On 11/17/2017 1:17 PM, Jason Gunthorpe wrote:
On Fri, Nov 17, 2017 at 07:10:09PM +0100, Javier Martinez Canillas wrote:
Right, that's what I understood indeed but wanted to be sure. The problem with
that approach is that would not scale.
Since this particular TPM2 doesn't have support for the TPM2_EncryptDecrypt2
command, but some chips may not support others commands.
No, tpm_validate is not supposed to be sensitive to what commands the
TPM supports. It is only supposed to check if the command passed is
fully understood by the kernel and is properly formed.
This is to prevent rouge user space from sending garbage or privileged
commands to the TPM.
If it is refusing TPM2_EncryptDecrypt2, and that command is safe to
use in the spaces system, then tpm_validate must learn how to handle
it, or userspace can never use it.
Do you really want to build in an every expanding list of commands that
the kernel has to screen for? I don't think so.
Remember that there are new commands, optional commands, and vendor
proprietary commands. What's the rationale for only looking at the
command code and not rest of the parameters?
To me, the simplest solution, and the easiest for the application
developer to debug, is to pass through any command possible.
