>=4.1.0 Cannot load device TCTI when compiled with clang #2840
Comments
|
From the output, the following seems to be most interesting: It uses the For those entries of default So I'm currently searching for what might be cause this, esp only on clang... |
|
I tried to reproduce on raspberry pi os with clang version 11 and did not find the bug. @salahcoronya Could you please run the following 3 commands and provide the log-files ? Thanks ! |
|
Here are the results (tests 1 and 3 truncated because they produce huge log files of the same output): |
|
Ok, so instead of loading the tcti-device it loads the tctildr recurively. Could you provide the outputs of Thanks a lot ! |
|
Here's the output (note things are in a different place in my system, and the "Split debug" option is enabled) |
|
That makes no sense... What does the strace say ? |
|
Again, log truncated because they produce huge log files of the same output |
|
If its helps, here's the output of the nm and xxd outputs without split debug: |
|
It would be interesting to see the combination of the tss trace and strace: |
|
Here it is (first 1,000 lines): |
|
Thank you for the trace. The correct so file tcti-device is loaded with dlopen but the generated handle provides the information about tctildr. |
|
Here is is running as root, which can access /dev/tpm0: |
|
Thank you again for the trace. My assumption was wrong that tcti-device did access /dev/tpm0. The open in the trace was caused by dlopen /dev/tpm0. |
|
Ok, so my current suspicion is the following: @salahcoronya Maybe you could check this by applying this patch: diff --git a/src/tss2-tcti/tcti-device.c b/src/tss2-tcti/tcti-device.c
index bfa6a94..3e7cd22 100644
--- a/src/tss2-tcti/tcti-device.c
+++ b/src/tss2-tcti/tcti-device.c
@@ -530,7 +530,7 @@ Tss2_Tcti_Device_Init (
return TSS2_RC_SUCCESS;
}
-const TSS2_TCTI_INFO tss2_tcti_info = {
+const TSS2_TCTI_INFO tss2_tcti_device_info = {
.version = TCTI_VERSION,
.name = "tcti-device",
.description = "TCTI module for communication with Linux kernel interface.",
@@ -542,5 +542,5 @@ const TSS2_TCTI_INFO tss2_tcti_info = {
const TSS2_TCTI_INFO*
Tss2_Tcti_Info (void)
{
- return &tss2_tcti_info;
+ return &tss2_tcti_device_info;
}and attempt again. In the meantime, I've started setting up a gentoo-VM in parallel, but that might take some time, since my schedule is quite full and I haven't used gentoo since 2005... Thanks for supporting in that matter ! P.S. if this ends up to be the problem, we will have to update all tctis, not just tcti-device... |
|
Ok, this is what we know: In
As @AndreasFuchsTPM said, this sounds like a namespace problem. I don't think your fix will solve the underlying issue. Yes, you can rename We might have to use |
|
So I did setup a KVM with a Gentoo livecd from today and a stage3 from today. @salahcoronya Could you provide me with information on how to setup a test-env for a KVM/libvirtd/virt-manager environment so that I could reproduce the issue here locally ? P.S. Is the a typical recent docker image that could be used in CI testing that you would recommend ? |
I always thought, that this was covered by But it seams like its only a guarantee on the reverse of what we have here. |
|
I tried he patch. It works for "tpm2_getrandom -Tdevice --hex 5". It does not work if -Tdevice is not specified. |
|
I use a KVM VM myself for testing tpm2-tss. There are offical docker images https://hub.docker.com/u/gentoo/. The only tricky part is tpm2-tss has to be compiled with clang and linked with lld, and gentoo uses gcc/ld.bfd by default. You'll need to set the "default-compiler-rt default-lld llvm-libunwind" USE flags on sys-devel/clang-common. Gentoo now has binary packages which should speed up the process: https://wiki.gentoo.org/wiki/Gentoo_Binary_Host_Quickstart . See https://wiki.gentoo.org/wiki/Clang to set up an environment file for tpm2-tss to compile with clang. |
|
@salahcoronya Perhaps we could try explicitly specifying RTLD_LOCAL to ensure that the symbol scope is local. diff --git a/src/tss2-tcti/tctildr-dl.c b/src/tss2-tcti/tctildr-dl.c
index d26219d2f..113e70262 100644
--- a/src/tss2-tcti/tctildr-dl.c
+++ b/src/tss2-tcti/tctildr-dl.c
@@ -108,7 +108,7 @@ handle_from_name(const char *file,
LOG_ERROR("TCTI name truncated in transform.");
return TSS2_TCTI_RC_BAD_VALUE;
}
- *handle = dlopen(file_xfrm, RTLD_NOW);
+ *handle = dlopen(file_xfrm, RTLD_LAZY | RTLD_LOCAL);
if (*handle != NULL) {
return TSS2_RC_SUCCESS;
} else {
|
|
No go. Same result as before: |
This was referenced May 17, 2024
Merged
|
@salahcoronya I was able to reproduce this in KVM. |
|
Yes, it works (I also tested it with tpm2-abrmd. That works too). |
|
I'm a bit busy the next few days but if needed I can help figure out CI as it should be doable. Also, wonderful work - thank you all. |
|
@thesamesam This would be highly appreciated. |
|
@salahcoronya 4.1.3 is released |
|
Not sure if this is helpful, but I just also noticed this issue appear in the latest development build of the tpm2-tss on Ubuntu using GCC. It does NOT occur in release 4.1.3, however. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
tpm2-tss-4.1.0 (and above) do not see to work when compiled with clang, at least for a real TPM. Currently ( see https://bugs.gentoo.org/931885 ) its being seen under Clevis, but I can replicate with tpm2-tools.
Here's the output from tpm2_selftest (with TPM2_LOG="tcti+DEBUG")
tpm2-tss-unstable.out.gz
Specifying the TCTI on the command line doesn't help, either.
The text was updated successfully, but these errors were encountered: