Re: [PATCH v6 2/7] tpm: tpm_tis: Add check_data handle to tpm_tis_phy_ops

[Amir Mizinski]

Hello jarkko,
I reconfigure my email client by the instructions you've sent, and
re-responsing as you requested.
please tell me if there are still any issues. thank you.

On 2020-04-08 18:33, Jarkko Sakkinen wrote:
> On Tue, Apr 07, 2020 at 07:20:39PM +0300, amirmizi6@xxxxxxxxx wrote:
>> From: Amir Mizinski <amirmizi6@xxxxxxxxx>
>>
>> In order to validate data integrity we need to compute the crc over the data
>> sent in lower layer (I2C for instance).
>
> s/crc/CRC/
>
>> To do that tpm_tis_check_data() calls a "check_data" operation (if available).
>
> "check_data" does not exist.
>

it is added in this commit to "tpm_tis_phy_ops" struct in
"tpm_tis_core.h", which is inherited in "tpm_tis_i2c.c" on later patch
(7/7).

>> If data integrity check fails, a retry to save the sent/received
>> data is implemented in tpm_tis_send_main()/tpm_tis_recv() functions.
>>
>> Considering this commit, the following steps are done when sending a command:
>>ÂÂÂ 1. Host writes to TPM_STS.commandReady.
>>ÂÂÂ 2. Host writes command.
>>ÂÂÂ 3. Host checks that TPM received data is valid.
>>ÂÂÂ 4. If data is currupted go to step 1.
>>
>> When receiving data:
>>ÂÂÂ 1. Host checks that TPM_STS.dataAvail is set.
>>ÂÂÂ 2. Host saves received data.
>>ÂÂÂ 3. Host checks that received data is correct.
>>ÂÂÂ 4. If data is currupted Host writes to TPM_STS.responseRetry and go to
>>ÂÂÂÂÂÂ step 1.
>
> These sequences in the commit message look somewhat uselss. Maybe
> just remove them.
>

Their main porpose is to describe how the retry attempt is implemented
in case of currupted data.
should i just describe that with a few words or that's unnecessary?

>>
>> Co-developed-by: Christophe Ricard <christophe-h.ricard@xxxxxx>
>> Signed-off-by: Christophe Ricard <christophe-h.ricard@xxxxxx>
>> Signed-off-by: Amir Mizinski <amirmizi6@xxxxxxxxx>
>> ---
>>Â drivers/char/tpm/tpm_tis_core.c | 102 +++++++++++++++++++++++++---------------
>>Â drivers/char/tpm/tpm_tis_core.h |ÂÂ 3 ++
>>Â 2 files changed, 67 insertions(+), 38 deletions(-)
>>
>> diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c
>> index 27c6ca0..6c4f232 100644
>> --- a/drivers/char/tpm/tpm_tis_core.c
>> +++ b/drivers/char/tpm/tpm_tis_core.c
>> @@ -242,6 +242,15 @@ static u8 tpm_tis_status(struct tpm_chip *chip)
>>ÂÂÂÂÂ return status;
>>Â }
>> Â
>> +static bool tpm_tis_check_data(struct tpm_chip *chip, const u8 *buf, size_t len)
>
> Not sure if this is the best possible function name, "check" can
> mean almost anything.
>

Ok, i'm changing it to "verify_data_integrity". is that ok?

>> +{
>> +ÂÂÂ struct tpm_tis_data *priv = dev_get_drvdata(&chip->dev);
>> +
>> +ÂÂÂ if (priv->phy_ops->check_data)
>> +ÂÂÂÂÂÂÂ return priv->phy_ops->check_data(priv, buf, len);
>
> New line here before the return statement.
>
>> +ÂÂÂ return true;
>> +}
>> +
>>Â static void tpm_tis_ready(struct tpm_chip *chip)
>>Â {
>>ÂÂÂÂÂ struct tpm_tis_data *priv = dev_get_drvdata(&chip->dev);
>> @@ -308,47 +317,59 @@ static int tpm_tis_recv(struct tpm_chip *chip, u8 *buf, size_t count)
>>Â {
>>ÂÂÂÂÂ struct tpm_tis_data *priv = dev_get_drvdata(&chip->dev);
>>ÂÂÂÂÂ int size = 0;
>> -ÂÂÂ int status;
>> +ÂÂÂ int status, i;
>>ÂÂÂÂÂ u32 expected;
>> +ÂÂÂ bool check_data = false;
>> Â
>> -ÂÂÂ if (count < TPM_HEADER_SIZE) {
>> -ÂÂÂÂÂÂÂ size = -EIO;
>> -ÂÂÂÂÂÂÂ goto out;
>> -ÂÂÂ }
>> +ÂÂÂ for (i = 0; i < TPM_RETRY; i++) {
>> +ÂÂÂÂÂÂÂ if (count < TPM_HEADER_SIZE) {
>> +ÂÂÂÂÂÂÂÂÂÂÂ size = -EIO;
>> +ÂÂÂÂÂÂÂÂÂÂÂ goto out;
>> +ÂÂÂÂÂÂÂ }
>> Â
>> -ÂÂÂ size = recv_data(chip, buf, TPM_HEADER_SIZE);
>> -ÂÂÂ /* read first 10 bytes, including tag, paramsize, and result */
>> -ÂÂÂ if (size < TPM_HEADER_SIZE) {
>> -ÂÂÂÂÂÂÂ dev_err(&chip->dev, "Unable to read header\n");
>> -ÂÂÂÂÂÂÂ goto out;
>> -ÂÂÂ }
>> +ÂÂÂÂÂÂÂ size = recv_data(chip, buf, TPM_HEADER_SIZE);
>> +ÂÂÂÂÂÂÂ /* read first 10 bytes, including tag, paramsize, and result */
>> +ÂÂÂÂÂÂÂ if (size < TPM_HEADER_SIZE) {
>> +ÂÂÂÂÂÂÂÂÂÂÂ dev_err(&chip->dev, "Unable to read header\n");
>> +ÂÂÂÂÂÂÂÂÂÂÂ goto out;
>> +ÂÂÂÂÂÂÂ }
>> Â
>> -ÂÂÂ expected = be32_to_cpu(*(__be32 *) (buf + 2));
>> -ÂÂÂ if (expected > count || expected < TPM_HEADER_SIZE) {
>> -ÂÂÂÂÂÂÂ size = -EIO;
>> -ÂÂÂÂÂÂÂ goto out;
>> -ÂÂÂ }
>> +ÂÂÂÂÂÂÂ expected = be32_to_cpu(*(__be32 *) (buf + 2));
>> +ÂÂÂÂÂÂÂ if (expected > count || expected < TPM_HEADER_SIZE) {
>> +ÂÂÂÂÂÂÂÂÂÂÂ size = -EIO;
>> +ÂÂÂÂÂÂÂÂÂÂÂ goto out;
>> +ÂÂÂÂÂÂÂ }
>> Â
>> -ÂÂÂ size += recv_data(chip, &buf[TPM_HEADER_SIZE],
>> -ÂÂÂÂÂÂÂÂÂÂÂÂÂ expected - TPM_HEADER_SIZE);
>> -ÂÂÂ if (size < expected) {
>> -ÂÂÂÂÂÂÂ dev_err(&chip->dev, "Unable to read remainder of result\n");
>> -ÂÂÂÂÂÂÂ size = -ETIME;
>> -ÂÂÂÂÂÂÂ goto out;
>> -ÂÂÂ }
>> +ÂÂÂÂÂÂÂ size += recv_data(chip, &buf[TPM_HEADER_SIZE],
>> +ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ expected - TPM_HEADER_SIZE);
>> +ÂÂÂÂÂÂÂ if (size < expected) {
>> +ÂÂÂÂÂÂÂÂÂÂÂ dev_err(&chip->dev, "Unable to read remainder of result\n");
>> +ÂÂÂÂÂÂÂÂÂÂÂ size = -ETIME;
>> +ÂÂÂÂÂÂÂÂÂÂÂ goto out;
>> +ÂÂÂÂÂÂÂ }
>> Â
>> -ÂÂÂ if (wait_for_tpm_stat(chip, TPM_STS_VALID, chip->timeout_c,
>> -ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ &priv->int_queue, false) < 0) {
>> -ÂÂÂÂÂÂÂ size = -ETIME;
>> -ÂÂÂÂÂÂÂ goto out;
>> +ÂÂÂÂÂÂÂ if (wait_for_tpm_stat(chip, TPM_STS_VALID, chip->timeout_c,
>> +ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ &priv->int_queue, false) < 0) {
>> +ÂÂÂÂÂÂÂÂÂÂÂ size = -ETIME;
>> +ÂÂÂÂÂÂÂÂÂÂÂ goto out;
>> +ÂÂÂÂÂÂÂ }
>> +
>> +ÂÂÂÂÂÂÂ status = tpm_tis_status(chip);
>> +ÂÂÂÂÂÂÂ if (status & TPM_STS_DATA_AVAIL) {ÂÂÂ /* retry? */
>> +ÂÂÂÂÂÂÂÂÂÂÂ dev_err(&chip->dev, "Error left over data\n");
>> +ÂÂÂÂÂÂÂÂÂÂÂ size = -EIO;
>> +ÂÂÂÂÂÂÂÂÂÂÂ goto out;
>> +ÂÂÂÂÂÂÂ }
>> +
>> +ÂÂÂÂÂÂÂ check_data = tpm_tis_check_data(chip, buf, size);
>> +ÂÂÂÂÂÂÂ if (!check_data)
>> +ÂÂÂÂÂÂÂÂÂÂÂ tpm_tis_write8(priv, TPM_STS(priv->locality),
>> +ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ TPM_STS_RESPONSE_RETRY);
>> +ÂÂÂÂÂÂÂ else
>> +ÂÂÂÂÂÂÂÂÂÂÂ break;
>>ÂÂÂÂÂ }
>> -ÂÂÂ status = tpm_tis_status(chip);
>> -ÂÂÂ if (status & TPM_STS_DATA_AVAIL) {ÂÂÂ /* retry? */
>> -ÂÂÂÂÂÂÂ dev_err(&chip->dev, "Error left over data\n");
>> +ÂÂÂ if (!check_data)
>>ÂÂÂÂÂÂÂÂÂ size = -EIO;
>> -ÂÂÂÂÂÂÂ goto out;
>> -ÂÂÂ }
>> -
>>Â out:
>>ÂÂÂÂÂ tpm_tis_ready(chip);
>>ÂÂÂÂÂ return size;
>> @@ -453,14 +474,19 @@ static void disable_interrupts(struct tpm_chip *chip)
>>Â static int tpm_tis_send_main(struct tpm_chip *chip, const u8 *buf, size_t len)
>>Â {
>>ÂÂÂÂÂ struct tpm_tis_data *priv = dev_get_drvdata(&chip->dev);
>> -ÂÂÂ int rc;
>> +ÂÂÂ int rc, i;
>>ÂÂÂÂÂ u32 ordinal;
>>ÂÂÂÂÂ unsigned long dur;
>> +ÂÂÂ bool data_valid = false;
>> Â
>> -ÂÂÂ rc = tpm_tis_send_data(chip, buf, len);
>> -ÂÂÂ if (rc < 0)
>> -ÂÂÂÂÂÂÂ return rc;
>> -
>> +ÂÂÂ for (i = 0; i < TPM_RETRY && !data_valid; i++) {
>> +ÂÂÂÂÂÂÂ rc = tpm_tis_send_data(chip, buf, len);
>> +ÂÂÂÂÂÂÂ if (rc < 0)
>> +ÂÂÂÂÂÂÂÂÂÂÂ return rc;
>> +ÂÂÂÂÂÂÂ data_valid = tpm_tis_check_data(chip, buf, len);
>> +ÂÂÂ }
>> +ÂÂÂ if (!data_valid)
>> +ÂÂÂÂÂÂÂ return -EIO;
>>ÂÂÂÂÂ /* go and do it */
>>ÂÂÂÂÂ rc = tpm_tis_write8(priv, TPM_STS(priv->locality), TPM_STS_GO);
>>ÂÂÂÂÂ if (rc < 0)
>> diff --git a/drivers/char/tpm/tpm_tis_core.h b/drivers/char/tpm/tpm_tis_core.h
>> index d06c65b..486c2e9 100644
>> --- a/drivers/char/tpm/tpm_tis_core.h
>> +++ b/drivers/char/tpm/tpm_tis_core.h
>> @@ -34,6 +34,7 @@ enum tis_status {
>>ÂÂÂÂÂ TPM_STS_GO = 0x20,
>>ÂÂÂÂÂ TPM_STS_DATA_AVAIL = 0x10,
>>ÂÂÂÂÂ TPM_STS_DATA_EXPECT = 0x08,
>> +ÂÂÂ TPM_STS_RESPONSE_RETRY = 0x02,
>>Â };
>> Â
>>Â enum tis_int_flags {
>> @@ -106,6 +107,8 @@ struct tpm_tis_phy_ops {
>>ÂÂÂÂÂ int (*read16)(struct tpm_tis_data *data, u32 addr, u16 *result);
>>ÂÂÂÂÂ int (*read32)(struct tpm_tis_data *data, u32 addr, u32 *result);
>>ÂÂÂÂÂ int (*write32)(struct tpm_tis_data *data, u32 addr, u32 src);
>> +ÂÂÂ bool (*check_data)(struct tpm_tis_data *data, const u8 *buf,
>> +ÂÂÂÂÂÂÂÂÂÂÂÂÂÂ size_t len);
>
> Aren't you validating the contents of the buf?
>
> /Jarkko

i do.
when sending, the data is written to the buff in "tpm_tis_send_data(chip,buf, len)".
and validated in "data_valid = tpm_tis_check_data(chip, buf, len)".
data is not sent until TPM_STS_GO is set.

when receiving, the data in the buffer is verified after recv_data, and
writing to TPM_STS_RESPONSE_RETRY in case it fails to recive it again.


Thank you
Amir Mizinski