Re: Bug: TPM returned invalid status

From: Kees Cook <keescook@chromium.org>
To: James Bottomley <James.Bottomley@HansenPartnership.com>
Cc: Jarkko Sakkinen <jarkko@kernel.org>,
	"Tj (Elloe Linux)" <ml.linux@elloe.vision>,
	linux-integrity@vger.kernel.org, jsnitsel@redhat.com,
	Lino Sanfilippo <LinoSanfilippo@gmx.de>
Subject: Re: Bug: TPM returned invalid status
Date: Mon, 29 Mar 2021 19:04:23 -0700	[thread overview]
Message-ID: <202103291901.F15EA83FB6@keescook> (raw)
In-Reply-To: <b1e71d07546ccce7957ead9cc80303734251f6c9.camel@HansenPartnership.com>

On Wed, Jan 27, 2021 at 10:11:56AM -0800, James Bottomley wrote:
> On Wed, 2021-01-27 at 20:00 +0200, Jarkko Sakkinen wrote:
> > On Wed, Jan 27, 2021 at 07:58:08PM +0200, Jarkko Sakkinen wrote:
> > > On Mon, Jan 25, 2021 at 09:00:54AM +0000, Tj (Elloe Linux) wrote:
> > > > Seeing this on Lenovo E495's that have:
> > > > 
> > > > AMD Ryzen 7 3700U with Radeon Vega Mobile Gfx
> > > > 
> > > > Linux version 5.11.0-rc4+ (tj@elloe000) (gcc (Ubuntu
> > > > 9.3.0-17ubuntu1~20.04) 9.3.0, GNU ld (GNU Binutils for Ubuntu)
> > > > 2.34) #12 SMP PREEMPT Sun Jan 24 11:28:01 GMT 2021
> > > > Command line: BOOT_IMAGE=/vmlinuz-5.11.0-rc4+
> > > > root=/dev/mapper/ELLOE000-rootfs ro acpi_osi=! "acpi_osi=Windows
> > > > 2016" systemd.unified_cgroup_hierarchy=1 nosplash
> > > > ...
> > > > efi: EFI v2.70 by Lenovo
> > > > 
> > > > efi: ACPI=0xbddfd000 ACPI 2.0=0xbddfd014 TPMFinalLog=0xbdc2d000
> > > > SMBIOS=0xba4d7000 SMBIOS 3.0=0xba4ca000 MEMATTR=0xb5611018
> > > > ESRT=0xb9075000 RNG=0xba5c2598 TPMEventLog=0xb13ae
> > > > 018
> > > > ...
> > > > DMI: LENOVO 20NECTO1WW/20NECTO1WW, BIOS R11ET32W (1.12 )
> > > > 12/23/2019
> > > > ...
> > > > tpm_tis NTC0702:00: 2.0 TPM (device-id 0xFC, rev-id 1)
> > > > ------------[ cut here ]------------
> > > > TPM returned invalid status
> > > > WARNING: CPU: 3 PID: 1 at drivers/char/tpm/tpm_tis_core.c:249
> > > 
> > > There's a patch set in cycle that should fix this:
> > > 
> > > https://lore.kernel.org/linux-integrity/20201001180925.13808-1-James.Bottomley@HansenPartnership.com/
> > > 
> > > James, where are we at with this?
> > 
> > I'm interested because I'm yet to send my pr and this is generating
> > constantly bug reports.
> 
> It's part of the enable interrupts series, which there's a lot of
> discussion over.  However, that single patch can be broken out of the
> series if you like.  The specific blocker was the screaming interrupt
> on the Lenovo that Jerry was looking at.  He propose a quirk to fix its
> so perhaps we're now ready to move the entire series forward?

Does this series solve the issue too?

https://lore.kernel.org/linux-integrity/1613955394-13152-1-git-send-email-LinoSanfilippo@gmx.de/

(I haven't had a chance to test either series with my TPM, but I see the
same "TPM returned invalid status" errors recently.)

-- 
Kees Cook