linux-kernel - Re: [PATCH V4] efi/tpm: Fix the issue where the CC platforms event log header can't be correctly identified

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <757cd21fb4eaebf0f89af1a5290c6f6665f66bae.camel@HansenPartnership.com>
Date: Fri, 11 Jul 2025 07:00:47 -0700
From: James Bottomley <James.Bottomley@...senPartnership.com>
To: yangge1116@....com, ardb@...nel.org
Cc: jarkko@...nel.org, sathyanarayanan.kuppuswamy@...ux.intel.com, 
	ilias.apalodimas@...aro.org, jgg@...pe.ca, linux-efi@...r.kernel.org, 
	linux-kernel@...r.kernel.org, stable@...r.kernel.org, liuzixing@...on.cn
Subject: Re: [PATCH V4] efi/tpm: Fix the issue where the CC platforms event
 log header can't be correctly identified

On Tue, 2025-07-08 at 15:54 +0800, yangge1116@....com wrote:
> From: Ge Yang <yangge1116@....com>
> 
> Since commit d228814b1913 ("efi/libstub: Add get_event_log() support
> for CC platforms") reuses TPM2 support code for the CC platforms,
> when launching a TDX virtual machine with coco measurement enabled,
> the following error log is generated:
> 
> [Firmware Bug]: Failed to parse event in TPM Final Events Log
> 
> Call Trace:
> efi_config_parse_tables()
>   efi_tpm_eventlog_init()
>     tpm2_calc_event_log_size()
>       __calc_tpm2_event_size()
> 
> The pcr_idx value in the Intel TDX log header is 1, causing the
> function __calc_tpm2_event_size() to fail to recognize the log
> header, ultimately leading to the "Failed to parse event in TPM Final
> Events Log" error.
> 
> According to UEFI Specification 2.10, Section 38.4.1: For TDX, TPM
> PCR 0 maps to MRTD, so the log header uses TPM PCR 1 instead. To
> successfully parse the TDX event log header, the check for a pcr_idx
> value of 0 must be skipped.
> 
> According to Table 6 in Section 10.2.1 of the TCG PC Client
> Specification, the index field does not require the PCR index to be
> fixed at zero. Therefore, skipping the check for a pcr_idx value of
> 0 for CC platforms is safe.

This is wrong: the spec does not allow a header EV_ACTION to be
recorded with anything other than pcrIndex == 0.

However, the fact that Intel, who practically wrote the TPM spec, can
get this wrong shows that others can too.  So the best way to fix this
is to remove the pcrIndex check for the first event.  There's no danger
of this causing problems because we check for the TCG_SPECID_SIG
signature as the next thing.  That means you don't need to thread
knowledge of whether this is a CC environment and we're pre-emptively
ready for any other spec violators who misread the spec in the same way
Intel did.

Regards,

James