Description of problem: Does RHEL7.4 have a driver or API that can grab the TCG event log of TPM2.0? Is the driver interface available in RHEL7.4? I understand that tpm2.0 in RHEL7.4 belongs to Technology Preview. If it is not supported in RHEL7.4, is it supported in the new version 7.5/7.6? As mentioned in the release note of RHEL7.5 below, TCG event logs are supported. How are they used and how are event logs obtained? https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.5_release_notes/new_features_virtualization tboot rebased to version 1.96 The tboot packages have been upgraded to upstream version 1.96, which fixes several bugs and adds various enhancements. Notable changes include: • Support has been added for event logs of Trusted Computing Group (TCG) trusted platform modules (TPMs). Version-Release number of selected component (if applicable): RHEL7.4/RHEL7.5 Additional info:
Dear Jerry, In the TPM 1.2, the customer can retrieve the TCG/TPM event log by invoke acpi_get_table from kernel. In TPM 2.0, TCG spec defines that it is optional to store TCG EVENT LOG with TPM ACPI method. But, in TPM 1.2, it is mandatory. Because of that , the BIOS vendor doesn't follow the spec of TPM 2.0 to put TCG event log to ACPI. So now, the customer can't use the original method to get TCG EVENT LOG. The customer would like to ask if there is any other method to retrieve LASA (Log Area Start Address) and LAML (Log Area Minimum Length). Is it possible from the SAPI (TPM 2.0 System API tpm2-tss)? And, the customer is a hardware vendor. Thank you. Best regards Edward
Created attachment 1555803 [details] sosreport
Dear Jerry, Hope you are doing good. Do you have any update on this bug? Thank you. Best regards Edward
RHEL7.4 does not. Tboot has its own code that is doing that. RHEL7.5 is the first kernel to have some tpm code that touches the tpm2 event log, and it looks to be measurement code. There might be something in Intel's or IBM's implementation of tss in userspace, but off the top of my head I don't know it.