linux-kernel - Re: [PATCH V3] efi/tpm: Fix the issue where the CC platforms event log header can't be correctly identified

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ec847802-5189-461a-a372-f81839938579@126.com>
Date: Fri, 11 Jul 2025 09:23:56 +0800
From: Ge Yang <yangge1116@....com>
To: James Bottomley <James.Bottomley@...senPartnership.com>, ardb@...nel.org
Cc: jarkko@...nel.org, sathyanarayanan.kuppuswamy@...ux.intel.com,
 ilias.apalodimas@...aro.org, jgg@...pe.ca, linux-efi@...r.kernel.org,
 linux-kernel@...r.kernel.org, stable@...r.kernel.org, liuzixing@...on.cn
Subject: Re: [PATCH V3] efi/tpm: Fix the issue where the CC platforms event
 log header can't be correctly identified



在 2025/7/11 5:58, James Bottomley 写道:
> On Mon, 2025-07-07 at 11:14 +0800, yangge1116@....com wrote:
>> The pcr_idx value in the Intel TDX log header is 1, causing the
>> function __calc_tpm2_event_size() to fail to recognize the log
>> header, ultimately leading to the "Failed to parse event in TPM Final
>> Events Log" error.
>>
>> According to UEFI Specification 2.10, Section 38.4.1: For TDX, TPM
>> PCR 0 maps to MRTD, so the log header uses TPM PCR 1 instead. To
>> successfully parse the TDX event log header, the check for a pcr_idx
>> value of 0 must be skipped.
> 
> I think someone has misread the spec.  EV_NO_ACTION events produce no
> PCR extension.  So the PCR value zero is conventional (and required by
> the TCG) since nothing gets logged.  Therefore even if you're
> technically using PCR0 for something else EV_NO_ACTION events should
> still have the conventional PCR = 0 value to conform to the TCG spec.
> I assume it's too late to correct this in the implementation?
> 

According to Table 14 in Section 10.4.1 of the TCG PC Client 
Specification, for EV_NO_ACTION events, the PCR (Platform Configuration 
Register) value can be 0 or other values, such as 6.

Link: 
https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClient_PFP_r1p05_v23_pub.pdf

>>   __calc_tpm2_event_size(struct tcg_pcr_event2_head *ev
>>   	count = event->count;
>>   	event_type = event->event_type;
>>   
>> -	/* Verify that it's the log header */
>> -	if (event_header->pcr_idx != 0 ||
>> +	/*
>> +	 * Verify that it's the log header. According to the TCG PC
>> Client
>> +	 * Specification, when identifying a log header, the check
>> for a
>> +	 * pcr_idx value of 0 is not required. For CC platforms,
>> skipping
>> +	 * this check during log header is necessary; otherwise, the
>> CC
>> +	 * platform's log header may fail to be recognized.
>> +	 */
>> +	if ((!is_cc_event && event_header->pcr_idx != 0) ||
>>   	    event_header->event_type != NO_ACTION ||
>>   	    memcmp(event_header->digest, zero_digest,
>> sizeof(zero_digest))) {
>>   		size = 0;
> 
> The above is just a heuristic to recognize an EV_NO_ACTION event as
> zero size.  All the TCG specs require that EV_NO_ACTION have pcr 0 in
> the event, but if the heuristic is wrong because of Intel/CC spec
> violations which can't be fixed, then we should update the heuristic
> ... so I don't think you need to thread the is_cc_event.

It seems that the TCG specifications do not stipulate that the 
EV_NO_ACTION event must have PCR 0. In addition, adding is_cc_event can 
maximize the reuse of TPM code for CC platforms without disrupting TPM 
functionality; otherwise, new functions would need to be added for CC 
platforms.

Please review the latest patch. Patch link: 
https://lore.kernel.org/lkml/1751961289-29673-1-git-send-email-yangge1116@126.com/

> 
> Regards,
> 
> James