m-iwanicki
commented
5 months ago @miczyg1 https://github.com/Dasharo/open-source-firmware-validation/pull/322 fixes this issue. Tests pass when only 1 bank is active. First test in this case is skipped.
In case neither SHA1 or SHA256 PCR bank is enabled then first test fails and tests 2-4 are skipped (not sure if needed).
Tested on Protectli v1210:
Checking if tpm2-tools is installed...
Package tpm2-tools is installed
TPMCMD001.001 Check if both SHA1 and SHA256 PCRs are enabled (Ubun... | SKIP |
Only one bank is enabled
------------------------------------------------------------------------------
TPMCMD002.001 PCRREAD Function Verification (Ubuntu 22.04) :: This... | PASS |
------------------------------------------------------------------------------
TPMCMD003.001 PCREXTEND And PCRRESET Functions (Ubuntu 22.04) :: T... | PASS |
------------------------------------------------------------------------------
TPMCMD003.002 PCREXTEND And PCRRESET Functions - locality protecti... | PASS |
------------------------------------------------------------------------------
TPMCMD004.001 PCREVENT Function (Ubuntu 22.04) :: This test aims t... | PASS |
------------------------------------------------------------------------------
TPMCMD005.001 CREATEPRIMARY Function Verification (Ubuntu 22.04) :... | PASS |
------------------------------------------------------------------------------
TPMCMD006.001 NVDEFINE and NVUNDEFINE Functions Verification (Ubun... | PASS |
------------------------------------------------------------------------------
TPMCMD007.001 CREATE Function (Ubuntu 22.04) :: This test aims to ... | PASS |
------------------------------------------------------------------------------
TPMCMD007.002 CREATELOADED Function (Ubuntu 22.04) :: This test ai... | PASS |
------------------------------------------------------------------------------
TPMCMD008.001 Signing the file (Ubuntu 22.04) :: Check whether the... | PASS |
------------------------------------------------------------------------------
TPMCMD009.001 Encryption and Decryption of the file (Ubuntu 22.04)... | SKIP |
TPM doesn't supports TPM2_EncryptDecrypt nor TPM2_EncryptDecrypt2
------------------------------------------------------------------------------
TPMCMD010.001 Hashing the file (Ubuntu 22.04) :: Check whether the... | PASS |
------------------------------------------------------------------------------
TPMCMD011.001 Performing HMAC operation on the file (Ubuntu 22.04)... | PASS |
------------------------------------------------------------------------------
Tpm2-Commands | PASS |
13 tests, 11 passed, 0 failed, 2 skipped
==============================================================================Test on QEMU with only SHA512 bank enabled (and temporarily removed tpm2_pcrallocate from Suite Setup)
TPMCMD001.001 Check if both SHA1 and SHA256 PCRs are enabled (Ubun... | FAIL |
'False' should be true.
------------------------------------------------------------------------------
TPMCMD002.001 PCRREAD Function Verification (Ubuntu 22.04) :: This... | SKIP |
No PCR banks enabled
------------------------------------------------------------------------------
TPMCMD003.001 PCREXTEND And PCRRESET Functions (Ubuntu 22.04) :: T... | SKIP |
No PCR banks enabled
------------------------------------------------------------------------------
TPMCMD003.002 PCREXTEND And PCRRESET Functions - locality protecti... | SKIP |
No PCR banks enabled
------------------------------------------------------------------------------
TPMCMD004.001 PCREVENT Function (Ubuntu 22.04) :: This test aims t... | SKIP |
No PCR banks enabled
------------------------------------------------------------------------------
TPMCMD005.001 CREATEPRIMARY Function Verification (Ubuntu 22.04) :... | PASS |
------------------------------------------------------------------------------
(...)
macpijan
Device
Any
Dasharo version
Any
Affected component(s) or functionality
Test cases in dasharo-security/tpm2-commands.robot in OSFV.
Brief summary
Test cases in dasharo-security/tpm2-commands.robot in OSFV test for SHA1 and SHA256 PCRs presence assuming both are always enabled. The test case should take into account platforms that have only fTPM. fTPM may have only one bank active on Intel platforms, so this test has 0% chance to pass.
How reproducible
Always on platforms with PTT.
How to reproduce
Run test suite on MSI platforms or Protectli V1x10
Expected behavior
Test checks for active banks and verified the PCRs based on active banks instead.
TPMCMD001.001 Check if both SHA1 and SHA256 PCRs are enabledis only valid for discrete TPMs which typically have both SHA1 and SHA256 banks active simultaneously.Actual behavior
Test assume that SHA1 and SHA256 banks are always active which leads to a test failure on platforms with fTPM/
Screenshots
No response
Additional context
Solutions you've tried
No response