ReadPCRs returns empty map without error when using SHA256 about go-tpm

[twitchy-jsonp]

ReadPCRs will return whatever the TPM gave you back:

go-tpm/tpm2/tpm2.go

Lines 151 to 180 in d331077

	func decodeReadPCRs(in []byte) (map[int][]byte, error) {
	buf := bytes.NewBuffer(in)
	var updateCounter uint32
	if err := tpmutil.UnpackBuf(buf, &updateCounter); err != nil {
	return nil, err
	}
	sel, err := decodeOneTPMLPCRSelection(buf)
	if err != nil {
	return nil, err
	}
	var digestCount uint32
	if err = tpmutil.UnpackBuf(buf, &digestCount); err != nil {
	return nil, fmt.Errorf("decoding TPML_DIGEST length: %v", err)
	}
	if int(digestCount) != len(sel.PCRs) {
	return nil, fmt.Errorf("received %d PCRs but %d digests", len(sel.PCRs), digestCount)
	}
	vals := make(map[int][]byte)
	for _, pcr := range sel.PCRs {
	var val tpmutil.U16Bytes
	if err = tpmutil.UnpackBuf(buf, &val); err != nil {
	return nil, fmt.Errorf("decoding TPML_DIGEST item: %v", err)
	}
	vals[pcr] = val
	}
	return vals, nil
	}

At a guess, it looks like your TPM responded to the command with a success response containing none of the PCRs.

This sounds like a hardware/firmware bug, though I will note that its not unusual to need to call this method multiple times to get a full set of PCRs. For example:

https://github.com/google/go-attestation/blob/b89180c3eb71f62c4f0bdf45d9323f8571d3129e/attest/tpm.go#L255-L280

[josephlr]

@lihanshang two questions:

1. What happens if you only specify PCRs 0-7?
2. What happens if you use the sudo tpm2_pcrread command from tpm2-tools (Github Link, Centos Package).

[chrisfenner]

From TPM Spec, Part 3: 22.4 TPM2_PCR_Read

The returned list may be empty if none of the selected PCR are implemented.

It sounds like only the SHA1 PCRs are currently implemented/enabled on your system. Typically, there is a BIOS option to toggle which banks are enabled. Can you check to see if your BIOS settings have some options for this?

[lihanshang]

Hey Guys.
Thanks for your replies and I have some update:

So after I read the PCRs using SHA1, I was able to read using SHA256. To reproduce this I reboot the machine and try using SHA256 and it stopped working. It is like using SHA1 trigger something for SHA256.

Any idea about this behaviour?

Plus: I am using centos 7 with only tpm2-tools 3.x version on it. This is a remote host that I may not be able to check the BIOS.

Thank you very much!