Linux-Integrity Archive on
 help / color / Atom feed
From: Mimi Zohar <>
To: James Bottomley <>,
Cc: Jarkko Sakkinen <>
Subject: Re: [PATCH 1/1] tpm: add sysfs exports for all banks of PCR registers
Date: Tue, 21 Jul 2020 08:30:27 -0400
Message-ID: <> (raw)
In-Reply-To: <>

Hi James,

On Mon, 2020-07-20 at 08:00 -0700, James Bottomley wrote:
> use macro magic to create sysfs per hash groups with 24 PCR files in
> them one for each possible agile hash of the TPM.  The files are
> plugged in to a read function which is TPM version agnostic, so this
> works also for TPM 1.2 although the hash is only sha1 in that case.
> For every hash the TPM supports, a group named pcr-<hash> is created
> and each of the PCR read files placed under it.
> Signed-off-by: James Bottomley <>

Nice!  Being able to read the TPM 2.0 PCRs, without requiring a TSS,
will really simplify regression testing - re-calculating the IMA
"boot_aggregate" and verifying the IMA measurement list.

With the following code snippet all of the PCRs for all the exported
TPM banks are displayed, but unfortunately the digests are not ordered
or prefixed with the PCR.

banks=$(echo -n $(ls -d /sys/class/tpm/tpm0/pcr-*))

for bank in ${banks[@]}; do
        echo "$bank:"
        find "${bank}/" -type f -exec cat {} \;
        echo " "

Either this code snippet needs to be fixed or, perhaps, instead of
returning just the digest, the digest could be prefixed with the PCR
number (eg. PCR-00:<digest>).

FYI, with this patch on a system with TPM 1.2, IMA goes into TPM-
bypass mode.

From dmesg (with some extra debugging):
tpm_chip_register: tpm_add_legacy_sysfs failed
tpm_tis: probe of 00:05 failed with error -2


  reply index

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-07-20 15:00 [PATCH 0/1] add sysfs exports for TPM 2 " James Bottomley
2020-07-20 15:00 ` [PATCH 1/1] tpm: add sysfs exports for all banks of " James Bottomley
2020-07-21 12:30   ` Mimi Zohar [this message]
2020-07-21 15:06     ` James Bottomley
2020-07-21 15:47       ` Mimi Zohar
2020-07-21 15:52         ` James Bottomley

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Linux-Integrity Archive on

Archives are clonable:
	git clone --mirror linux-integrity/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-integrity linux-integrity/ \
	public-inbox-index linux-integrity

Example config snippet for mirrors

Newsgroup available over NNTP:

AGPL code for this site: git clone