linux-kernel - Re: [PATCH V6] efi/tpm: Fix the issue where the CC platforms event log header can't be correctly identified

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <e3be6b181ce1eb47b89fdeb945ff4831793af15b.camel@HansenPartnership.com>
Date: Tue, 15 Jul 2025 16:51:50 -0400
From: James Bottomley <James.Bottomley@...senPartnership.com>
To: yangge1116@....com, ardb@...nel.org
Cc: jarkko@...nel.org, sathyanarayanan.kuppuswamy@...ux.intel.com, 
	ilias.apalodimas@...aro.org, jgg@...pe.ca, linux-efi@...r.kernel.org, 
	linux-kernel@...r.kernel.org, stable@...r.kernel.org, liuzixing@...on.cn
Subject: Re: [PATCH V6] efi/tpm: Fix the issue where the CC platforms event
 log header can't be correctly identified

On Sat, 2025-07-12 at 11:24 +0800, yangge1116@....com wrote:
> From: Ge Yang <yangge1116@....com>
> 
> Since commit d228814b1913 ("efi/libstub: Add get_event_log() support
> for CC platforms") reuses TPM2 support code for the CC platforms,
> when launching a TDX virtual machine with coco measurement enabled,
> the following error log is generated:
> 
> [Firmware Bug]: Failed to parse event in TPM Final Events Log
> 
> Call Trace:
> efi_config_parse_tables()
>   efi_tpm_eventlog_init()
>     tpm2_calc_event_log_size()
>       __calc_tpm2_event_size()
> 
> The pcr_idx value in the Intel TDX log header is 1, causing the
> function __calc_tpm2_event_size() to fail to recognize the log
> header, ultimately leading to the "Failed to parse event in TPM Final
> Events Log" error.
> 
> Intel misread the spec and wrongly sets pcrIndex to 1 in the header
> and since they did this, we fear others might, so we're relaxing the
> header check. There's no danger of this causing problems because we
> check for the TCG_SPECID_SIG signature as the next thing.
> 
> Fixes: d228814b1913 ("efi/libstub: Add get_event_log() support for CC
> platforms")
> Signed-off-by: Ge Yang <yangge1116@....com>
> Cc: stable@...r.kernel.org

Reviewed-by: James Bottomley <James.Bottomley@...senPartnership.com>