search

tpm2-software / tpm2-tss

OSS implementation of the TCG TPM2 Software Stack (TSS2)
https://tpm2-software.github.io
BSD 2-Clause "Simplified" License
753 stars 365 forks source link

CEL events for PCR 0 is included when Fapi_PcrRead is called for other PCR #2454

Closed whooo closed 2 years ago

whooo commented 2 years ago

In some tpm2-pytss tests we call Fapi_PcrRead with a PCR > 0, but with latest master all CEL events for PCR 0 are included in the response

whooo commented 2 years ago

I should mention that this affects Fapi_Quote as well

williamcroberts commented 2 years ago

@JuergenReppSIT I have no idea what to do with this, could you help out?

JuergenReppSIT commented 2 years ago

Only events which do not change PCR 0 (e.g. CEL management events) are included if PCR 0 is not in the PCR list. They are related to the firmware events. @AndreasFuchsTPM If the PCR selection produces a list without firmware events, should we omit these events?

whooo commented 2 years ago

I see the EV_NO_ACTION firmware log header as well unless I disable the firmware log parsing

JuergenReppSIT commented 2 years ago

yes that's the SPECID event which also is not extended to PCR0. @AndreasFuchsTPM @whooo @williamcroberts or should we omit all these events if PCR0 is not selected?

williamcroberts commented 2 years ago

@AndreasFuchsTPM @whooo @williamcroberts or should we omit all these events if PCR0 is not selected?

I am not familiar enough with that API to have any reasonable answer, im assuming we're talking about the log file that comes in through the char **pcrLog argument?

whooo commented 2 years ago

I don't think the SpecID and firmware end events should be included, unless PCR 0 is requested as they are only used when looking at at firmware events. Perhaps the CEL version event should only be included if the response contains other CEL events? If an application extends for example PCR 23 with it's own data and then requests the events for that does the version event make sense?