Re: [PATCH v4 1/1] tpm: add sysfs exports for all banks of PCR registers

[Jason Gunthorpe <jgg@nvidia.com>]

On Wed, Aug 19, 2020 at 08:17:11AM -0700, James Bottomley wrote:
> On Wed, 2020-08-19 at 09:02 -0300, Jason Gunthorpe wrote:
> > On Tue, Aug 18, 2020 at 02:55:50PM -0400, Mimi Zohar wrote:
> > 
> > > The problem is that there isn't just one single userspace library
> > > or application for reading PCRs.  So now not only is there the
> > > kernel "boot_aggregate" regression testing, but regression testing
> > > of the tool itself to support multiple methods of reading the PCRs.
> > 
> > I was thinking just open code 
> >   open("/dev/tpm")
> >   write(read_pcrs_cmd)
> 
> That's rather an over simplification.  The command takes a
> TPML_PCR_SELECTION structure which is, in turn, a packed array of
> TPMS_PCR_SELECTION which is a hash type and big endian packed bitmap.

Which is a fixed value, so at least the write is not a complete over
simplification, and this is a LTP where it is reasonable to directly
talk to the kernel.

Remember, the only reason we got here is because apparently there is
no sane single userspace library the LTP could use. Which seems crazy at
this point..

Your other reasons are more compelling, but they also sound like a
tool will be needed to do the other parts - and if we need a tool we
can't the tool read the PCRS progmatically too?

Especially if the tool has to parse log, call hashing functions and
unpack TPM keys already.

And to Mimi's other jab:

> "dysfunctional" is dropping existing TPM 1.2 sysfs support, which was
> done without consideration about existing applications/tools (e.g. ima-
> evm-utils, ltp) and without community input. 

Yes - it was dropped because TPM 2 was a *complete ABI break* for
everything. The kernel was reset to a uABI that matches current
uABI standards starting TPM 2.

The whole userspace needed to be redone anyhow, and certainly nobody
objected at the time.

At least my expecation was that a sensible userspace for TPM (for
administrator user) would be built, like we see in other subsystems eg
'ip' for netdev.

Jason