lkml.org 
[lkml]   [2017]   [Jan]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH 1/2] tpm2: add session handle context saving and restoring to the space code
From
Date
On Thu, 2017-01-26 at 14:51 +0200, Jarkko Sakkinen wrote:
> On Mon, Jan 23, 2017 at 09:37:11PM -0800, James Bottomley wrote:
> > sessions are different from transient objects in that their handles
> > may not be virtualized (because they're used for some hmac
> > calculations). Additionally when a session is context saved, a
> > vestigial memory remains in the TPM and if it is also flushed, that
> > will be lost and the session context will refuse to load next time,
> > so the code is updated to flush only transient objects after a
> > context save. Add a separate array (chip->session_tbl) to save and
> > restore sessions by handle. Use the failure of a context save or
> > load to signal that the session has been flushed from the TPM and
> > we can remove its memory from chip->session_tbl.
> >
> > Sessions are also isolated during each instance of a tpm space.
> > This means that spaces shouldn't be able to see each other's
> > sessions and is enforced by ensuring that a space user may only
> > refer to sessions handles that are present in their own chip
> > ->session_tbl. Finally when a space is closed, all the sessions
> > belonging to it should be flushed so the handles may be re-used by
> > other spaces.
> >
> > Signed-off-by: James Bottomley <
> > James.Bottomley@HansenPartnership.com>
>
> I'm wondering if you ever need more than two sessions at once? If we
> would limit the number of sessions to that you could probably
> simplify a lot.

Three seems to be the agreed maximum: hmac authority, parameter
encryption and command audit.

I'll fix up the rest

James

\
 
 \ /
  Last update: 2017-01-26 16:19    [W:0.060 / U:0.904 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site