Re: [PATCH] tpm, tpm_tis: Acquire locality in tpm_tis_gen_interrupt() and tpm_get_timeouts()

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Le 15/06/21 à 14:56, Jarkko Sakkinen a écrit :
On Tue, Jun 15, 2021 at 01:19:56PM +0200, Laurent Bigonville wrote:
Le 14/06/21 à 22:40, Jarkko Sakkinen a écrit :
On Thu, Jun 10, 2021 at 04:00:27PM +0200, Laurent Bigonville wrote:
Le 10/06/21 à 14:29, Jarkko Sakkinen a écrit :
On Thu, Jun 10, 2021 at 01:35:47PM +0200, Laurent Bigonville wrote:
# dmesg |grep -i tpm

[   13.019986] tpm_tis 00:06: 1.2 TPM (device-id 0x6871, rev-id 1)
[   15.016198] tpm tpm0: tpm_try_transmit: send(): error -62
[   15.016208] tpm tpm0: A TPM error (-62) occurred attempting to determine
the timeouts
[   15.016239] tpm_tis: probe of 00:06 failed with error -62
[   15.053255] tpm_inf_pnp 00:06: Found TPM with ID IFX0102
If possible, can you check what happens when you apply the attached patch.
I'm not proposing it as a bug fix but it just simplifies the flow a lot,
and might help to observe something.

With the patch on the top of HEAD of master and the patch from your branch,
I'm getting this:

[   13.140548] tpm tpm0: invalid TPM_STS.x 0xa0, dumping stack for forensics
[   13.140617] CPU: 4 PID: 462 Comm: systemd-udevd Tainted: G          I
E     5.13.0-rc5+ #7
[   13.140621] Hardware name: System manufacturer System Product Name/P6T
DELUXE V2, BIOS 0406    04/24/2009
[   13.140623] Call Trace:
[   13.140628]  dump_stack+0x76/0x94
[   13.140637]  tpm_tis_status.cold+0x19/0x20 [tpm_tis_core]
[   13.140643]  tpm_transmit+0x15f/0x3d0 [tpm]
[   13.140657]  tpm_transmit_cmd+0x25/0x90 [tpm]
[   13.140666]  tpm2_probe+0xe2/0x140 [tpm]
It's weird because it's the first transaction with the TPM, not likely
to have any sort of mismatch in power gating.

I'm suspecting this:

	if (wait_startup(chip, 0) != 0) {
		rc = -ENODEV;
		goto out_err;
	}

I did not find anything from [*] stating that reading Access Register,
could cause any change in the burstCount (0xa0) but still might be worth
of testing to couple that with

	release_locality(chip, 0);

I.e. add that just after the first snippet.

You mean this, right?

diff --git a/drivers/char/tpm/tpm_tis_core.c
b/drivers/char/tpm/tpm_tis_core.c
index 3b5a03f9efce..857ea790e9d3 100644
--- a/drivers/char/tpm/tpm_tis_core.c
+++ b/drivers/char/tpm/tpm_tis_core.c
@@ -969,6 +969,7 @@ int tpm_tis_core_init(struct device *dev, struct
tpm_tis_data *priv, int irq,
                 rc = -ENODEV;
                 goto out_err;
         }
+       release_locality(chip, 0);

         /* Take control of the TPM's interrupt hardware and shut it off */
         rc = tpm_tis_read32(priv, TPM_INT_ENABLE(priv->locality), &intmask);


With this change (and with or without "tpm_tis: Use request_locality()
before calling tpm2_probe()"), I get the following:

[   13.420485] tpm tpm0: invalid TPM_STS.x 0xff, dumping stack for forensics
[   13.420494] CPU: 5 PID: 461 Comm: systemd-udevd Tainted: G          I
E     5.13.0-rc6+ #8
[   13.420498] Hardware name: System manufacturer System Product Name/P6T
DELUXE V2, BIOS 0406    04/24/2009
[   13.420500] Call Trace:
[   13.420505]  dump_stack+0x76/0x94
[   13.420512]  tpm_tis_status.cold+0x19/0x20 [tpm_tis_core]
[   13.420519]  wait_for_tpm_stat+0x49/0x200 [tpm_tis_core]
[   13.420524]  ? get_page_from_freelist+0x228/0xed0
[   13.420530]  ? tpm_tcg_read_bytes+0x30/0x50 [tpm_tis]
[   13.420536]  tpm_tis_send_data+0x90/0x250 [tpm_tis_core]
[   13.420542]  tpm_tis_send_main+0x2e/0xf0 [tpm_tis_core]
[   13.420547]  tpm_transmit+0xd8/0x3d0 [tpm]
[   13.420559]  tpm_transmit_cmd+0x25/0x90 [tpm]
[   13.420567]  tpm2_probe+0xe2/0x140 [tpm]
[   13.420577]  tpm_tis_core_init+0x1fd/0x2e0 [tpm_tis_core]
[   13.420582]  ? tpm_tis_init.part.0+0x130/0x130 [tpm_tis]
[   13.420587]  tpm_tis_pnp_init+0xe1/0x110 [tpm_tis]
[   13.420594]  pnp_device_probe+0xaf/0x140
[   13.420600]  really_probe+0xf2/0x460
[   13.420606]  driver_probe_device+0xe8/0x160
[   13.420610]  device_driver_attach+0xa1/0xb0
[   13.420614]  __driver_attach+0x8f/0x150
[   13.420618]  ? device_driver_attach+0xb0/0xb0
[   13.420621]  ? device_driver_attach+0xb0/0xb0
[   13.420624]  bus_for_each_dev+0x78/0xc0
[   13.420628]  bus_add_driver+0x12b/0x1e0
[   13.420632]  driver_register+0x8b/0xe0
[   13.420636]  ? 0xffffffffc1413000
[   13.420639]  init_tis+0xa0/0x1000 [tpm_tis]
[   13.420646]  do_one_initcall+0x44/0x1d0
[   13.420652]  ? kmem_cache_alloc_trace+0x119/0x240
[   13.420657]  do_init_module+0x5c/0x260
[   13.420662]  __do_sys_finit_module+0xb1/0x110
[   13.420668]  do_syscall_64+0x40/0xb0
[   13.420673]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[   13.420678] RIP: 0033:0x7f15fe84e9b9
[   13.420681] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48
89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48>
3d 01 f0 ff ff 73 01 c3 48 8b 0d a7 54 0c 00 f7 d8 64 89 01 48
[   13.420685] RSP: 002b:00007fffc3aca668 EFLAGS: 00000246 ORIG_RAX:
0000000000000139
[   13.420689] RAX: ffffffffffffffda RBX: 00005561627275b0 RCX:
00007f15fe84e9b9
[   13.420692] RDX: 0000000000000000 RSI: 00007f15fe9d9e2d RDI:
0000000000000012
[   13.420694] RBP: 0000000000020000 R08: 0000000000000000 R09:
0000556161c2f330
[   13.420696] R10: 0000000000000012 R11: 0000000000000246 R12:
00007f15fe9d9e2d
[   13.420698] R13: 0000000000000000 R14: 000055616271dab0 R15:
00005561627275b0
[...]
[   14.185406] tpm tpm0: tpm_try_transmit: send(): error -62
[   14.185422] tpm_tis 00:06: 1.2 TPM (device-id 0x6871, rev-id 1)
[   15.021233] tpm tpm0: tpm_try_transmit: send(): error -62
[   24.381575] tpm tpm0: tpm_try_transmit: send(): error -62
[...]

But now the /dev/tpm0 device appears (but doesn't seem to work)
I'm sorry, I made a mistake: release_locality() call should be exactly
right before tpm_chip_start(). The reason is that we access TPM_INT_ENABLE,
i.e. locality is released too early.

In summary, I think I would try this:

	tpm_chip_stop(chip);

	rc = tpm_chip_start(chip);
	if (rc)
		goto out_err;
	rc = tpm2_probe(chip);
	tpm_chip_stop(chip);
	if (rc)
		goto out_err;

tpm_chip_stop() is makes more sense it takes care also of disabling
clk_enable.

I.e. TPM should be shut down right after intmask mangling...

Sorry to bring bad news but it's still not working :(

With the following change:

diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c
index 69579efb247b..45ad813ce840 100644
--- a/drivers/char/tpm/tpm_tis_core.c
+++ b/drivers/char/tpm/tpm_tis_core.c
@@ -980,6 +980,8 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq,
        intmask &= ~TPM_GLOBAL_INT_ENABLE;
        tpm_tis_write32(priv, TPM_INT_ENABLE(priv->locality), intmask);

+       tpm_chip_stop(chip);
+
        rc = tpm_chip_start(chip);
        if (rc)
                goto out_err;

I get now a Oops

[   13.438251] BUG: unable to handle page fault for address: ffff9e8141157000
[   13.438257] #PF: supervisor write access in kernel mode
[   13.438259] #PF: error_code(0x0002) - not-present page
[   13.438261] PGD 100000067 P4D 100000067 PUD 0
[   13.438265] Oops: 0002 [#1] SMP PTI
[   13.438268] CPU: 7 PID: 469 Comm: systemd-udevd Tainted: G          I E     5.13.0-rc6+ #8 [   13.438271] Hardware name: System manufacturer System Product Name/P6T DELUXE V2, BIOS 0406    04/24/2009
[   13.438273] RIP: 0010:iowrite8+0x9/0x50
[   13.438282] Code: 48 c7 c2 e8 6a 10 98 48 89 04 24 e8 ac 5e 3f 00 0f 0b 48 8b 04 24 48 83 c4 08 c3 66 0f 1f 44 00 00 48 81 fe ff ff 03 00 76 04 <40> 88 3e c3 48 81 fe 00 00 01 00 76 07 0f b7 d6 89 f8 ee c3 8b 05
[   13.438286] RSP: 0018:ffff9e8040f23b10 EFLAGS: 00010292
[   13.438289] RAX: ffffffffc15440b0 RBX: ffff9e8040f23b48 RCX: ffff9e8040f23b47 [   13.438292] RDX: 0000000000000001 RSI: ffff9e8141157000 RDI: 0000000000000020 [   13.438295] RBP: ffff9e8040f23b48 R08: ffff88f2108bf018 R09: ffff88f20104b290 [   13.438297] R10: 0000000000000002 R11: 0000000000000004 R12: ffff88f2108bf018 [   13.438300] R13: 00000000fffff000 R14: ffff88f20104b000 R15: 00000000ffffffff [   13.438303] FS:  00007fafaab758c0(0000) GS:ffff88f5adbc0000(0000) knlGS:0000000000000000
[   13.438307] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   13.438310] CR2: ffff9e8141157000 CR3: 00000001065ca000 CR4: 00000000000006e0
[   13.438313] Call Trace:
[   13.438318]  tpm_tcg_write_bytes+0x33/0x50 [tpm_tis]
[   13.438326]  release_locality+0x3c/0x60 [tpm_tis_core]
[   13.438331]  tpm_relinquish_locality+0x24/0x40 [tpm]
[   13.438342]  tpm_chip_stop+0x26/0x50 [tpm]
[   13.438351]  tpm_tis_core_init+0x1c2/0x2b2 [tpm_tis_core]
[   13.438357]  ? tpm_tis_init.part.0+0x130/0x130 [tpm_tis]
[   13.438363]  tpm_tis_pnp_init+0xe1/0x110 [tpm_tis]
[   13.438370]  pnp_device_probe+0xaf/0x140
[   13.438377]  really_probe+0xf2/0x460
[   13.438384]  driver_probe_device+0xe8/0x160
[   13.438388]  device_driver_attach+0xa1/0xb0
[   13.438393]  __driver_attach+0x8f/0x150
[   13.438397]  ? device_driver_attach+0xb0/0xb0
[   13.438402]  ? device_driver_attach+0xb0/0xb0
[   13.438405]  bus_for_each_dev+0x78/0xc0
[   13.438410]  bus_add_driver+0x12b/0x1e0
[   13.438415]  driver_register+0x8b/0xe0
[   13.438419]  ? 0xffffffffc1549000
[   13.438422]  init_tis+0xa0/0x1000 [tpm_tis]
[   13.438430]  do_one_initcall+0x44/0x1d0
[   13.438437]  ? kmem_cache_alloc_trace+0x119/0x240
[   13.438444]  do_init_module+0x5c/0x260
[   13.438450]  __do_sys_finit_module+0xb1/0x110
[   13.438456]  do_syscall_64+0x40/0xb0
[   13.438462]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[   13.438467] RIP: 0033:0x7fafab02e9b9
[   13.438471] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d a7 54 0c 00 f7 d8 64 89 01 48 [   13.438475] RSP: 002b:00007ffe03c50528 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 [   13.438480] RAX: ffffffffffffffda RBX: 00005596198bfc00 RCX: 00007fafab02e9b9 [   13.438483] RDX: 0000000000000000 RSI: 00007fafab1b9e2d RDI: 0000000000000012 [   13.438486] RBP: 0000000000020000 R08: 0000000000000000 R09: 00005596198baaa0 [   13.438489] R10: 0000000000000012 R11: 0000000000000246 R12: 00007fafab1b9e2d [   13.438492] R13: 0000000000000000 R14: 00005596198bab20 R15: 00005596198bfc00 [   13.438497] Modules linked in: tpm_tis(E+) tpm_tis_core(E) tpm(E) asus_atk0110(E) rng_core(E) fjes(E-) evdev(E) acpi_cpufreq(E-) loop(E+) firewire_sbp2(E) msr(E) parport_pc(E) ppdev(E) lp(E) parport(E) fuse(E) configfs(E) sunrpc(E) ip_tables(E) x_tables(E) autofs4(E) ext4(E) crc16(E) mbcache(E) jbd2(E) btrfs(E) blake2b_generic(E) zstd_compress(E) efivars(E) raid10(E) raid456(E) async_raid6_recov(E) async_memcpy(E) async_pq(E) async_xor(E) async_tx(E) xor(E) raid6_pq(E) libcrc32c(E) crc32c_generic(E) raid1(E) raid0(E) multipath(E) linear(E) md_mod(E) dm_mod(E) sr_mod(E) sd_mod(E) cdrom(E) t10_pi(E) hid_generic(E) usbhid(E) hid(E) amdgpu(E) gpu_sched(E) i2c_algo_bit(E) drm_ttm_helper(E) ttm(E) ahci(E) libahci(E) drm_kms_helper(E) i2c_i801(E) firewire_ohci(E) ehci_pci(E) uhci_hcd(E) libata(E) firewire_core(E) cec(E) crc32c_intel(E) mxm_wmi(E) psmouse(E) ehci_hcd(E) crc_itu_t(E) scsi_mod(E) i2c_smbus(E) lpc_ich(E) sky2(E) usbcore(E) drm(E) mfd_core(E) wmi(E) button(E)
[   13.438584] CR2: ffff9e8141157000
[   13.438587] ---[ end trace 25e12430fd1718f9 ]---
[   13.438589] RIP: 0010:iowrite8+0x9/0x50
[   13.438594] Code: 48 c7 c2 e8 6a 10 98 48 89 04 24 e8 ac 5e 3f 00 0f 0b 48 8b 04 24 48 83 c4 08 c3 66 0f 1f 44 00 00 48 81 fe ff ff 03 00 76 04 <40> 88 3e c3 48 81 fe 00 00 01 00 76 07 0f b7 d6 89 f8 ee c3 8b 05
[   13.438597] RSP: 0018:ffff9e8040f23b10 EFLAGS: 00010292
[   13.438601] RAX: ffffffffc15440b0 RBX: ffff9e8040f23b48 RCX: ffff9e8040f23b47 [   13.438604] RDX: 0000000000000001 RSI: ffff9e8141157000 RDI: 0000000000000020 [   13.438606] RBP: ffff9e8040f23b48 R08: ffff88f2108bf018 R09: ffff88f20104b290 [   13.438609] R10: 0000000000000002 R11: 0000000000000004 R12: ffff88f2108bf018 [   13.438612] R13: 00000000fffff000 R14: ffff88f20104b000 R15: 00000000ffffffff [   13.438615] FS:  00007fafaab758c0(0000) GS:ffff88f5adbc0000(0000) knlGS:0000000000000000
[   13.438619] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   13.438622] CR2: ffff9e8141157000 CR3: 00000001065ca000 CR4: 00000000000006e0




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux Kernel]     [Linux Kernel Hardening]     [Linux NFS]     [Linux NILFS]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite News]     [Linux SCSI]

  Powered by Linux