[PATCH V4] efi/tpm: Fix the issue where the CC platforms event log header can't be correctly identified

[PATCH V4] efi/tpm: Fix the issue where the CC platforms event log header can't be correctly identified

[yangge1116]

From: Ge Yang <yangge1116@126.com>

Since commit d228814b1913 ("efi/libstub: Add get_event_log() support
for CC platforms") reuses TPM2 support code for the CC platforms, when
launching a TDX virtual machine with coco measurement enabled, the
following error log is generated:

[Firmware Bug]: Failed to parse event in TPM Final Events Log

Call Trace:
efi_config_parse_tables()
  efi_tpm_eventlog_init()
    tpm2_calc_event_log_size()
      __calc_tpm2_event_size()

The pcr_idx value in the Intel TDX log header is 1, causing the function
__calc_tpm2_event_size() to fail to recognize the log header, ultimately
leading to the "Failed to parse event in TPM Final Events Log" error.

According to UEFI Specification 2.10, Section 38.4.1: For TDX, TPM PCR
0 maps to MRTD, so the log header uses TPM PCR 1 instead. To successfully
parse the TDX event log header, the check for a pcr_idx value of 0
must be skipped.

According to Table 6 in Section 10.2.1 of the TCG PC Client
Specification, the index field does not require the PCR index to be
fixed at zero. Therefore, skipping the check for a pcr_idx value of
0 for CC platforms is safe.

Link: https://uefi.org/specs/UEFI/2.10/38_Confidential_Computing.html#intel-trust-domain-extension
Link: https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClient_PFP_r1p05_v23_pub.pdf
Fixes: d228814b1913 ("efi/libstub: Add get_event_log() support for CC platforms")
Signed-off-by: Ge Yang <yangge1116@126.com>
Cc: stable@vger.kernel.org
---

V4:
- remove cc_platform_has(CC_ATTR_GUEST_STATE_ENCRYPT) suggested by Ard

V3:
- fix build error

V2:
- limit the fix for CC only suggested by Jarkko and Sathyanarayanan 

 drivers/char/tpm/eventlog/tpm2.c   |  6 +++++-
 drivers/firmware/efi/efi.c         |  8 ++++++--
 drivers/firmware/efi/libstub/tpm.c | 13 +++++++++----
 drivers/firmware/efi/tpm.c         | 36 ++++++++++++++++++++----------------
 include/linux/efi.h                |  4 +++-
 include/linux/tpm_eventlog.h       | 14 +++++++++++---
 6 files changed, 54 insertions(+), 27 deletions(-)

diff --git a/drivers/char/tpm/eventlog/tpm2.c b/drivers/char/tpm/eventlog/tpm2.c
index 37a0580..e9484fd 100644
--- a/drivers/char/tpm/eventlog/tpm2.c
+++ b/drivers/char/tpm/eventlog/tpm2.c
@@ -36,7 +36,11 @@
 static size_t calc_tpm2_event_size(struct tcg_pcr_event2_head *event,
 				   struct tcg_pcr_event *event_header)
 {
-	return __calc_tpm2_event_size(event, event_header, false);
+	/*
+	 * This function is only used by TPM2 and will not be used by CC.
+	 * Therefore, the argument is_cc_event is set to 0.
+	 */
+	return __calc_tpm2_event_size(event, event_header, false, 0);
 }
 
 static void *tpm2_bios_measurements_start(struct seq_file *m, loff_t *pos)
diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
index e57bff7..954b8f7 100644
--- a/drivers/firmware/efi/efi.c
+++ b/drivers/firmware/efi/efi.c
@@ -45,6 +45,7 @@ struct efi __read_mostly efi = {
 	.esrt			= EFI_INVALID_TABLE_ADDR,
 	.tpm_log		= EFI_INVALID_TABLE_ADDR,
 	.tpm_final_log		= EFI_INVALID_TABLE_ADDR,
+	.cc_final_log		= EFI_INVALID_TABLE_ADDR,
 #ifdef CONFIG_LOAD_UEFI_KEYS
 	.mokvar_table		= EFI_INVALID_TABLE_ADDR,
 #endif
@@ -613,7 +614,7 @@ static const efi_config_table_type_t common_tables[] __initconst = {
 	{LINUX_EFI_RANDOM_SEED_TABLE_GUID,	&efi_rng_seed,		"RNG"		},
 	{LINUX_EFI_TPM_EVENT_LOG_GUID,		&efi.tpm_log,		"TPMEventLog"	},
 	{EFI_TCG2_FINAL_EVENTS_TABLE_GUID,	&efi.tpm_final_log,	"TPMFinalLog"	},
-	{EFI_CC_FINAL_EVENTS_TABLE_GUID,	&efi.tpm_final_log,	"CCFinalLog"	},
+	{EFI_CC_FINAL_EVENTS_TABLE_GUID,	&efi.cc_final_log,	"CCFinalLog"	},
 	{LINUX_EFI_MEMRESERVE_TABLE_GUID,	&mem_reserve,		"MEMRESERVE"	},
 	{LINUX_EFI_INITRD_MEDIA_GUID,		&initrd,		"INITRD"	},
 	{EFI_RT_PROPERTIES_TABLE_GUID,		&rt_prop,		"RTPROP"	},
@@ -752,7 +753,10 @@ int __init efi_config_parse_tables(const efi_config_table_t *config_tables,
 	if (!IS_ENABLED(CONFIG_X86_32) && efi_enabled(EFI_MEMMAP))
 		efi_memattr_init();
 
-	efi_tpm_eventlog_init();
+	if (efi.tpm_final_log != EFI_INVALID_TABLE_ADDR)
+		efi_tcg2_eventlog_init(&efi.tpm_log, &efi.tpm_final_log, 0);
+	else if (efi.cc_final_log != EFI_INVALID_TABLE_ADDR)
+		efi_tcg2_eventlog_init(&efi.tpm_log, &efi.cc_final_log, 1);
 
 	if (mem_reserve != EFI_INVALID_TABLE_ADDR) {
 		unsigned long prsv = mem_reserve;
diff --git a/drivers/firmware/efi/libstub/tpm.c b/drivers/firmware/efi/libstub/tpm.c
index a5c6c4f..9728060 100644
--- a/drivers/firmware/efi/libstub/tpm.c
+++ b/drivers/firmware/efi/libstub/tpm.c
@@ -50,7 +50,8 @@ void efi_enable_reset_attack_mitigation(void)
 static void efi_retrieve_tcg2_eventlog(int version, efi_physical_addr_t log_location,
 				       efi_physical_addr_t log_last_entry,
 				       efi_bool_t truncated,
-				       struct efi_tcg2_final_events_table *final_events_table)
+				       struct efi_tcg2_final_events_table *final_events_table,
+				       bool is_cc_event)
 {
 	efi_guid_t linux_eventlog_guid = LINUX_EFI_TPM_EVENT_LOG_GUID;
 	efi_status_t status;
@@ -87,7 +88,8 @@ static void efi_retrieve_tcg2_eventlog(int version, efi_physical_addr_t log_loca
 			last_entry_size =
 				__calc_tpm2_event_size((void *)last_entry_addr,
 						    (void *)(long)log_location,
-						    false);
+						    false,
+						    is_cc_event);
 		} else {
 			last_entry_size = sizeof(struct tcpa_event) +
 			   ((struct tcpa_event *) last_entry_addr)->event_size;
@@ -123,7 +125,8 @@ static void efi_retrieve_tcg2_eventlog(int version, efi_physical_addr_t log_loca
 			header = data + offset + final_events_size;
 			event_size = __calc_tpm2_event_size(header,
 						   (void *)(long)log_location,
-						   false);
+						   false,
+						   is_cc_event);
 			/* If calc fails this is a malformed log */
 			if (!event_size)
 				break;
@@ -157,6 +160,7 @@ void efi_retrieve_eventlog(void)
 	efi_tcg2_protocol_t *tpm2 = NULL;
 	efi_bool_t truncated;
 	efi_status_t status;
+	bool is_cc_event = false;
 
 	status = efi_bs_call(locate_protocol, &tpm2_guid, NULL, (void **)&tpm2);
 	if (status == EFI_SUCCESS) {
@@ -186,11 +190,12 @@ void efi_retrieve_eventlog(void)
 
 		final_events_table =
 			get_efi_config_table(EFI_CC_FINAL_EVENTS_TABLE_GUID);
+		is_cc_event = true;
 	}
 
 	if (status != EFI_SUCCESS || !log_location)
 		return;
 
 	efi_retrieve_tcg2_eventlog(version, log_location, log_last_entry,
-				   truncated, final_events_table);
+				   truncated, final_events_table, is_cc_event);
 }
diff --git a/drivers/firmware/efi/tpm.c b/drivers/firmware/efi/tpm.c
index cdd4310..d79291d 100644
--- a/drivers/firmware/efi/tpm.c
+++ b/drivers/firmware/efi/tpm.c
@@ -16,14 +16,16 @@
 int efi_tpm_final_log_size;
 EXPORT_SYMBOL(efi_tpm_final_log_size);
 
-static int __init tpm2_calc_event_log_size(void *data, int count, void *size_info)
+static int __init tpm2_calc_event_log_size(void *data, int count,
+					    void *size_info, bool is_cc_event)
 {
 	struct tcg_pcr_event2_head *header;
 	u32 event_size, size = 0;
 
 	while (count > 0) {
 		header = data + size;
-		event_size = __calc_tpm2_event_size(header, size_info, true);
+		event_size = __calc_tpm2_event_size(header, size_info, true,
+						    is_cc_event);
 		if (event_size == 0)
 			return -1;
 		size += event_size;
@@ -36,7 +38,8 @@ static int __init tpm2_calc_event_log_size(void *data, int count, void *size_inf
 /*
  * Reserve the memory associated with the TPM Event Log configuration table.
  */
-int __init efi_tpm_eventlog_init(void)
+int __init efi_tcg2_eventlog_init(unsigned long *log, unsigned long *final_log,
+				   bool is_cc_event)
 {
 	struct linux_efi_tpm_eventlog *log_tbl;
 	struct efi_tcg2_final_events_table *final_tbl;
@@ -44,7 +47,7 @@ int __init efi_tpm_eventlog_init(void)
 	int final_tbl_size;
 	int ret = 0;
 
-	if (efi.tpm_log == EFI_INVALID_TABLE_ADDR) {
+	if (*log == EFI_INVALID_TABLE_ADDR) {
 		/*
 		 * We can't calculate the size of the final events without the
 		 * first entry in the TPM log, so bail here.
@@ -52,23 +55,23 @@ int __init efi_tpm_eventlog_init(void)
 		return 0;
 	}
 
-	log_tbl = early_memremap(efi.tpm_log, sizeof(*log_tbl));
+	log_tbl = early_memremap(*log, sizeof(*log_tbl));
 	if (!log_tbl) {
 		pr_err("Failed to map TPM Event Log table @ 0x%lx\n",
-		       efi.tpm_log);
-		efi.tpm_log = EFI_INVALID_TABLE_ADDR;
+		       *log);
+		*log = EFI_INVALID_TABLE_ADDR;
 		return -ENOMEM;
 	}
 
 	tbl_size = sizeof(*log_tbl) + log_tbl->size;
-	if (memblock_reserve(efi.tpm_log, tbl_size)) {
+	if (memblock_reserve(*log, tbl_size)) {
 		pr_err("TPM Event Log memblock reserve fails (0x%lx, 0x%x)\n",
-		       efi.tpm_log, tbl_size);
+		       *log, tbl_size);
 		ret = -ENOMEM;
 		goto out;
 	}
 
-	if (efi.tpm_final_log == EFI_INVALID_TABLE_ADDR) {
+	if (*final_log == EFI_INVALID_TABLE_ADDR) {
 		pr_info("TPM Final Events table not present\n");
 		goto out;
 	} else if (log_tbl->version != EFI_TCG2_EVENT_LOG_FORMAT_TCG_2) {
@@ -76,25 +79,26 @@ int __init efi_tpm_eventlog_init(void)
 		goto out;
 	}
 
-	final_tbl = early_memremap(efi.tpm_final_log, sizeof(*final_tbl));
+	final_tbl = early_memremap(*final_log, sizeof(*final_tbl));
 
 	if (!final_tbl) {
 		pr_err("Failed to map TPM Final Event Log table @ 0x%lx\n",
-		       efi.tpm_final_log);
-		efi.tpm_final_log = EFI_INVALID_TABLE_ADDR;
+		       *final_log);
+		*final_log = EFI_INVALID_TABLE_ADDR;
 		ret = -ENOMEM;
 		goto out;
 	}
 
 	final_tbl_size = 0;
 	if (final_tbl->nr_events != 0) {
-		void *events = (void *)efi.tpm_final_log
+		void *events = (void *)*final_log
 				+ sizeof(final_tbl->version)
 				+ sizeof(final_tbl->nr_events);
 
 		final_tbl_size = tpm2_calc_event_log_size(events,
 							  final_tbl->nr_events,
-							  log_tbl->log);
+							  log_tbl->log,
+							  is_cc_event);
 	}
 
 	if (final_tbl_size < 0) {
@@ -103,7 +107,7 @@ int __init efi_tpm_eventlog_init(void)
 		goto out_calc;
 	}
 
-	memblock_reserve(efi.tpm_final_log,
+	memblock_reserve(*final_log,
 			 final_tbl_size + sizeof(*final_tbl));
 	efi_tpm_final_log_size = final_tbl_size;
 
diff --git a/include/linux/efi.h b/include/linux/efi.h
index 7d63d1d..71efec0 100644
--- a/include/linux/efi.h
+++ b/include/linux/efi.h
@@ -642,6 +642,7 @@ extern struct efi {
 	unsigned long			esrt;			/* ESRT table */
 	unsigned long			tpm_log;		/* TPM2 Event Log table */
 	unsigned long			tpm_final_log;		/* TPM2 Final Events Log table */
+	unsigned long			cc_final_log;		/* CC Final Events Log table */
 	unsigned long			mokvar_table;		/* MOK variable config table */
 	unsigned long			coco_secret;		/* Confidential computing secret table */
 	unsigned long			unaccepted;		/* Unaccepted memory table */
@@ -1209,7 +1210,8 @@ struct linux_efi_tpm_eventlog {
 	u8	log[];
 };
 
-extern int efi_tpm_eventlog_init(void);
+extern int efi_tcg2_eventlog_init(unsigned long *log, unsigned long *final_log,
+				   bool is_cc_event);
 
 struct efi_tcg2_final_events_table {
 	u64 version;
diff --git a/include/linux/tpm_eventlog.h b/include/linux/tpm_eventlog.h
index 891368e..b3380c9 100644
--- a/include/linux/tpm_eventlog.h
+++ b/include/linux/tpm_eventlog.h
@@ -143,6 +143,7 @@ struct tcg_algorithm_info {
  * @event:        Pointer to the event whose size should be calculated
  * @event_header: Pointer to the initial event containing the digest lengths
  * @do_mapping:   Whether or not the event needs to be mapped
+ * @is_cc_event:  Whether or not the event is from a CC platform
  *
  * The TPM2 event log format can contain multiple digests corresponding to
  * separate PCR banks, and also contains a variable length of the data that
@@ -159,7 +160,8 @@ struct tcg_algorithm_info {
 
 static __always_inline u32 __calc_tpm2_event_size(struct tcg_pcr_event2_head *event,
 					 struct tcg_pcr_event *event_header,
-					 bool do_mapping)
+					 bool do_mapping,
+					 bool is_cc_event)
 {
 	struct tcg_efi_specid_event_head *efispecid;
 	struct tcg_event_field *event_field;
@@ -201,8 +203,14 @@ static __always_inline u32 __calc_tpm2_event_size(struct tcg_pcr_event2_head *ev
 	count = event->count;
 	event_type = event->event_type;
 
-	/* Verify that it's the log header */
-	if (event_header->pcr_idx != 0 ||
+	/*
+	 * Verify that it's the log header. According to the TCG PC Client
+	 * Specification, when identifying a log header, the check for a
+	 * pcr_idx value of 0 is not required. For CC platforms, skipping
+	 * this check during log header is necessary; otherwise, the CC
+	 * platform's log header may fail to be recognized.
+	 */
+	if ((!is_cc_event && event_header->pcr_idx != 0) ||
 	    event_header->event_type != NO_ACTION ||
 	    memcmp(event_header->digest, zero_digest, sizeof(zero_digest))) {
 		size = 0;
-- 
2.7.4

Re: [PATCH V4] efi/tpm: Fix the issue where the CC platforms event log header can't be correctly identified

[James Bottomley]

On Tue, 2025-07-08 at 15:54 +0800, yangge1116@126.com wrote:
> From: Ge Yang <yangge1116@126.com>
> 
> Since commit d228814b1913 ("efi/libstub: Add get_event_log() support
> for CC platforms") reuses TPM2 support code for the CC platforms,
> when launching a TDX virtual machine with coco measurement enabled,
> the following error log is generated:
> 
> [Firmware Bug]: Failed to parse event in TPM Final Events Log
> 
> Call Trace:
> efi_config_parse_tables()
>   efi_tpm_eventlog_init()
>     tpm2_calc_event_log_size()
>       __calc_tpm2_event_size()
> 
> The pcr_idx value in the Intel TDX log header is 1, causing the
> function __calc_tpm2_event_size() to fail to recognize the log
> header, ultimately leading to the "Failed to parse event in TPM Final
> Events Log" error.
> 
> According to UEFI Specification 2.10, Section 38.4.1: For TDX, TPM
> PCR 0 maps to MRTD, so the log header uses TPM PCR 1 instead. To
> successfully parse the TDX event log header, the check for a pcr_idx
> value of 0 must be skipped.
> 
> According to Table 6 in Section 10.2.1 of the TCG PC Client
> Specification, the index field does not require the PCR index to be
> fixed at zero. Therefore, skipping the check for a pcr_idx value of
> 0 for CC platforms is safe.

This is wrong: the spec does not allow a header EV_ACTION to be
recorded with anything other than pcrIndex == 0.

However, the fact that Intel, who practically wrote the TPM spec, can
get this wrong shows that others can too.  So the best way to fix this
is to remove the pcrIndex check for the first event.  There's no danger
of this causing problems because we check for the TCG_SPECID_SIG
signature as the next thing.  That means you don't need to thread
knowledge of whether this is a CC environment and we're pre-emptively
ready for any other spec violators who misread the spec in the same way
Intel did.

Regards,

James

Re: [PATCH V4] efi/tpm: Fix the issue where the CC platforms event log header can't be correctly identified

[Sathyanarayanan Kuppuswamy]

On 7/11/25 7:00 AM, James Bottomley wrote:
> On Tue, 2025-07-08 at 15:54 +0800, yangge1116@126.com wrote:
>> From: Ge Yang <yangge1116@126.com>
>>
>> Since commit d228814b1913 ("efi/libstub: Add get_event_log() support
>> for CC platforms") reuses TPM2 support code for the CC platforms,
>> when launching a TDX virtual machine with coco measurement enabled,
>> the following error log is generated:
>>
>> [Firmware Bug]: Failed to parse event in TPM Final Events Log
>>
>> Call Trace:
>> efi_config_parse_tables()
>>    efi_tpm_eventlog_init()
>>      tpm2_calc_event_log_size()
>>        __calc_tpm2_event_size()
>>
>> The pcr_idx value in the Intel TDX log header is 1, causing the
>> function __calc_tpm2_event_size() to fail to recognize the log
>> header, ultimately leading to the "Failed to parse event in TPM Final
>> Events Log" error.
>>
>> According to UEFI Specification 2.10, Section 38.4.1: For TDX, TPM
>> PCR 0 maps to MRTD, so the log header uses TPM PCR 1 instead. To
>> successfully parse the TDX event log header, the check for a pcr_idx
>> value of 0 must be skipped.
>>
>> According to Table 6 in Section 10.2.1 of the TCG PC Client
>> Specification, the index field does not require the PCR index to be
>> fixed at zero. Therefore, skipping the check for a pcr_idx value of
>> 0 for CC platforms is safe.
> This is wrong: the spec does not allow a header EV_ACTION to be
> recorded with anything other than pcrIndex == 0.
>
> However, the fact that Intel, who practically wrote the TPM spec, can
> get this wrong shows that others can too.  So the best way to fix this
> is to remove the pcrIndex check for the first event.  There's no danger
> of this causing problems because we check for the TCG_SPECID_SIG
> signature as the next thing.  That means you don't need to thread
> knowledge of whether this is a CC environment and we're pre-emptively
> ready for any other spec violators who misread the spec in the same way
> Intel did.


I agree with James Bottomley's suggestion to remove the pcr_index check
without adding any replacement checks.

This check was originally introduced in the following commit to handle a
case where certain Dell platforms provided an event log without a valid
header:

commit 7dfc06a0f25b593a9f51992f540c0f80a57f3629
Author: Fabian Vogt <fvogt@suse.de>
Date:   Mon Jun 15 09:16:36 2020 +0200

     efi/tpm: Verify event log header before parsing

At first, I was concerned that the pcr_index check might still be important for
this fix. However, after re-reading the commit and reviewing the intent, it appears
that relying on the event_type and digest checks should be sufficient for validating
the event log header.




> Regards,
>
> James
>
-- 
Sathyanarayanan Kuppuswamy
Linux Kernel Developer

Re: [PATCH V4] efi/tpm: Fix the issue where the CC platforms event log header can't be correctly identified

[Ge Yang]

在 2025/7/12 1:01, Sathyanarayanan Kuppuswamy 写道:
> 
> On 7/11/25 7:00 AM, James Bottomley wrote:
>> On Tue, 2025-07-08 at 15:54 +0800, yangge1116@126.com wrote:
>>> From: Ge Yang <yangge1116@126.com>
>>>
>>> Since commit d228814b1913 ("efi/libstub: Add get_event_log() support
>>> for CC platforms") reuses TPM2 support code for the CC platforms,
>>> when launching a TDX virtual machine with coco measurement enabled,
>>> the following error log is generated:
>>>
>>> [Firmware Bug]: Failed to parse event in TPM Final Events Log
>>>
>>> Call Trace:
>>> efi_config_parse_tables()
>>>    efi_tpm_eventlog_init()
>>>      tpm2_calc_event_log_size()
>>>        __calc_tpm2_event_size()
>>>
>>> The pcr_idx value in the Intel TDX log header is 1, causing the
>>> function __calc_tpm2_event_size() to fail to recognize the log
>>> header, ultimately leading to the "Failed to parse event in TPM Final
>>> Events Log" error.
>>>
>>> According to UEFI Specification 2.10, Section 38.4.1: For TDX, TPM
>>> PCR 0 maps to MRTD, so the log header uses TPM PCR 1 instead. To
>>> successfully parse the TDX event log header, the check for a pcr_idx
>>> value of 0 must be skipped.
>>>
>>> According to Table 6 in Section 10.2.1 of the TCG PC Client
>>> Specification, the index field does not require the PCR index to be
>>> fixed at zero. Therefore, skipping the check for a pcr_idx value of
>>> 0 for CC platforms is safe.
>> This is wrong: the spec does not allow a header EV_ACTION to be
>> recorded with anything other than pcrIndex == 0.
>>
>> However, the fact that Intel, who practically wrote the TPM spec, can
>> get this wrong shows that others can too.  So the best way to fix this
>> is to remove the pcrIndex check for the first event.  There's no danger
>> of this causing problems because we check for the TCG_SPECID_SIG
>> signature as the next thing.  That means you don't need to thread
>> knowledge of whether this is a CC environment and we're pre-emptively
>> ready for any other spec violators who misread the spec in the same way
>> Intel did.
> 
> 
> I agree with James Bottomley's suggestion to remove the pcr_index check
> without adding any replacement checks.
> 
> This check was originally introduced in the following commit to handle a
> case where certain Dell platforms provided an event log without a valid
> header:
> 
> commit 7dfc06a0f25b593a9f51992f540c0f80a57f3629
> Author: Fabian Vogt <fvogt@suse.de>
> Date:   Mon Jun 15 09:16:36 2020 +0200
> 
>      efi/tpm: Verify event log header before parsing
> 
> At first, I was concerned that the pcr_index check might still be 
> important for
> this fix. However, after re-reading the commit and reviewing the intent, 
> it appears
> that relying on the event_type and digest checks should be sufficient 
> for validating
> the event log header.
> 
> 
> 

Thanks to the suggestions from Bottomley and Sathyanarayanan. Now, I'll 
submit another version of the patch.

> 
>> Regards,
>>
>> James
>>