AI智能摘要
问题源于`qcom_scm_pas_auth_and_reset`函数返回异常,导致系统panic。日志分析发现tz处于忙碌状态,且`mfido`固件更新可能与问题相关。进一步分析显示,`mfido`在尝试读取公钥证书时失败,引发系统崩溃。
此摘要由AI分析文章内容生成,仅供参考。
一、问题背景
在工厂以及开发版本种,开始大批量高概率出现死机问题,经过分析都指向同一个原因tz
二、问题分析
[ 15.198352][ T1609] Kernel panic - not syncing: Panicking, auth and reset failed for remoteproc 6000000.remoteproc-mss ret=-16
[ 15.198362][ T1609] CPU: 2 PID: 1609 Comm: vndbinder:1545_ Tainted: G C OE 6.1.118-android14-11-maybe-dirty #1
[ 15.198368][ T1609] Hardware name: Qualcomm Technologies, Inc. Spring QRD (DT)
[ 15.198372][ T1609] Call trace:
[ 15.198376][ T1609] dump_backtrace+0xf4/0x11c
[ 15.198393][ T1609] show_stack+0x18/0x24
[ 15.198397][ T1609] dump_stack_lvl+0x60/0x90
[ 15.198407][ T1609] panic+0x160/0x3e8
[ 15.198412][ T1609] adsp_start+0x6e4/0x71c [qcom_q6v5_pas]
[ 15.198446][ T1609] rproc_start+0x174/0x2e0
[ 15.198454][ T1609] rproc_boot+0x49c/0x5ec
[ 15.198459][ T1609] rproc_cdev_write+0x194/0x278
[ 15.198464][ T1609] vfs_write+0x108/0x2e0
[ 15.198471][ T1609] ksys_write+0x78/0xe8
[ 15.198475][ T1609] __arm64_sys_write+0x1c/0x2c
[ 15.198479][ T1609] invoke_syscall+0x58/0x114
[ 15.198484][ T1609] el0_svc_common+0xb4/0xfc
[ 15.198489][ T1609] do_el0_svc+0x24/0x84
[ 15.198492][ T1609] el0_svc+0x2c/0x90
[ 15.198499][ T1609] el0t_64_sync_handler+0x68/0xb4
[ 15.198503][ T1609] el0t_64_sync+0x1a4/0x1a8
查看源码:
static int adsp_start(struct rproc *rproc)
{
/////.....................
ret = qcom_scm_pas_auth_and_reset(adsp->pas_id);
if (ret)
panic("Panicking, auth and reset failed for remoteproc %s ret=%d\n",
////....................
}
可以看到是这块主动panic的,原因是因为qcom_scm_pas_auth_and_reset函数返回值异常,分析这个函数可以或者该函数的功能为发送scm指令给tz
同时查看日志
[ 14.315144][ T1413] QSEECOM: __qseecom_scm_call2_locked: re-sending syscall with TZ busy
tz当前处于busy状态
--> 查看qseelog
[014dad861]<8>mfido: "FIDOTA Version : 2.a0.10"
[014daddb8]<8>mfido: "Read Pubkey Certificate"
[014daec7a]<8>mfido: "rpmb init fail 0xffffffeb"
[014daee37]<8>mfido: "rpmb init fail"
[014daeef9]<8>mfido: "read pubkey cert fail, failover"
[014db1e46]<8>mfido: "USE_SFS:0"
[014db2bcf]<8>mfido: "read 560 bytes from /mnt/vendor/persist/data/mfido/66706b63"
[014dbd7f4]<8>widevine: DRM Library unloaded
[014de0472]<8>widevine: Error at function init_hw_support_for_video_offload_sessions line 1047
[014de082c]<8>widevine: Error at function init_hw_support_for_audio_offload_sessions line 1069
[014dffec1]<8>mfido: "open record fail - read, eno: 2"
[014e001b3]<8>mfido: "read pubkey cert fail"
[014e002ae]<8>mfido: "fido_ta Init: Read Pubkey Certificate Failed."
解析tzdiaglog得到
29460x00000000000758FE | 14.695269: QSEECOM: __qseecom_unload_app: scm_call to unload app (id = 11) failed ret: -16
29730x000000000007783D | 14.939378: Kernel panic - not syncing: Panicking, auth and reset failed for remoteproc 6000000.remoteproc-mss ret=-16
0x0000000014D889B2 | 18.215383: QSee Diag <2>qwes: tz_app_init[95]: QWES TA Start 1.0
0x000000001512F7C0 | 18.414823: QSee Diag <16>miriskm: =================================
0x000000001512FAC6 | 18.414864: QSee Diag <16>miriskm: tz_app_init success, version:1
0x00000000152976F7 | 18.491613: QSee Diag <8>widevine: DRM Library unloaded
0x00000000154563BB | 18.586930: QSee Diag <8>mfido: "FIDOTA Version : 2.a0.10"
0x00000000154568FA | 18.587000: QSee Diag <8>mfido: "Read Pubkey Certificate"
0x00000000154575B8 | 18.587170: QSee Diag <8>mfido: "rpmb init fail 0xffffffeb"
0x0000000015457685 | 18.587180: QSee Diag <8>mfido: "rpmb init fail"
0x000000001545771A | 18.587188: QSee Diag <8>mfido: "read pubkey cert fail, failover"
0x0000000015457816 | 18.587201: QSee Diag <8>mfido: "USE_SFS:0"
0x0000000015458156 | 18.587324: QSee Diag <8>mfido: "read 560 bytes from /mnt/vendor/persist/data/mfido/66706b63"
0x00000000154921FD | 18.599707: QSee Diag <8>widevine: Error at function init_hw_support_for_video_offload_sessions line 1047
0x000000001549257E | 18.599753: QSee Diag <8>widevine: Error at function init_hw_support_for_audio_offload_sessions line 1069
0x00000000154EC064 | 18.618885: QSee Diag <8>mfido: "open record fail - read, eno: 2"
0x00000000154EC325 | 18.618922: QSee Diag <8>mfido: "read pubkey cert fail"
0x00000000154EC48D | 18.618941: QSee Diag <8>mfido: "fido_ta Init: Read Pubkey Certificate Failed."
0x00000000163074FA | 19.389293: Diag TZBSP_EC_SYSCALL_DENIED_DPC_BLOCKED
0x00000000163076E6 | 19.389319: Diag TZBSP_SYSCALL_SMC_ERR_ID : tzbsp_syscall, smc_id->72000102
0x000000001630786F | 19.389339: Diag TZBSP_SYSCALL_SMC_RET_VAL : tzbsp_syscall, return value->fffffff4 //tz busying
0x0000000016307FA1 | 19.389435: Diag TZBSP_EC_SYSCALL_DENIED_DPC_BLOCKED
0x000000001630814D | 19.389457: Diag TZBSP_SYSCALL_SMC_ERR_ID : tzbsp_syscall, smc_id->72000602
0x00000000163082D7 | 19.389478: Diag TZBSP_SYSCALL_SMC_RET_VAL : tzbsp_syscall, return value->fffffff4
0x0000000016352E8A | 19.405421: Diag TZBSP_EC_SYSCALL_DENIED_DPC_BLOCKED
0x000000001635321C | 19.405468: Diag TZBSP_SYSCALL_SMC_ERR_ID : tzbsp_syscall, smc_id->c2000603
0x00000000163533A6 | 19.405489: Diag TZBSP_SYSCALL_SMC_RET_VAL : tzbsp_syscall, return value->fffffff4
0x000000001638B4E7 | 19.417452: Diag TZBSP_EC_SYSCALL_DENIED_DPC_BLOCKED
|-----------------------------------------------------------------------|
| TATASK[0] |
| - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - |
| Tasked: TRUE |
| Refs: 1 |
| View TLS Using: v.v (TATaskTLS*)0x59DC8DB60 |
| TLS: |
| threadBlocked: 0x000000059DCAA5B0 mfido |
| result: 0
-000|SMCInvoke_inboundIpc(inline)
-000|smc_invoke(inBuf_ptr = 0x9EC14000, inBuf_len = 0x1000, outBuf_ptr = ?, outBuf_len = ?, is_cache_coherent = ?, smc_rsp = 0x000000059DB6DAC0)
-001|qsee_smc_invoke_cc(inBuf_ptr = ?, inBuf_len = ?, outBuf_ptr = ?, outBuf_len = ?, smc_rsp = ?)
-002|route_to_svc_impl(pArgs = 0x000000059DC814B0)
-003|callWithOutLock(tls = 0x000000059DC81490)
-004|ServiceThread_accept(cxt = 0x000000059DC81140)
-005|initial_thread_func()
-006|initial_thread_func()
---|end of frame
可以确定问题为mfido导致
三、根本原因
安全同事提交了一笔mfido固件的更新提交导致