Understanding TPM PCRs, PCR banks, indexes and their relations

Question

I'm reading about TPM, and I'm currently thinking how to visualize their relationships.

Basically, reading from https://link.springer.com/chapter/10.1007/978-1-4302-6584-9_12 (and the TPM documents) I gather the following:

PCR: It is a memory register that stores the output of a hash algorithm. A PCR can store the output of more than one hash algorithm. An example is the output of 256 bits for SHA-256.

Question: Can a PCR store simultaneously output from multiple types of hash algorithms? Or are PCRs are tied to some specific hash algorithm? I think only the latest hashed value of any given operation is saved (and concatenated with the previous). But I'm not sure if multiple hash algorithms can use the same PCRs simultaneously (e.g. like operating shadow registers or a stack).

PCR bank: a PCR bank is a set, or a collection, of PCRs that are used to store the output of the same type of hash algorithm. As for an example, output of SHA-256 or an SHA-1 algorithm would be disjoint PCR banks. However, I don't know if the underlying PCRs used by these banks could be the same. So, effectively a PCR bank would be a way to group PCRs together logically, but they could use the same underlying PCRs.

PCR Index: Points to some PCR.

PCR Attribute: This is some attribute a PCR has, such as being resettable. If an attribute is applicable to some index location in one bank, it is applicable across all PCR banks on the same index.

Not all PCR banks are required to have the same number of PCRs, so they need not be equally large.

The main reason I'm considering visualization is that I'm not sure how should one understand PCR indexing and attributes. The usual images online are like

PCR[0]  = [what's in this this cell?]
PCR[1]  = 
.
.
.
PCR[23] = [what's in this scell]

But if the idea is like PCR[Index], then what is the size and number of each of the cells? Is there only one cell width of which is the maximum width needed to store the output of the hash algorithm that produces the longest output? Or does it mean there are multiple cells of some fixed with?

That is, if there's both SHA-1 and SHA-256, then PCR[23].length = 256 bits or PCR[23][0].length = 256 bits?

I also think the case of attribute confuse me here. I.e. is it so that for each of those indexes PCR[n] there are multiple cells of length denoted by the hashing algorithm? It makes me feel there should be a concept of attribute index, which would index this system like matrix:

          [Attr1]   [Attr2]
PCR[0]  = [pcr0-0], [pcr0-1], ... [???]
PCR[1]  = [pcr1-0], [pcr1-1], ... [???]
.
.
.
PCR[23] = [pcr23-0], [pcr23-1], ... [???]

So I'm trying to understand how PCRs related to indexes and attributes. I may come across unclear as this feels a bit confusing.

This edit is after @saurabh wrote the excellent answer. But maybe this clarifies what I'm thinking. I used TSS.MSR to dump out PCR data. Basically I used the library to get indexes and loop through them by a PCR bank and dumping out the context of each of the PCR banks as far I understand the situation. Now I wonder if this is in fact a good way, or correct way, to think of this situation?

Sha has registers at index:
0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23
Index[0],  Buffer[0]: 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
Index[1],  Buffer[1]: 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
Index[2],  Buffer[2]: 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
Index[3],  Buffer[3]: 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
Index[4],  Buffer[4]: 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
Index[5],  Buffer[5]: 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
Index[6],  Buffer[6]: 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
Index[7],  Buffer[7]: 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
Index[8],  Buffer[0]: 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
Index[9],  Buffer[1]: 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
Index[10], Buffer[2]: 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
Index[11], Buffer[3]: 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
Index[12], Buffer[4]: 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
Index[13], Buffer[5]: 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
Index[14], Buffer[6]: 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
Index[15], Buffer[7]: 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
Index[16], Buffer[0]: 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
Index[17], Buffer[1]: FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF
Index[18], Buffer[2]: FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF
Index[19], Buffer[3]: FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF
Index[20], Buffer[4]: FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF
Index[21], Buffer[5]: FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF
Index[22], Buffer[6]: FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF
Index[23], Buffer[7]: 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00

Sha256 has registers at index:
0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23
Index[0],  Buffer[0]: 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
Index[1],  Buffer[1]: 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
Index[2],  Buffer[2]: 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
Index[3],  Buffer[3]: 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
Index[4],  Buffer[4]: 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
Index[5],  Buffer[5]: 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
Index[6],  Buffer[6]: 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
Index[7],  Buffer[7]: 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
Index[8],  Buffer[0]: 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
Index[9],  Buffer[1]: 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
Index[10], Buffer[2]: 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
Index[11], Buffer[3]: 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
Index[12], Buffer[4]: 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
Index[13], Buffer[5]: 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
Index[14], Buffer[6]: 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
Index[15], Buffer[7]: 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
Index[16], Buffer[0]: 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
Index[17], Buffer[1]: FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF
Index[18], Buffer[2]: FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF
Index[19], Buffer[3]: FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF
Index[20], Buffer[4]: FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF
Index[21], Buffer[5]: FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF
Index[22], Buffer[6]: FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF-FF
Index[23], Buffer[7]: 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00


ExtendL0 is supported by registers:
0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 23

ResetL0 is supported by registers:
16,23

Answer 1

PCR:

PCR in TPM has specific properties for e.g. SHA1-PCR can store only sha1 hash around 20bytes. Generally, TPM comes with 24PCR's per supported hash algorithm. So, in TPM 2.0 you will find minimum of 48 PCR's (SHA1 and SHA2). The size that can be stored in each PCR is defined by the associated hashing algorithm, which can be updated as per policy defined for the PCR.

Read: tpm2

PCR banks:

So, effectively a PCR bank would be a way to group PCRs together logically but they could use the same underlying PCRs.

This is possible, but I'm not sure. As per the specification from TCG:

It is possible for a single PCR to record all log entries.However, this would make it difficult to evaluate the different stages of platform evolution as it boots into the operating system. Normally, multiple PCR are provided in a TPM to allow simplification of the evaluation

So, for simplification multiple PCR's can be provided from the vendor but if multiple hashes can be stored is platform specific I think. For e.g. in Infenion SLB 9665 TPM2.0 when you list the PCR through command line it will show 24 PCR in each SHA1 and SHA2 bank which means 48 PCR (logically maybe). But if you read the specification document, it has only 24 PCR:

24 PCRs (SHA-1 or SHA-256)

PCR Attributes:

Over here I think you are trying to understand how mapping is done w.r.t index and PCR. Below explanation might be helpful:

As per specification, multiple PCR at a given index is possible, with each using a different hashing algorithm. So, attributes of all PCR with same index are same in all the banks (Algorithm may differ). Operation on PCR at index 0 will affect PCR in all bank at index 0. (Better explanation could be found in above TCG link)

tpm2_pcrlist on Debian list one PCR with index 0:

sha1 :
0 : 0000000000000000000000000000000000000003

sha256 :
0 : 0000000000000000000000000000000000000000000000000000000000000003

So, I think the mapping with index and attributes is done w.r.t to PCR banks.