Linux-Integrity Archive on lore.kernel.org
 help / color / Atom feed
From: Doug Anderson <dianders@chromium.org>
To: Greg KH <gregkh@linuxfoundation.org>
Cc: Jason Gunthorpe <jgg@ziepe.ca>, "# 4.0+" <stable@vger.kernel.org>,
	Guenter Roeck <groeck@chromium.org>,
	Vadim Sukhomlinov <sukhomlinov@google.com>,
	Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>,
	Arnd Bergmann <arnd@arndb.de>, Peter Huewe <peterhuewe@gmx.de>,
	LKML <linux-kernel@vger.kernel.org>,
	linux-integrity@vger.kernel.org
Subject: Re: [PATCH] tpm: Fix TPM 1.2 Shutdown sequence to prevent future TPM operations
Date: Fri, 12 Jul 2019 08:00:12 -0700
Message-ID: <CAD=FV=UBOWHrEFQRhxsnK-PmVkFjcvnEruuy0sYHh0p-Qnk8pA@mail.gmail.com> (raw)
In-Reply-To: <20190712115025.GA8221@kroah.com>

Hi,

On Fri, Jul 12, 2019 at 4:50 AM Greg KH <gregkh@linuxfoundation.org> wrote:
>
> On Thu, Jul 11, 2019 at 10:28:01AM -0700, Doug Anderson wrote:
> > Hi,
> >
> > On Thu, Jul 11, 2019 at 10:26 AM Greg KH <gregkh@linuxfoundation.org> wrote:
> > >
> > > On Thu, Jul 11, 2019 at 02:17:26PM -0300, Jason Gunthorpe wrote:
> > > > On Thu, Jul 11, 2019 at 07:04:37PM +0200, Greg KH wrote:
> > > > > On Thu, Jul 11, 2019 at 01:39:15PM -0300, Jason Gunthorpe wrote:
> > > > > > On Thu, Jul 11, 2019 at 09:29:19AM -0700, Douglas Anderson wrote:
> > > > > > > From: Vadim Sukhomlinov <sukhomlinov@google.com>
> > > > > > >
> > > > > > > commit db4d8cb9c9f2af71c4d087817160d866ed572cc9 upstream.
> > > > > > >
> > > > > > > TPM 2.0 Shutdown involve sending TPM2_Shutdown to TPM chip and disabling
> > > > > > > future TPM operations. TPM 1.2 behavior was different, future TPM
> > > > > > > operations weren't disabled, causing rare issues. This patch ensures
> > > > > > > that future TPM operations are disabled.
> > > > > > >
> > > > > > > Fixes: d1bd4a792d39 ("tpm: Issue a TPM2_Shutdown for TPM2 devices.")
> > > > > > > Cc: stable@vger.kernel.org
> > > > > > > Signed-off-by: Vadim Sukhomlinov <sukhomlinov@google.com>
> > > > > > > [dianders: resolved merge conflicts with mainline]
> > > > > > > Signed-off-by: Douglas Anderson <dianders@chromium.org>
> > > > > > > Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
> > > > > > > Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
> > > > > > > This is the backport of the patch referenced above to 4.19 as was done
> > > > > > > in Chrome OS.  See <https://crrev.com/c/1495114> for details.  It
> > > > > > > presumably applies to some older kernels.  NOTE that the problem
> > > > > > > itself has existed for a long time, but continuing to backport this
> > > > > > > exact solution to super old kernels is out of scope for me.  For those
> > > > > > > truly interested feel free to reference the past discussion [1].
> > > > > > >
> > > > > > > Reason for backport: mainline has commit a3fbfae82b4c ("tpm: take TPM
> > > > > > > chip power gating out of tpm_transmit()") and commit 719b7d81f204
> > > > > > > ("tpm: introduce tpm_chip_start() and tpm_chip_stop()") and it didn't
> > > > > > > seem like a good idea to backport 17 patches to avoid the conflict.
> > > > > >
> > > > > > Careful with this, you can't backport this to any kernels that don't
> > > > > > have the sysfs ops locking changes or they will crash in sysfs code.
> > > > >
> > > > > And what commit added that?
> > > >
> > > > commit 2677ca98ae377517930c183248221f69f771c921
> > > > Author: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
> > > > Date:   Sun Nov 4 11:38:27 2018 +0200
> > > >
> > > >     tpm: use tpm_try_get_ops() in tpm-sysfs.c.
> > > >
> > > >     Use tpm_try_get_ops() in tpm-sysfs.c so that we can consider moving
> > > >     other decorations (locking, localities, power management for example)
> > > >     inside it. This direction can be of course taken only after other call
> > > >     sites for tpm_transmit() have been treated in the same way.
> > > >
> > > > The last sentence suggests there are other patches needed too though..
> > >
> > > So 5.1.  So does this original patch need to go into the 5.2 and 5.1
> > > kernels?
> >
> > The patch ("Fix TPM 1.2 Shutdown sequence to prevent future TPM
> > operations")?  It's already done.  It just got merge conflicts when
> > going back to 4.19 which is why I sent the backport.
>
> But the sysfs comment means I should not apply this backport then?
>
> Totally confused by this long thread, sorry.
>
> What am I supposed to do for the stable trees here?

I think the answer is to drop my backport for now and Jarkko says
he'll take a fresh look at it in 2 weeks when he's back from his
leave.  Thus my understanding:

* On mainline: fixed

* On 5.2 / 5.1: you've already got this picked to stable.  Good

* On 4.14 / 4.19: Jarkko will look at in 2 weeks.

* On 4.9 and older: I'd propose skipping unless someone is known to
need a solution here.

-Doug

  reply index

Thread overview: 25+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-07-11 16:29 Douglas Anderson
2019-07-11 16:39 ` Jason Gunthorpe
2019-07-11 16:41   ` Doug Anderson
2019-07-11 17:04   ` Greg KH
2019-07-11 17:17     ` Jason Gunthorpe
2019-07-11 17:26       ` Greg KH
2019-07-11 17:28         ` Doug Anderson
2019-07-12 11:50           ` Greg KH
2019-07-12 15:00             ` Doug Anderson [this message]
2019-07-12 15:27               ` Greg KH
2019-07-12 15:47               ` Jarkko Sakkinen
2019-07-12 15:21             ` Jarkko Sakkinen
2019-07-11 18:35   ` Jarkko Sakkinen
2019-07-11 19:43     ` Jarkko Sakkinen
2019-07-11 19:46       ` Jason Gunthorpe
2019-07-12  3:31         ` Jarkko Sakkinen
2019-07-12  3:35           ` Jarkko Sakkinen
2019-07-12 11:58             ` Jason Gunthorpe
2019-07-11 19:55       ` Doug Anderson
2019-07-11 18:34 ` Jarkko Sakkinen
  -- strict thread matches above, loose matches on Subject: below --
2019-06-10 22:01 Douglas Anderson
2019-06-12 19:16 ` Jarkko Sakkinen
2019-06-13 13:58   ` Jarkko Sakkinen
2019-06-13 15:20     ` Doug Anderson
2019-06-14 15:15       ` Jarkko Sakkinen

Reply instructions:

You may reply publically to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to='CAD=FV=UBOWHrEFQRhxsnK-PmVkFjcvnEruuy0sYHh0p-Qnk8pA@mail.gmail.com' \
    --to=dianders@chromium.org \
    --cc=arnd@arndb.de \
    --cc=gregkh@linuxfoundation.org \
    --cc=groeck@chromium.org \
    --cc=jarkko.sakkinen@linux.intel.com \
    --cc=jgg@ziepe.ca \
    --cc=linux-integrity@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=peterhuewe@gmx.de \
    --cc=stable@vger.kernel.org \
    --cc=sukhomlinov@google.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Linux-Integrity Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-integrity/0 linux-integrity/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-integrity linux-integrity/ https://lore.kernel.org/linux-integrity \
		linux-integrity@vger.kernel.org linux-integrity@archiver.kernel.org
	public-inbox-index linux-integrity


Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-integrity


AGPL code for this site: git clone https://public-inbox.org/ public-inbox