Messages in this thread | | | Subject | Re: [RFC PATCH] tpm: don't return -EINVAL if TPM command validation fails | From | Javier Martinez Canillas <> | Date | Fri, 17 Nov 2017 19:10:09 +0100 |
| |
On 11/17/2017 06:58 PM, Jason Gunthorpe wrote: > On Fri, Nov 17, 2017 at 06:56:09PM +0100, Javier Martinez Canillas wrote: > >> Yes, the problem with that is user-space not having enough information about >> what went wrong. Right now the TCTI layer just reports TSS2_BASE_RC_IO_ERROR >> in this case and can't be blamed. > > Well, if you care about the differnce between a transport failure and > a kernel rejection due to validation, then it needs to report a > different code :) >
Fair enough, the hard part I guess would be to decide which errno codes to use that could better map to the actual TPM_RC_COMMAND_{CODE,SIZE} response codes.
I'll give some thought to this and also discuss with the tpm2 tools/tss folks.
>>> Regarding your specific issue, can you make the command you want to >>> use validate? Would that make sense? >> >> Sorry, I'm not sure to understand what you meant. Could you please elaborate? > > Make it so tpm_validate will accept the command being sent. >
Right, that's what I understood indeed but wanted to be sure. The problem with that approach is that would not scale.
Since this particular TPM2 doesn't have support for the TPM2_EncryptDecrypt2 command, but some chips may not support others commands. So I rather prefer to have a consistent way for the kernel to report when a command is found to not be supported and user-space to understand it.
> Jason >
Best regards, -- Javier Martinez Canillas Software Engineer - Desktop Hardware Enablement Red Hat
| |