Bug 1700420

Summary:

[Inspur RHEL7.4 Feature] Does RHEL7.4 have a driver or API that can grab the TCG event log of TPM2.0?

Product:

Red Hat Enterprise Linux 7

Reporter:

liu.junbj

Component:

tpm2-tools

Assignee:

Jerry Snitselaar <jsnitsel>

Status:

CLOSED NOTABUG

QA Contact:

Vilém Maršík <vmarsik>

Severity:

high

Docs Contact:

Priority:

unspecified

Version:

7.4

CC:

aklimov, core-kernel-mgr, jsnitsel, liu.junbj, rvr, xiqin, xujin, zhangxufang

Target Milestone:

Keywords:

FutureFeature

Target Release:

---

Hardware:

x86_64

OS:

Linux

Whiteboard:

Fixed In Version:

Doc Type:

If docs needed, set a value

Doc Text:

Story Points:

---

Clone Of:

Environment:

Last Closed:

2019-10-22 17:42:00 UTC

Type:

Bug

Regression:

---

Mount Type:

---

Documentation:

---

CRM:

Verified Versions:

Category:

---

oVirt Team:

---

RHEL 7.3 requirements from Atomic Host:

Cloudforms Team:

---

Target Upstream Version:

Embargoed:

Attachments:

Description	Flags
sosreport	none

Description liu.junbj 2019-04-16 13:56:17 UTC

Description of problem:
Does RHEL7.4 have a driver or API that can grab the TCG event log of TPM2.0?
Is the driver interface available in RHEL7.4?
I understand that tpm2.0 in RHEL7.4 belongs to Technology Preview. If it is not supported in RHEL7.4, is it supported in the new version 7.5/7.6?

As mentioned in the release note of RHEL7.5 below, TCG event logs are supported. 
How are they used and how are event logs obtained?

https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.5_release_notes/new_features_virtualization
tboot rebased to version 1.96
The tboot packages have been upgraded to upstream version 1.96, which fixes several bugs and adds various enhancements. Notable changes include:
•	Support has been added for event logs of Trusted Computing Group (TCG) trusted platform modules (TPMs).

Version-Release number of selected component (if applicable):
RHEL7.4/RHEL7.5

Additional info:

Comment 3 xujin 2019-04-17 03:41:27 UTC

Dear Jerry, 

In the TPM 1.2, the customer can retrieve the TCG/TPM event log by invoke acpi_get_table from kernel. 

In TPM 2.0, TCG spec defines that it is optional to store TCG EVENT LOG with TPM ACPI method. 
But, in TPM 1.2, it is mandatory. 
Because of that , the BIOS vendor doesn't follow the spec of TPM 2.0 to put TCG event log to ACPI. 
So now, the customer can't use the original method to get TCG EVENT LOG. 

The customer would like to ask if there is any other method to retrieve LASA (Log Area Start Address) and LAML (Log Area Minimum Length). 
Is it possible from the SAPI (TPM 2.0 System API tpm2-tss)? 

And, the customer is a hardware vendor. 

Thank you.  


Best regards
Edward

Comment 4 liu.junbj 2019-04-17 09:31:03 UTC

Created attachment 1555803 [details]
sosreport

Comment 5 xujin 2019-04-23 09:37:44 UTC

Dear Jerry, 

Hope you are doing good. 

Do you have any update on this bug? 
Thank you. 


Best regards
Edward

Comment 6 Jerry Snitselaar 2019-05-09 18:10:59 UTC

RHEL7.4 does not. Tboot has its own code that is doing that. RHEL7.5 is the first kernel to have some tpm code that touches the tpm2 event log, and it looks to be measurement code. There might be something in Intel's or IBM's implementation of tss in userspace, but off the top of my head I don't know it.