Am 05.01.2017 um 19:06 schrieb James Bottomley: > On Thu, 2017-01-05 at 10:27 -0700, Jason Gunthorpe wrote: >> On Thu, Jan 05, 2017 at 03:52:02PM +0000, Fuchs, Andreas wrote: >>> Great to see this coming along so well. Thanks a lot to Jarkko ! >>> The TPM allows an application to get the list of currently loaded >>> handles TPM2_GetCapabilities(TPM_CAP_HANDLES). It would be great >>> to have the RM be as transparent to userspace as possible. The RM >>> spec of TCG therefore says that you need to intercept and override >>> this >> I'd rather just ban unnecessary stuff like this on the RM fd. >> Tracking active handles can be done in userspace by the app >> itself. Debugging can be done by using the non-RM fd or debugfs. > Yes, we basically agreed on not doing this. The only handles that > actually need translating are the transient 0x80 ones. Since the RM > effectively segregates them, you can't see anyone else's, so the only > query could be about the application's own transient handles and it's > difficult to see how it could lose track of them and want to issue this > query. So the best course is to leave it unimplemented (less code) and > see if anyone complains because they have an actual use case.
Then how about blocking TPM2_GetCapabilities(TPM_CAP_HANDLES, 0x80000000) ? My concern is with a consistent view, so you either get the correct result or no result, but please no false results... ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, SlashDot.org! http://sdm.link/slashdot _______________________________________________ tpmdd-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/tpmdd-devel
