linux-kernel - Re: [PATCH 4/5] tpm_tis_spi: Remove limitation of transfers to MAX_SPI

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <0FCA4890-55E6-44E2-B88E-EA609A8B698F@gmx.de>
Date:   Fri, 17 Feb 2017 08:19:40 +0100
From:   Peter Huewe <peterhuewe@....de>
To:     Christophe Ricard <christophe.ricard@...il.com>,
        Peter Huewe <peter.huewe@...ineon.com>,
        Jarkko Sakkinen <jarkko.sakkinen@...ux.intel.com>
CC:     Jason Gunthorpe <jgunthorpe@...idianresearch.com>,
        tpmdd-devel@...ts.sourceforge.net, linux-kernel@...r.kernel.org,
        Christophe Ricard <christophe-h.ricard@...com>,
        stable@...r.kernel.org,
        Alexander Steffen <Alexander.Steffen@...ineon.com>
Subject: Re: [PATCH 4/5] tpm_tis_spi: Remove limitation of transfers to MAX_SPI_FRAMESIZE bytes



Am 17. Februar 2017 06:11:53 MEZ schrieb Christophe Ricard <christophe.ricard@...il.com>:
>I am not sure i understand here, are you considering there could be 
>burstcount > 64 with "TCG" TPM ?
>
With the current upstream version, any command larger with a response of more than 64 byte is broken, since the splitting loop went missing during the merge.
At least with our tpms that's the case.
(I think we are signalling a higher burstcount value than 64, which is allowed)

>Or is this because of TIS vs PTP differences ?
>
>To be honest, this is a little behind me now :-)
>
>
>On 16/02/2017 08:08, Peter Huewe wrote:
>> Limiting transfers to MAX_SPI_FRAMESIZE was not expected by the upper
>> layers, as tpm_tis has no such limitation. Add a loop to hide that
>> limitation.
>>
>> Cc: <stable@...r.kernel.org>
>> Fixes: 0edbfea537d1 ("tpm/tpm_tis_spi: Add support for spi phy")
>> Signed-off-by: Alexander Steffen <Alexander.Steffen@...ineon.com>
>> Signed-off-by: Peter Huewe <peter.huewe@...ineon.com>
>> ---
>>   drivers/char/tpm/tpm_tis_spi.c | 108
>++++++++++++++++++++++-------------------
>>   1 file changed, 57 insertions(+), 51 deletions(-)
>>
>> diff --git a/drivers/char/tpm/tpm_tis_spi.c
>b/drivers/char/tpm/tpm_tis_spi.c
>> index 16938e2253d2..b50c5b072df3 100644
>> --- a/drivers/char/tpm/tpm_tis_spi.c
>> +++ b/drivers/char/tpm/tpm_tis_spi.c
>> @@ -61,68 +61,74 @@ static int tpm_tis_spi_transfer(struct
>tpm_tis_data *data, u32 addr, u8 len,
>>   {
>>   	struct tpm_tis_spi_phy *phy = to_tpm_tis_spi_phy(data);
>>   	int ret;
>> -	struct spi_message m;
>> -	struct spi_transfer spi_xfer = {
>> -		.tx_buf = phy->tx_buf,
>> -		.rx_buf = phy->rx_buf,
>> -		.len = 4,
>> -		.cs_change = 1,
>> -	};
>> -
>> -	if (len > MAX_SPI_FRAMESIZE)
>> -		return -ENOMEM;
>>   
>> -	phy->tx_buf[0] = direction | (len - 1);
>> -	phy->tx_buf[1] = 0xd4;
>> -	phy->tx_buf[2] = addr >> 8;
>> -	phy->tx_buf[3] = addr;
>> +	spi_bus_lock(phy->spi_device->master);
>>   
>> -	spi_message_init(&m);
>> -	spi_message_add_tail(&spi_xfer, &m);
>> +	while (len) {
>> +		struct spi_message m;
>> +		struct spi_transfer spi_xfer = {
>> +			.tx_buf = phy->tx_buf,
>> +			.rx_buf = phy->rx_buf,
>> +			.len = 4,
>> +			.cs_change = 1,
>> +		};
>> +		u8 transfer_len = min_t(u16, len, MAX_SPI_FRAMESIZE);
>> +
>> +		phy->tx_buf[0] = direction | (transfer_len - 1);
>> +		phy->tx_buf[1] = 0xd4;
>> +		phy->tx_buf[2] = addr >> 8;
>> +		phy->tx_buf[3] = addr;
>> +
>> +		spi_message_init(&m);
>> +		spi_message_add_tail(&spi_xfer, &m);
>> +		ret = spi_sync_locked(phy->spi_device, &m);
>> +		if (ret < 0)
>> +			goto exit;
>>   
>> -	spi_bus_lock(phy->spi_device->master);
>> -	ret = spi_sync_locked(phy->spi_device, &m);
>> -	if (ret < 0)
>> -		goto exit;
>> -
>> -	if ((phy->rx_buf[3] & 0x01) == 0) {
>> -		// handle SPI wait states
>> -		int i;
>> -
>> -		phy->tx_buf[0] = 0;
>> -
>> -		for (i = 0; i < TPM_RETRY; i++) {
>> -			spi_xfer.len = 1;
>> -			spi_message_init(&m);
>> -			spi_message_add_tail(&spi_xfer, &m);
>> -			ret = spi_sync_locked(phy->spi_device, &m);
>> -			if (ret < 0)
>> +		if ((phy->rx_buf[3] & 0x01) == 0) {
>> +			// handle SPI wait states
>> +			int i;
>> +
>> +			phy->tx_buf[0] = 0;
>> +
>> +			for (i = 0; i < TPM_RETRY; i++) {
>> +				spi_xfer.len = 1;
>> +				spi_message_init(&m);
>> +				spi_message_add_tail(&spi_xfer, &m);
>> +				ret = spi_sync_locked(phy->spi_device, &m);
>> +				if (ret < 0)
>> +					goto exit;
>> +				if (phy->rx_buf[0] & 0x01)
>> +					break;
>> +			}
>> +
>> +			if (i == TPM_RETRY) {
>> +				ret = -ETIMEDOUT;
>>   				goto exit;
>> -			if (phy->rx_buf[0] & 0x01)
>> -				break;
>> +			}
>>   		}
>>   
>> -		if (i == TPM_RETRY) {
>> -			ret = -ETIMEDOUT;
>> -			goto exit;
>> +		spi_xfer.cs_change = 0;
>> +		spi_xfer.len = transfer_len;
>> +
>> +		if (direction) {
>> +			spi_xfer.tx_buf = NULL;
>> +			spi_xfer.rx_buf = buffer;
>> +		} else {
>> +			spi_xfer.tx_buf = buffer;
>> +			spi_xfer.rx_buf = NULL;
>>   		}
>> -	}
>>   
>> -	spi_xfer.cs_change = 0;
>> -	spi_xfer.len = len;
>> +		spi_message_init(&m);
>> +		spi_message_add_tail(&spi_xfer, &m);
>> +		ret = spi_sync_locked(phy->spi_device, &m);
>> +		if (ret < 0)
>> +			goto exit;
>>   
>> -	if (direction) {
>> -		spi_xfer.tx_buf = NULL;
>> -		spi_xfer.rx_buf = buffer;
>> -	} else {
>> -		spi_xfer.tx_buf = buffer;
>> -		spi_xfer.rx_buf = NULL;
>> +		len -= transfer_len;
>> +		buffer += transfer_len;
>>   	}
>>   
>> -	spi_message_init(&m);
>> -	spi_message_add_tail(&spi_xfer, &m);
>> -	ret = spi_sync_locked(phy->spi_device, &m);
>> -
>>   exit:
>>   	spi_bus_unlock(phy->spi_device->master);
>>   	return ret;

-- 
Sent from my mobile