Re: [TrouSerS-tech] tcsi_caps_tpm.c patch

[Hal F. <hal...@gm...>]

This is another example of what I was talking about with the patches.
It is not Solaris related at all, is it?

And isn't it possible that resetting the TPM like this would break
other persistent state that the TCS daemon may be relying on, like
loaded keys?

Hal

On Tue, Dec 9, 2008 at 6:20 AM, Wyllys Ingersoll
<wyl...@su...> wrote:
> Changes:
> * Some TPMs (ATML) fail to release auth sessions when certain
> GetCapability functions fail
>  and will quickly run out of sessions effectively DOS-ing the chip.
> This fix
>  resets the TPM after such a failure so the auth sessions are cleared.
>
> *** src/tcs/tcsi_caps_tpm.c.old Fri Dec  5 07:52:01 2008
> --- src/tcs/tcsi_caps_tpm.c     Fri Dec  5 07:53:26 2008
> ***************
> *** 61,66 ****
> --- 61,83 ----
>        return result;
>  }
>
> + #ifdef __sun__
> + static TSS_RESULT
> + reset_tpm()
> + {
> +       char reset[] = {
> +               0, 193,         /* TPM_TAG_RQU_COMMAND */
> +               0, 0, 0, 10,    /* length */
> +               0, 0, 0, 90     /* TPM_ORD_Reset */
> +       };
> +       TSS_RESULT ret;
> +
> +       ret = req_mgr_submit_req(reset);
> +
> +       return (ret);
> + }
> + #endif /* __sun__ */
> +
>  TSS_RESULT
>  TCSP_GetCapabilityOwner_Internal(TCS_CONTEXT_HANDLE hContext, /* in */
>                                 TPM_AUTH * pOwnerAuth,         /* in /
> out */
> ***************
> *** 91,97 ****
> --- 108,122 ----
>        if (!result) {
>                result = tpm_rsp_parse(TPM_ORD_GetCapabilityOwner,
> txBlob, paramSize, pVersion,
>                                       pNonVolatileFlags,
> pVolatileFlags, pOwnerAuth);
> + #ifndef __sun__
>        }
> + #else
> +       } else if (result == 0x0a) {
> +               /* ATML TPMs do not release the auth sessions when this
> command fails */
> +               /* so we force a reset to avoid running out of sessions. */
> +               (void) reset_tpm();
> +       }
> + #endif /* __sun__ */
>
>        LogResult("GetCapowner", result);
>  done: