From: James Bottomley <James.Bottomley@HansenPartnership.com>
To: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Cc: zohar@linux.ibm.com, Omar Sandoval <osandov@osandov.com>,
Peter Huewe <peterhuewe@gmx.de>, Jason Gunthorpe <jgg@ziepe.ca>,
linux-integrity@vger.kernel.org
Subject: Re: [PATCH] tpm_tis: work around status register bug in STMicroelectronics TPM
Date: Tue, 21 Apr 2020 15:08:15 -0700 [thread overview]
Message-ID: <1587506895.3873.11.camel@HansenPartnership.com> (raw)
In-Reply-To: <20200421202355.GC46589@linux.intel.com>
On Tue, 2020-04-21 at 23:23 +0300, Jarkko Sakkinen wrote:
> On Mon, Apr 20, 2020 at 03:28:06PM -0700, James Bottomley wrote:
> > On Mon, 2020-04-20 at 23:46 +0300, Jarkko Sakkinen wrote:
[...]
> > > Does it matter?
> >
> > Not if you're the one telling Mimi ... and I'm at least 1 mile from
> > the blast radius.
> >
> > But more seriously: Nayna Jain did a series of patches improving
> > the time it takes to poll the TPM for operations precisely because
> > the TPM PCR extend was going so slowly:
> >
> > https://lore.kernel.org/linux-integrity/20180516055125.5685-1-nayna
> > @linux.vnet.ibm.com/
> >
> > I also reported the issue shortly after that patch was integrated,
> > but everyone seemed to think it was just a problem with my TPM chip
> > (it's an early Nuvoton field upgraded to 2.0):
> >
> > https://lore.kernel.org/linux-integrity/1531328689.3260.8.camel@Han
> > senPartnership.com/
>
> What if we make it dynamic? I.e. if the init code gets -ETIME, then
> increase the timeouts?
The problem is detecting that you need the updated timeouts. My tpm
doesn't fail in init. In fact it manages quite a healthy amount of key
operations before going offline. I'm a heavy TPM key user: I use RSA
keys for two VPNs, all my ssh keys and so on I got tired of the time
RSA takes, so my gpg keys are elliptic curve, but they're the only
ones. By the time my TPM fails, I've usually at least booted my
desktop, which means several tens of RSA operations have already
happened in the TPM.
James
next prev parent reply other threads:[~2020-04-21 22:08 UTC|newest]
Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-04-15 22:45 [PATCH] tpm_tis: work around status register bug in STMicroelectronics TPM Omar Sandoval
2020-04-15 23:51 ` James Bottomley
2020-04-16 0:16 ` Omar Sandoval
2020-04-16 0:24 ` Omar Sandoval
2020-04-16 18:02 ` James Bottomley
2020-04-17 23:55 ` Jarkko Sakkinen
2020-04-18 0:12 ` James Bottomley
2020-04-20 20:46 ` Jarkko Sakkinen
2020-04-20 22:28 ` James Bottomley
2020-04-21 14:36 ` Mimi Zohar
2020-04-21 20:25 ` Jarkko Sakkinen
2020-04-21 20:31 ` Mimi Zohar
2020-04-21 20:23 ` Jarkko Sakkinen
2020-04-21 22:08 ` James Bottomley [this message]
2020-04-16 17:09 ` Jarkko Sakkinen
2020-04-16 17:56 ` James Bottomley
2020-08-27 15:24 ` Jason Andryuk
2020-08-28 23:18 ` Jarkko Sakkinen
2020-08-29 0:12 ` Jason Andryuk
2020-08-31 13:55 ` Jarkko Sakkinen
2020-09-04 12:03 ` Jarkko Sakkinen
2020-04-16 17:08 ` Jarkko Sakkinen
2020-04-16 18:54 ` Omar Sandoval
2020-04-17 23:54 ` Jarkko Sakkinen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1587506895.3873.11.camel@HansenPartnership.com \
--to=james.bottomley@hansenpartnership.com \
--cc=jarkko.sakkinen@linux.intel.com \
--cc=jgg@ziepe.ca \
--cc=linux-integrity@vger.kernel.org \
--cc=osandov@osandov.com \
--cc=peterhuewe@gmx.de \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.