On 9/18/2017 2:02 PM, Jarkko Sakkinen wrote:

Other than context gap it would probably make sense to estimate TPM
capacity in order to make implementation more intelligent. We could
measure memory capacity of a TPM in the driver initialization by filling
it with fixed size dummy objects.

TPM2_GetCapability gives stuff that cannot be really trusted as spec
compliant TPM HW could just return always '1' for max.

I don't see anything in the TPM specs that claim the TPM can return 1.

E.g., the PC Client spec says that loaded sessions must return a minimum 
of 3.  Active sessions must return a minimum of 64.

I think the resource manager can safely use these getcapability values.

--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html