On 9/6/2017 12:12 PM, Jason Gunthorpe wrote:

The problem with this approach is that the TPM could totally block
the CPU for very long periods of time.

It seems very risky to enable..

How would you characterize "very long"?

The TPM vendors confirm that they empty the FIFO at internal speeds that
are comparable to the bus speed.  Thus, any stall will be sub-usec.  Is
that an issue?

In addition, new TPMs have ever larger FIFO's, making stalls less likely
going forward.

--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html