Re: [tpm2] Policy check fails writing to NVRAM > 512B

[Tadeusz Struk <tadeusz.struk at intel.com>]

[-- Attachment #1: Type: text/plain, Size: 3735 bytes --]

On 06/11/2018 11:20 PM, Gabriela Limonta Márquez wrote:
> Hi,
> 
> I have updated the tpm2 software stack to use
> 
> tpm2-tss @ 2.0.0_rc3
> tpm2-abrmd @ 2.0.0_rc0
> tpm2-tools @ 3.1.0-rc0
> 
> I am trying to write a file to NVRAM and seal it using a simple policy
> ​ (sha256:0)​
> .
> 
> I can create the policy and define the NVRAM. However, when I try writing to it it fails with a policy check error:
> 
> $ tpm2_nvrelease -x 0x1800005 -a 0x40000001
> 
> $ tpm2_pcrlist -L sha256:0 -o pcr.value
> sha256 :
>   0  : d8a76f44656e5b7ed75ddc6c19071d8594e99edb67c54c0f5f562a8bdaa26bbf
> 
> $ tpm2_createpolicy -P -L sha256:0 -F pcr.value -f policy
> 
> $ tpm2_nvdefine -x 0x1800005 -a 0x40000001 -s 700 -L policy -t "policyread|policywrite"
> 
> $ tpm2_nvwrite -x  0x1800005 -a 0x1800005 -L sha256:0 -F pcr.value ta_config.cfg -V
> INFO on line: "125" in file: "tools/tpm2_nvwrite.c": The data(size=512) to be written:
> INFO on line: "141" in file: "tools/tpm2_nvwrite.c": Success to write NV area at index 0x1800005 (25165829) offset 0x0.
> INFO on line: "125" in file: "tools/tpm2_nvwrite.c": The data(size=131) to be written:
> ERROR on line: "136" in file: "tools/tpm2_nvwrite.c": Failed to write NV area at index 0x1800005 (25165829) offset 0x200. Error:0x99d
> ERROR on line: "168" in file: "tools/tpm2_tool.c": Unable to run tpm2_nvwrite
> 
> $ tpm2_rc_decode 0x99d
> error layer
>   hex: 0x0
>   identifier: TSS2_TPM_RC_LAYER
>   description: Error produced by the TPM
> format 1 error code
>   hex: 0x1d
>   identifier: TPM2_RC_POLICY_FAIL
>   description: a policy check failed
> session
>   hex: 0x100
>   identifier: TPM2_RC_1
>   description:  (null)
> 
> From the verbose output I can see that the first 512 bytes are successfully written, and it only fails the policy check for the remaining 131 bytes.
> ​I don't think this is a policy ​failure, since the policy check succeeds for the first 512 bytes and the policy is defined with PCR0 of the sha256 bank which is not changing.
> 
> 
> ​My guess is that it was related to the size of the file I was trying to write to NVRAM, so​
>  I tried writing a smaller file (< 512) and that succee
> ​ds​
> .
> 
> $ tpm2_nvwrite -x  0x1800005 -a 0x1800005 -L sha256:0 -F pcr.value ta2_config.cfg -V
> INFO on line: "125" in file: "tools/tpm2_nvwrite.c": The data(size=273) to be written:
> INFO on line: "141" in file: "tools/tpm2_nvwrite.c": Success to write NV area at index 0x1800005 (25165829) offset 0x0.
> 54504d5f454b5f4b45595f48414e444c45203d202230783831303130303032220a54504d5f414b5f4b45595f48414e444c45203d202230783831303130303033220a54504d5f484153485f414c474f524954484d203d2022736861323536220a4d53475f46494c45203d20222f746d702f71756f74652e6d7367220a5349474e41545552455f46494c45203d20222f746d702f71756f74652e736967220a51554f54455f46494c45203d20222f746d702f71756f74652e71756f74220a51554f54455f4a534f4e5f46494c45203d20222f746d702f71756f74652e6a736f6e220a454b5f46494c45203d20222f746d702f656b2e707562220a414b5f46494c45203d20222f746d702f616b2e707562220a%  
> 
> I only have this problem when using policies. If I define NVRAM without any policies I can write the file successfully even if the size is larger than 512.
> 
> Does anyone have any idea what might be going on?
> 
> Thanks in advance!
> 
> Best regards,
> Gabriela Limonta

Hi Gabriela,
My first guess is that the TCTI performs two partial writes internally and after the first partial write the policy digest
gets updated. Could you please enable TCTI debug info and try to write the big buffer again.
The debug info can be turned on by:
export TSS2_LOG="all+ERROR,tcti+TRACE"

Thanks,
-- 
Tadeusz