Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1550086 > unrolled thread

Re: [PATCH RFC 4/4] tpm: add the infrastructure for TPM space for TPM 2.0

Back to article view | Back to linux.kernel

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Re: [PATCH RFC 4/4] tpm: add the infrastructure for TPM space for  TPM 2.0 Jason Gunthorpe <jgunthorpe@obsidianresearch.com> - 2017-01-03 19:50 +0100
    Re: [PATCH RFC 4/4] tpm: add the infrastructure for TPM space for  TPM 2.0 Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> - 2017-01-04 13:50 +0100

#1550086 — Re: [PATCH RFC 4/4] tpm: add the infrastructure for TPM space for TPM 2.0

On Tue, Jan 03, 2017 at 02:37:30AM +0200, Jarkko Sakkinen wrote:
> On Mon, Jan 02, 2017 at 02:09:53PM -0700, Jason Gunthorpe wrote:
> > On Mon, Jan 02, 2017 at 03:22:10PM +0200, Jarkko Sakkinen wrote:
> > > Added a ioctl for creating a TPM space. The space is isolated from the
> > > other users of the TPM. Only a process holding the file with the handle
> > > can access the objects and only objects that are created through that
> > > file handle can be accessed.
> > 
> > I don't understand this comment. /dev/tpmX is forced to be
> > single-process-open, so how can there ever be more than 1 FD for it?
> > 
> > Since the space is tied to that single fd these patches just create a
> > way for the single user-space process to auto-cleanup if it crashes?
> > 
> > Is that the entire intent of this design? I guess it is OK as a
> > stepping point..
> 
> is_open is cleared in tpm_ioc_new_space.

That is no good, it is racy if the intention is to use multiple
clients, and any single client that doesn't support the new API blocks
all access.

Jason

[toc] | [next] | [standalone]

#1550740

On Tue, Jan 03, 2017 at 11:46:27AM -0700, Jason Gunthorpe wrote:
> On Tue, Jan 03, 2017 at 02:37:30AM +0200, Jarkko Sakkinen wrote:
> > On Mon, Jan 02, 2017 at 02:09:53PM -0700, Jason Gunthorpe wrote:
> > > On Mon, Jan 02, 2017 at 03:22:10PM +0200, Jarkko Sakkinen wrote:
> > > > Added a ioctl for creating a TPM space. The space is isolated from the
> > > > other users of the TPM. Only a process holding the file with the handle
> > > > can access the objects and only objects that are created through that
> > > > file handle can be accessed.
> > > 
> > > I don't understand this comment. /dev/tpmX is forced to be
> > > single-process-open, so how can there ever be more than 1 FD for it?
> > > 
> > > Since the space is tied to that single fd these patches just create a
> > > way for the single user-space process to auto-cleanup if it crashes?
> > > 
> > > Is that the entire intent of this design? I guess it is OK as a
> > > stepping point..
> > 
> > is_open is cleared in tpm_ioc_new_space.
> 
> That is no good, it is racy if the intention is to use multiple
> clients, and any single client that doesn't support the new API blocks
> all access.

Luckily this will be implicitly fixed with a separate device file 
in the non-RFC patch set :-)

> Jason

/Jarkko

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web