New issue
Advanced search Search tips

Issue 830130 link

Starred by 2 users

Issue metadata

Status: Started
Owner:
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Chrome
Pri: 1
Type: Bug


Participants' hotlists:
TPM-Userland-Robustness


Sign in to add a comment

cryptohome: retry all tpm commands in case of comm errors

Project Member Reported by apronin@chromium.org, Apr 7 2018

Issue description

If an error code returned from a trousers or trunks TSS call (called from tpm_impl and tpm2_impl) indicates a communication error, cryptohomed should retry the command a few times before giving up. 

cryptohomed already has retry logic in certain places, but it doesn't cover at least some of the initialization operations during the first boot. See b/33758106#comment100 for an example of this.
 
Cc: semenzato@chromium.org
Owner: louiscollard@chromium.org
Louis will work on this.
Project Member

Comment 3 by bugdroid1@chromium.org, Jun 1 2018

Labels: merge-merged-master-0.3.13
The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/third_party/trousers/+/2ba9706f576d1a0026ab1da6af9034b311683849

commit 2ba9706f576d1a0026ab1da6af9034b311683849
Author: Louis Collard <louiscollard@chromium.org>
Date: Fri Jun 01 10:51:57 2018

trousers: Retry I/O errors when communicating with the TPM.

Writes/reads will be retried up a number of times specified by the
TCSD_TPM_RW_RETRY_COUNT environment variable, or a default of 3
times if this is not set.

BUG=chromium:830130
TEST=ran live test locally with modified kernel that fails 50% of reads/writes, checks test passes and messages printed

Change-Id: I5a0d4d45bfa2ee415ac0c807883c679b5fdbf5b1
Reviewed-on: https://chromium-review.googlesource.com/1051489
Commit-Ready: Louis Collard <louiscollard@chromium.org>
Tested-by: Louis Collard <louiscollard@chromium.org>
Reviewed-by: Andrey Pronin <apronin@chromium.org>

[modify] https://crrev.com/2ba9706f576d1a0026ab1da6af9034b311683849/src/tddl/tddl.c

As analyzed in http://b/33758106#comment125, 

1) Low-level retries in tcsd from comment #3 don't cover all use cases. For authorized commands, if the comm issue happened when receiving a response, retrying the old command won't work (session nonce on TPM side has already changed). To cover those case we need retries for high-level ops, starting with launching the auth session.

2) for some platforms, we also have attestationd in tpm 1.2 case, so either we should switch to cryptohome-based attestation there; or implement high-level retries in attestationd as well (and that is still useful for 2.0 case).
ack, I'll revisit the high-level retries  work
Status: Started (was: Assigned)
Components: OS>Systems>Security
Labels: TPM-Userland-Robustness

Sign in to add a comment