New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 669109 link

Starred by 1 user

Issue metadata

Status: Archived
Owner: ----
Closed: Dec 2016
Cc:
EstimatedDays: ----
NextAction: ----
OS: Chrome
Pri: 2
Type: Bug



Sign in to add a comment

tpm2_simulator doesn't work

Project Member Reported by apronin@chromium.org, Nov 28 2016

Issue description

Since this change https://chromium-review.googlesource.com/#/c/407538/, tpm2_simulator doesn't work anymore. Trunksd exits on start due to status check failure:

2016-11-28T10:11:08.095025-08:00 ERR trunksd[1689]: GetCapability: TPM_RC_INITIALIZE
2016-11-28T10:11:08.095040-08:00 ERR trunksd[1689]: Failed to query TPM properties: TPM_RC_INITIALIZE
2016-11-28T10:11:08.095043-08:00 ERR trunksd[1689]: TpmBasicInit: TPM_RC_INITIALIZE
2016-11-28T10:11:08.095046-08:00 ERR trunksd[1689]: CheckState: TPM_RC_INITIALIZE

and eventually:
2016-11-28T10:11:08.099317-08:00 CRIT trunksd[1689]: Check failed: tpm_utility->CheckState() == TPM_RC_SUCCESS (256 vs. 0) ...

There's no firmware to call TPM2_Startup, thus GetCapability returns TPM_RC_INITIALIZE, and CheckState() fails.
 
Cc: vbendeb@chromium.org dkrahn@chromium.org ngm@chromium.org
There are two ways to address it:
1) Call TPM2_Startup from the simulator-specific code.
2) Return back calling TPM2_Startup to the general case (this will also change it for the cases when for some reason the firmware didn't initialize TPM - with this fix trunksd will still start then).
WDYT?

Also, need to add 'open' to seccomp filters to cover the case when the check fails: https://chromium-review.googlesource.com/#/c/414952/.
I think the proper initialization should be called by the simulator startup code. 

It could also be tuned to do different things for normal and recovery mode boot, to make simulation environment even closer to a real chromes os device.
We can also update the CheckState() routine to print a warning but still return success if TPM is not initialized.
This would allow calling something like 'trunks_client --init_tpm' to initialize the TPM as firmware would. Otherwise, since trunksd is not running, trunks_client can't send any commands through it.

Comment 4 by ajha@chromium.org, Nov 29 2016

Labels: OS-Chrome
Project Member

Comment 5 by bugdroid1@chromium.org, Nov 30 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/aosp/platform/system/tpm/+/b5f6248c030f2653d79ae3dec8f27aa8234d2216

commit b5f6248c030f2653d79ae3dec8f27aa8234d2216
Author: Andrey Pronin <apronin@chromium.org>
Date: Mon Nov 28 18:00:09 2016

trunks: add 'open' to seccomp filters

When an error is detected in TpmUtility::CheckState(), trunksd crashes
when minijail blocks 'open' syscall. Can be seen on the simulator, where
there is no firmware to initialize the TPM.

BUG= chromium:669109 
TEST=Start on the simulator, no "blocked syscall: open" in logs.

Change-Id: I0de70ec798b8da77da1d53b0297fe217ee935155
Reviewed-on: https://chromium-review.googlesource.com/414952
Commit-Ready: Andrey Pronin <apronin@chromium.org>
Tested-by: Andrey Pronin <apronin@chromium.org>
Reviewed-by: Darren Krahn <dkrahn@chromium.org>

[modify] https://crrev.com/b5f6248c030f2653d79ae3dec8f27aa8234d2216/trunks/trunksd-seccomp-mips.policy
[modify] https://crrev.com/b5f6248c030f2653d79ae3dec8f27aa8234d2216/trunks/trunksd-seccomp-arm64.policy
[modify] https://crrev.com/b5f6248c030f2653d79ae3dec8f27aa8234d2216/trunks/trunksd-seccomp-amd64.policy
[modify] https://crrev.com/b5f6248c030f2653d79ae3dec8f27aa8234d2216/trunks/trunksd-seccomp-x86.policy
[modify] https://crrev.com/b5f6248c030f2653d79ae3dec8f27aa8234d2216/trunks/trunksd-seccomp-arm.policy
[modify] https://crrev.com/b5f6248c030f2653d79ae3dec8f27aa8234d2216/trunks/trunksd-seccomp-x86_64.policy

Status: Fixed (was: Untriaged)
Actually, the CL below also belongs to this issue: https://chromium-review.googlesource.com/#/c/415597/

Comment 7 by dchan@google.com, Mar 4 2017

Labels: VerifyIn-58

Comment 8 by dchan@google.com, Apr 17 2017

Labels: VerifyIn-59

Comment 9 by dchan@google.com, May 30 2017

Labels: VerifyIn-60
Labels: VerifyIn-61

Comment 11 by dchan@chromium.org, Oct 14 2017

Status: Archived (was: Fixed)

Sign in to add a comment