| Message ID | 20170515173304.12216-1-joshz@google.com |
|---|---|
| State | New |
| Headers | show |
On Mon, May 15, 2017 at 10:33:04AM -0700, Josh Zimmerman wrote: > If a TPM2 loses power without a TPM2_Shutdown command being issued (a > "disorderly reboot"), it may lose some state that has yet to be > persisted to NVRam, and will increment the DA counter (eventually, this > will cause the TPM to lock the user out.) > > NOTE: This only changes behavior on TPM2 devices. Since TPM1 uses sysfs, > and sysfs relies on implicit locking on chip->ops, it is not safe to > allow this code to run in TPM1, or to add sysfs support to TPM2, until > that locking is made explicit. > > This patch is dependent on '[PATCH] Add "shutdown" to "struct class".' > http://marc.info/?l=linux-kernel&m=149463235025420&w=2 > > Signed-off-by: Josh Zimmerman <joshz@google.com> > > v2: > - Properly split changes between this and another commit > - Use proper locking primitive. > - Fix commenting style > drivers/char/tpm/tpm-chip.c | 20 ++++++++++++++++++++ > drivers/char/tpm/tpm-sysfs.c | 2 ++ > 2 files changed, 22 insertions(+) > > diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c > index 9dec9f551b83..e0c4323876b8 100644 > +++ b/drivers/char/tpm/tpm-chip.c > @@ -142,6 +142,25 @@ static void tpm_devs_release(struct device *dev) > put_device(&chip->dev); > } > > +static void tpm_shutdown(struct device *dev) > +{ > + struct tpm_chip *chip = container_of(dev, struct tpm_chip, dev); > + /** TPM 2.0 requires that the TPM2_Shutdown() command be issued prior to Single * for this comment > + * loss of power. If it is not, the DA counter will be incremented and, > + * eventually, the user will be locked out of their TPM. > + * XXX: This codepath relies on the fact that sysfs is not enabled for > + * TPM2: sysfs uses an implicit lock on chip->ops, so this use could > + * race if TPM2 has sysfs support enabled before TPM sysfs's implicit > + * locking is fixed. > + */ > + if (chip->flags & TPM_CHIP_FLAG_TPM2) { > + down_write(&chip->ops_sem); > + tpm2_shutdown(chip, TPM_SU_CLEAR); Would it be appropriate to now chain to the device_driver shutdown in case any TPM-bus related shutdown is required? We don't have any drivers that need that today though. > void tpm_sysfs_add_device(struct tpm_chip *chip) > { > + // XXX: Before this restriction is removed, tpm_sysfs must be updated > + // to explicitly lock chip->ops. comment style again Otherwise seems like a reasonable approach, we can fix the TPM2-onlyness in later patches. Jason ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot
Resending to all recipients... On Mon, May 15, 2017 at 10:40 AM, Jason Gunthorpe <jgunthorpe@obsidianresearch.com> wrote: > On Mon, May 15, 2017 at 10:33:04AM -0700, Josh Zimmerman wrote: >> + if (chip->flags & TPM_CHIP_FLAG_TPM2) { >> + down_write(&chip->ops_sem); >> + tpm2_shutdown(chip, TPM_SU_CLEAR); > > Would it be appropriate to now chain to the device_driver shutdown > in case any TPM-bus related shutdown is required? > > We don't have any drivers that need that today though. I think I'd prefer to keep the patch to the functionality we need today. Is there any reason to prefer adding this functionality now rather than waiting for a specific driver that needs it to add it when it comes up? ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot
On Mon, May 15, 2017 at 10:33:04AM -0700, Josh Zimmerman wrote: > If a TPM2 loses power without a TPM2_Shutdown command being issued (a > "disorderly reboot"), it may lose some state that has yet to be > persisted to NVRam, and will increment the DA counter (eventually, this > will cause the TPM to lock the user out.) > > NOTE: This only changes behavior on TPM2 devices. Since TPM1 uses sysfs, > and sysfs relies on implicit locking on chip->ops, it is not safe to > allow this code to run in TPM1, or to add sysfs support to TPM2, until > that locking is made explicit. > > This patch is dependent on '[PATCH] Add "shutdown" to "struct class".' > http://marc.info/?l=linux-kernel&m=149463235025420&w=2 Is this merged already? Who is going to merge it? > Signed-off-by: Josh Zimmerman <joshz@google.com> Otherwise, Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> /Jarkko > ---- > v2: > - Properly split changes between this and another commit > - Use proper locking primitive. > - Fix commenting style > --- > drivers/char/tpm/tpm-chip.c | 20 ++++++++++++++++++++ > drivers/char/tpm/tpm-sysfs.c | 2 ++ > 2 files changed, 22 insertions(+) > > diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c > index 9dec9f551b83..e0c4323876b8 100644 > --- a/drivers/char/tpm/tpm-chip.c > +++ b/drivers/char/tpm/tpm-chip.c > @@ -142,6 +142,25 @@ static void tpm_devs_release(struct device *dev) > put_device(&chip->dev); > } > > +static void tpm_shutdown(struct device *dev) > +{ > + struct tpm_chip *chip = container_of(dev, struct tpm_chip, dev); > + /** TPM 2.0 requires that the TPM2_Shutdown() command be issued prior to > + * loss of power. If it is not, the DA counter will be incremented and, > + * eventually, the user will be locked out of their TPM. > + * XXX: This codepath relies on the fact that sysfs is not enabled for > + * TPM2: sysfs uses an implicit lock on chip->ops, so this use could > + * race if TPM2 has sysfs support enabled before TPM sysfs's implicit > + * locking is fixed. > + */ > + if (chip->flags & TPM_CHIP_FLAG_TPM2) { > + down_write(&chip->ops_sem); > + tpm2_shutdown(chip, TPM_SU_CLEAR); > + chip->ops = NULL; > + up_write(&chip->ops_sem); > + } > +} > + > /** > * tpm_chip_alloc() - allocate a new struct tpm_chip instance > * @pdev: device to which the chip is associated > @@ -181,6 +200,7 @@ struct tpm_chip *tpm_chip_alloc(struct device *pdev, > device_initialize(&chip->devs); > > chip->dev.class = tpm_class; > + chip->dev.class.shutdown = tpm_shutdown; > chip->dev.release = tpm_dev_release; > chip->dev.parent = pdev; > chip->dev.groups = chip->groups; > diff --git a/drivers/char/tpm/tpm-sysfs.c b/drivers/char/tpm/tpm-sysfs.c > index 55405dbe43fa..6256f6e174b0 100644 > --- a/drivers/char/tpm/tpm-sysfs.c > +++ b/drivers/char/tpm/tpm-sysfs.c > @@ -294,6 +294,8 @@ static const struct attribute_group tpm_dev_group = { > > void tpm_sysfs_add_device(struct tpm_chip *chip) > { > + // XXX: Before this restriction is removed, tpm_sysfs must be updated > + // to explicitly lock chip->ops. > if (chip->flags & TPM_CHIP_FLAG_TPM2) > return; > > -- > 2.13.0.rc2.291.g57267f2277-goog > ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot
diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c index 9dec9f551b83..e0c4323876b8 100644 --- a/drivers/char/tpm/tpm-chip.c +++ b/drivers/char/tpm/tpm-chip.c @@ -142,6 +142,25 @@ static void tpm_devs_release(struct device *dev) put_device(&chip->dev); } +static void tpm_shutdown(struct device *dev) +{ + struct tpm_chip *chip = container_of(dev, struct tpm_chip, dev); + /** TPM 2.0 requires that the TPM2_Shutdown() command be issued prior to + * loss of power. If it is not, the DA counter will be incremented and, + * eventually, the user will be locked out of their TPM. + * XXX: This codepath relies on the fact that sysfs is not enabled for + * TPM2: sysfs uses an implicit lock on chip->ops, so this use could + * race if TPM2 has sysfs support enabled before TPM sysfs's implicit + * locking is fixed. + */ + if (chip->flags & TPM_CHIP_FLAG_TPM2) { + down_write(&chip->ops_sem); + tpm2_shutdown(chip, TPM_SU_CLEAR); + chip->ops = NULL; + up_write(&chip->ops_sem); + } +} + /** * tpm_chip_alloc() - allocate a new struct tpm_chip instance * @pdev: device to which the chip is associated @@ -181,6 +200,7 @@ struct tpm_chip *tpm_chip_alloc(struct device *pdev, device_initialize(&chip->devs); chip->dev.class = tpm_class; + chip->dev.class.shutdown = tpm_shutdown; chip->dev.release = tpm_dev_release; chip->dev.parent = pdev; chip->dev.groups = chip->groups; diff --git a/drivers/char/tpm/tpm-sysfs.c b/drivers/char/tpm/tpm-sysfs.c index 55405dbe43fa..6256f6e174b0 100644 --- a/drivers/char/tpm/tpm-sysfs.c +++ b/drivers/char/tpm/tpm-sysfs.c @@ -294,6 +294,8 @@ static const struct attribute_group tpm_dev_group = { void tpm_sysfs_add_device(struct tpm_chip *chip) { + // XXX: Before this restriction is removed, tpm_sysfs must be updated + // to explicitly lock chip->ops. if (chip->flags & TPM_CHIP_FLAG_TPM2) return;
If a TPM2 loses power without a TPM2_Shutdown command being issued (a "disorderly reboot"), it may lose some state that has yet to be persisted to NVRam, and will increment the DA counter (eventually, this will cause the TPM to lock the user out.) NOTE: This only changes behavior on TPM2 devices. Since TPM1 uses sysfs, and sysfs relies on implicit locking on chip->ops, it is not safe to allow this code to run in TPM1, or to add sysfs support to TPM2, until that locking is made explicit. This patch is dependent on '[PATCH] Add "shutdown" to "struct class".' http://marc.info/?l=linux-kernel&m=149463235025420&w=2 Signed-off-by: Josh Zimmerman <joshz@google.com> ---- v2: - Properly split changes between this and another commit - Use proper locking primitive. - Fix commenting style --- drivers/char/tpm/tpm-chip.c | 20 ++++++++++++++++++++ drivers/char/tpm/tpm-sysfs.c | 2 ++ 2 files changed, 22 insertions(+)