[RFC PATCH 7/8] ima-evm-utils: use a common bank variable for TPM 1.2 and TPM 2.0

From: Mimi Zohar <zohar@linux.ibm.com>
To: linux-integrity@vger.kernel.org
Cc: Roberto Sassu <roberto.sassu@huawei.com>,
	Vitaly Chikunov <vt@altlinux.org>,
	Patrick Uiterwijk <puiterwi@redhat.com>,
	Petr Vorel <pvorel@suse.cz>, Mimi Zohar <zohar@linux.ibm.com>
Subject: [RFC PATCH 7/8] ima-evm-utils: use a common bank variable for TPM 1.2 and TPM 2.0
Date: Fri, 21 Feb 2020 13:38:57 -0500	[thread overview]
Message-ID: <1582310338-1562-8-git-send-email-zohar@linux.ibm.com> (raw)
In-Reply-To: <1582310338-1562-1-git-send-email-zohar@linux.ibm.com>

Extend read_tpm_banks() to support TPM 1.2, by reading TPM 1.2 SHA1 PCRs
into the first bank and mark the other banks as disabled.

Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
---
 src/evmctl.c | 37 ++++++++++++++++++++++++++++++-------
 1 file changed, 30 insertions(+), 7 deletions(-)

diff --git a/src/evmctl.c b/src/evmctl.c
index 9e21d3963556..49ce7ea2ce1a 100644
--- a/src/evmctl.c
+++ b/src/evmctl.c
@@ -1399,7 +1399,7 @@ static int tpm_pcr_read(int idx, uint8_t *pcr, int len)
 	char *p, pcr_str[7], buf[70]; /* length of the TPM string */
 	int result = -1;
 
-	sprintf(pcr_str, "PCR-%d", idx);
+	sprintf(pcr_str, "PCR-%2.2d", idx);
 
 	fp = fopen(pcrs, "r");
 	if (!fp)
@@ -1844,8 +1844,26 @@ static void extend_tpm_banks(struct template_entry *entry, int num_banks,
 #endif
 }
 
+/* Read TPM 1.2 PCRs */
+static int read_tpm_pcrs(int num_banks, struct tpm_bank_info *tpm_banks)
+{
+	int i;
+
+	for (i = 0; i < NUM_PCRS; i++) {
+		if (tpm_pcr_read(i, tpm_banks[0].pcr[i], SHA_DIGEST_LENGTH)) {
+			log_debug("Failed to read TPM 1.2 PCRs.\n");
+			return -1;
+		}
+	}
+
+	tpm_banks[0].supported = 1;
+	for (i = 1; i < num_banks; i++)
+		tpm_banks[i].supported = 0;
+	return 0;
+}
+
 /*
- * Attempt to read TPM PCRs from the multiple TPM 2.0 banks.
+ * Attempt to read TPM PCRs from either TPM 1.2 or multiple TPM 2.0 banks.
  *
  * On success reading from any TPM bank, return 0.
  */
@@ -1856,12 +1874,17 @@ static int read_tpm_banks(int num_banks, struct tpm_bank_info *bank)
 	int i, j;
 	int err;
 
+	/* First try reading PCRs from exported TPM 1.2 securityfs file */
+	if (read_tpm_pcrs(num_banks, bank) == 0)
+		return 0;
+
 	/* Any userspace applications available for reading TPM 2.0 PCRs? */
 	if (!tpm2_pcrread) {
-		log_info("Failed to read TPM 2.0 PCRs\n");
+		log_debug("Failed to read TPM 2.0 PCRs\n");
 		return 1;
 	}
 
+	/* Read PCRs from multiple TPM 2.0 banks */
 	for (i = 0; i < num_banks; i++) {
 		err = 0;
 		for (j = 0; j < NUM_PCRS && !err; j++) {
@@ -1869,8 +1892,8 @@ static int read_tpm_banks(int num_banks, struct tpm_bank_info *bank)
 					    bank[i].pcr[j], bank[i].digest_size,
 					    &errmsg);
 			if (err) {
-				log_info("Failed to read %s PCRs: (%s)\n",
-					 bank[i].algo_name, errmsg);
+				log_debug("Failed to read %s PCRs: (%s)\n",
+					  bank[i].algo_name, errmsg);
 				free(errmsg);
 				bank[i].supported = 0;
 			}
@@ -1991,8 +2014,8 @@ static int ima_measurement(const char *file)
 
 	if (!verify_failed)
 		err = 0;
-	else if (read_tpm_banks(num_banks, tpm_banks) != 0)
-		log_info("Failed to read TPM 2.0 PCRs\n");
+	if (read_tpm_banks(num_banks, tpm_banks) != 0)
+		log_info("Failed to read any TPM PCRs\n");
 	else
 		err = compare_tpm_banks(num_banks, pseudo_banks, tpm_banks);
 
-- 
2.7.5

