the signatures and hashes (i.e., the ones for removing the 5 beeps). I didn't see any code in this repository for fixing up those things. Is that already in the patcher binary ?