Re-Initialize PCR0 on HCRTM Event

tcg/eventlog_test.go

@@ -16,7 +16,9 @@ package tcg
 
 import (
 	"bytes"
+	"crypto"
 	"encoding/base64"
+	"encoding/hex"
 	"encoding/json"
 	"os"
 	"testing"
@@ -391,3 +393,64 @@ YWNrLHRvbW95byxicGYgcGFuaWM9MzAgaTkxNS5lbmFibGVfcHNyPTA=`)
 		}
 	}
 }
+
+func TestReplayPCRSWithHCRTM(t *testing.T) {
+	decodeHex := func(input string) []byte {
+		decoded, err := hex.DecodeString(input)
+		if err != nil {
+			t.Fatalf("Failed to hex decode %q: %v", input, err)
+		}
+
+		return decoded
+	}
+
+	testDigest := "806fcb3c4d6ee3afc8eca3d420a48c206fb23803fcbd593eebba2b1df20c322c"
+	testMR := register.PCR{
+		Index:     0,
+		DigestAlg: crypto.SHA256,
+		Digest:    decodeHex(testDigest),
+	}
+
+	hcrtmEvent := rawEvent{
+		sequence: 1,
+		index:    0,
+		typ:      EFIHCRTMEvent,
+		data:     []byte("HCRTM"),
+		digests: []digest{
+			{crypto.SHA256, decodeHex("abababababababababababababababababababababababababababababababab")},
+		},
+	}
+
+	testcases := []struct {
+		events        []rawEvent
+		expectSuccess bool
+	}{
+		{
+			events:        []rawEvent{hcrtmEvent},
+			expectSuccess: true,
+		},
+		{
+			events: []rawEvent{
+				{
+					// Dummy event.
+					sequence: 0,
+					index:    0,
+					typ:      EFIEventBase,
+					data:     []byte("testevent"),
+					digests: []digest{
+						{crypto.SHA256, decodeHex("cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd")},
+					},
+				},
+				hcrtmEvent,
+			},
+			expectSuccess: false,
+		},
+	}
+
+	for _, tc := range testcases {
+		_, ok := replayPCR(tc.events, testMR)
+		if ok != tc.expectSuccess {
+			t.Errorf("replayPCR(%v, %v) returned %v, want %v", tc, testMR, ok, tc.expectSuccess)
+		}
+	}
+}

tcg/pfpformat.go

@@ -381,6 +381,17 @@ func replayPCR(rawEvents []rawEvent, mr register.MR) ([]Event, bool) {
 			}
 			continue
 		}
+
+		if e.typ == EFIHCRTMEvent {
+			// Expect HCRTM to be the first event in the register.
+			if len(replay) != 0 {
+				return nil, false
+			}
+
+			// HCRTM resets the PCR to {0, ... 0, 4} prior to extending.
+			replay = append(bytes.Repeat([]byte{0x00}, mr.DgstAlg().Size()-1), byte(0x04))
+		}
+
 		replayValue, digest, err := extend(mr, replay, e, locality)
 		if err != nil {
 			return nil, false