From nobody Thu Sep 03 04:05:14 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hb5bZ35THz6qWYq for ; Thu, 03 Sep 2026 04:05:14 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hb5bZ2D6Vz3sBL for ; Thu, 03 Sep 2026 04:05:14 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1788408314; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=W1gICAtL27Z6Zb+eHIy6a3tbMzJzwCY1svdxc6W0Aws=; b=HunN8goCf2fQUDm4MWhrzwXPgPye/h1UQ+FOvOiDY1gokbPYKs+W6JJmu9DaJFgpHxpMZE Cm9apDYOVCr5i1MGYxCIORwXIVAOZRVD+/W+NsHsdGmoBfQ6fUREEBhPaJT1ZoigYwlMQt dHAvzfMaymVTlQ2j7yMjh42518U9WKq6uspkLoig1PMRT7PbryczXAxYWVb4u6uChUzXTr rinjXrP9CUdDEn0QUTOiN/ttB1NPmkSmsE/oSDzuZ/434RQZTgb9qi1rOovMuR9RMbwTDu 2wnD4MQcDHuRFXyih38HhCQcM9pU2o4H+fBwXs8IMsQXoKsUwCDBJpKwyJTKCQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1788408314; a=rsa-sha256; cv=none; b=QWC+ImGNDevsZtfSQ5W2NrYsHOcIaOm1FsFNo/kR0PB6zclIoajewmLi1D/b0me3tSnwSk AYR/OOOzZgsRvk1z44MprxnNUV+T5B3GU+Q6zomnVrYIlZKh4W5zNLIPv2ubO2ymBUApN5 hGJDRFXsyGGwcue3ILjN/u1VNtoJBzbWYkb9yPgxd4kAK9/juwflAd/QOjfPpQDJbCTJb3 GFcmaEUjBD+Zm0X00xIRRg0gd2Z+RBbRvM0Xof9ccUXUEPBJljzy3ZNOaYrvtj4ySI9R+f vhDUJOX4QzLHh1JQ5a+iFMawxagdyeWBfTBMbeQ5zY/LE/VyTMOXDGEmxdVc/w== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1788408314; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=W1gICAtL27Z6Zb+eHIy6a3tbMzJzwCY1svdxc6W0Aws=; b=FPWFToDbKnHuSuSpKKTkQjb6cSaa09ZU3FMcEfr9iyEnLTr9UqM0/NxBG8gPDkPKlHXbhW zK4eFsNy4dg0iktM7Gqe4dOM7HwnFOqEXz7O3rjrTZmeEKp40u9xhFEifnsQOBbI6LpK/H sFmRtDmLLODhdYtCX6iKOD/TS6qI63DE31XKRYD5UwmlXJEHo+/DMtwT5GWIQEPrXZuUpu sb2wIFePVB2QAQyqQKnlQAYp6tZZPoY1Z+fv1KenS91GXncgC8fIPNZ4NvRekJlpDGGrzy cvPy7v66CIm/tplKP/nM7nxp2ZvNVbmtlZd35aMQ0DIarFStHki8opC9pYPZjQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hb5bZ0vshz1CQV for ; Thu, 03 Sep 2026 04:05:14 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 398ac by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Thu, 03 Sep 2026 04:05:14 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Kevin Bowling Subject: git: 74c539fd1cef - main - tpm20: Move user copies outside the lifecycle lock List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kbowling X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 74c539fd1cefdbc993411274c613434c3f23b4b1 Auto-Submitted: auto-generated Date: Thu, 03 Sep 2026 04:05:14 +0000 Message-Id: <6a98f1fa.398ac.282eddc3@gitrepo.freebsd.org> The branch main has been updated by kbowling: URL: https://cgit.FreeBSD.org/src/commit/?id=74c539fd1cefdbc993411274c613434c3f23b4b1 commit 74c539fd1cefdbc993411274c613434c3f23b4b1 Author: Kevin Bowling AuthorDate: 2026-08-27 14:06:55 +0000 Commit: Kevin Bowling CommitDate: 2026-09-03 04:03:32 +0000 tpm20: Move user copies outside the lifecycle lock The TPM 2.0 character-device methods held the global device lock while uiomove() accessed user memory. User page faults could therefore delay suspend or detach even though the read response was already buffered. Add a per-open sleepable lock to serialize operations on each response buffer. Stage commands under that lock before acquiring the device lock, and copy them into the response buffer only after the lifecycle checks succeed. This preserves an unread response when suspend or detach rejects a write. Release the device lock before copying buffered responses out. Also advance the response offset by the bytes actually copied when uiomove() returns after a partial transfer. Validated on an Intel TPM 2.0 TIS device. PCR reads and GetRandom passed under 16-process mixed command load. A response was consumed correctly in 5-byte, 7-byte, and remainder reads. Module unload/reload recreated the device and entropy source without lock diagnostics. Source inspection confirmed rejected writes preserve unread responses. Reviewed by: kevans MFC after: 2 weeks Sponsored by: BBOX.io Differential Revision: https://reviews.freebsd.org/D59245 --- sys/dev/tpm/tpm20.c | 37 +++++++++++++++++++++++++++++-------- sys/dev/tpm/tpm20.h | 1 + 2 files changed, 30 insertions(+), 8 deletions(-) diff --git a/sys/dev/tpm/tpm20.c b/sys/dev/tpm/tpm20.c index bebf0af400fa..6c96f1ce848d 100644 --- a/sys/dev/tpm/tpm20.c +++ b/sys/dev/tpm/tpm20.c @@ -86,6 +86,7 @@ tpm20_read(struct cdev *dev, struct uio *uio, int flags) struct tpm_priv *priv; size_t bytes_to_transfer; size_t offset; + ssize_t resid; int result; sc = (struct tpm_sc *)dev->si_drv1; @@ -93,27 +94,36 @@ tpm20_read(struct cdev *dev, struct uio *uio, int flags) if (result != 0) return (result); + sx_xlock(&priv->io_lock); sx_xlock(&sc->dev_lock); if (atomic_load_bool(&sc->dying)) { result = ENXIO; - goto out; + goto out_locked; } if (sc->suspended) { result = EBUSY; - goto out; + goto out_locked; } offset = priv->offset; bytes_to_transfer = MIN(priv->len, uio->uio_resid); + sx_xunlock(&sc->dev_lock); + if (bytes_to_transfer > 0) { - result = uiomove((caddr_t) priv->buf + offset, bytes_to_transfer, uio); + resid = uio->uio_resid; + result = uiomove((caddr_t)priv->buf + offset, + (int)bytes_to_transfer, uio); + bytes_to_transfer = resid - uio->uio_resid; priv->offset += bytes_to_transfer; priv->len -= bytes_to_transfer; } else { result = 0; } + sx_xunlock(&priv->io_lock); + return (result); -out: +out_locked: sx_xunlock(&sc->dev_lock); + sx_xunlock(&priv->io_lock); return (result); } @@ -122,6 +132,7 @@ tpm20_write(struct cdev *dev, struct uio *uio, int flags) { struct tpm_sc *sc; struct tpm_priv *priv; + uint8_t *command; size_t byte_count; int result; @@ -143,6 +154,12 @@ tpm20_write(struct cdev *dev, struct uio *uio, int flags) return (E2BIG); } + command = malloc(byte_count, M_TPM20, M_WAITOK); + sx_xlock(&priv->io_lock); + result = uiomove(command, byte_count, uio); + if (result != 0) + goto out_priv; + sx_xlock(&sc->dev_lock); if (atomic_load_bool(&sc->dying)) { result = ENXIO; @@ -153,14 +170,16 @@ tpm20_write(struct cdev *dev, struct uio *uio, int flags) goto out; } - result = uiomove(priv->buf, byte_count, uio); - if (result != 0) - goto out; - + memcpy(priv->buf, command, byte_count); result = TPM_TRANSMIT(sc->dev, priv, byte_count); out: sx_xunlock(&sc->dev_lock); + if (result != 0) + uio->uio_resid = byte_count; +out_priv: + sx_xunlock(&priv->io_lock); + free(command, M_TPM20); return (result); } @@ -170,6 +189,7 @@ tpm20_priv_alloc(void) struct tpm_priv *priv; priv = malloc(sizeof (*priv), M_TPM20, M_WAITOK | M_ZERO); + sx_init(&priv->io_lock, "TPM per-open I/O lock"); return (priv); } @@ -178,6 +198,7 @@ tpm20_priv_dtor(void *data) { struct tpm_priv *priv = data; + sx_destroy(&priv->io_lock); free(priv, M_TPM20); } diff --git a/sys/dev/tpm/tpm20.h b/sys/dev/tpm/tpm20.h index 1d7a11265b02..f210cd84c331 100644 --- a/sys/dev/tpm/tpm20.h +++ b/sys/dev/tpm/tpm20.h @@ -110,6 +110,7 @@ MALLOC_DECLARE(M_TPM20); struct tpm_priv { + struct sx io_lock; uint8_t buf[TPM_BUFSIZE]; size_t offset; size_t len;