From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from rn-mailsvcp-ppex-lapp14.apple.com (rn-mailsvcp-ppex-lapp14.apple.com [17.179.253.33]) by mx.groups.io with SMTP id smtpd.web10.2164.1663381705218091380 for ; Fri, 16 Sep 2022 19:28:25 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@apple.com header.s=20180706 header.b=MVdyd+6Z; spf=pass (domain: apple.com, ip: 17.179.253.33, mailfrom: afish@apple.com) Received: from pps.filterd (rn-mailsvcp-ppex-lapp14.rno.apple.com [127.0.0.1]) by rn-mailsvcp-ppex-lapp14.rno.apple.com (8.16.1.2/8.16.1.2) with SMTP id 28H2KQX8017277; Fri, 16 Sep 2022 19:28:24 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=apple.com; h=from : content-type : mime-version : subject : date : references : to : in-reply-to : message-id; s=20180706; bh=ceMhY8hQ3WF5+KJwx3IjUGZ0N085hQ7WscyJfmCTg1M=; b=MVdyd+6ZppzjYG9iPG6wIpP0MGJIT/AXFwy8zmvwUXABKuAZ+w0Y2tveFkNg39XzzaJC 402WVqpHohRdQrACVKhwDBnGyS05wnALVkJQw2YcBtSGhy5s+yW2+pU4+CkVvrmfNdqR APLTirgGaXOHE/eeC+aBJlgJprrhkfqX4Qb6Zz2nOLgvO/Wkghz9fvR0ZcHVeV+D07XL st95kgWhKgkdl/hjX9WR9RLDqI+W3H41WGv0dAXWLtiu9zxav3ASej/5q1nFDU5ukv4S j5KbMZPOj8a7c6xbPUw1mXErfg1gJLhuvj7VdKG+MHV+CMrs1os10fI6XR+tiwN/nRO4 XQ== Received: from rn-mailsvcp-mta-lapp02.rno.apple.com (rn-mailsvcp-mta-lapp02.rno.apple.com [10.225.203.150]) by rn-mailsvcp-ppex-lapp14.rno.apple.com with ESMTP id 3jm91618m2-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Fri, 16 Sep 2022 19:28:24 -0700 Received: from rn-mailsvcp-mmp-lapp03.rno.apple.com (rn-mailsvcp-mmp-lapp03.rno.apple.com [17.179.253.16]) by rn-mailsvcp-mta-lapp02.rno.apple.com (Oracle Communications Messaging Server 8.1.0.19.20220711 64bit (built Jul 11 2022)) with ESMTPS id <0RIC00FTX1JC2Q90@rn-mailsvcp-mta-lapp02.rno.apple.com>; Fri, 16 Sep 2022 19:28:24 -0700 (PDT) Received: from process_milters-daemon.rn-mailsvcp-mmp-lapp03.rno.apple.com by rn-mailsvcp-mmp-lapp03.rno.apple.com (Oracle Communications Messaging Server 8.1.0.19.20220711 64bit (built Jul 11 2022)) id <0RIC00S00160J400@rn-mailsvcp-mmp-lapp03.rno.apple.com>; Fri, 16 Sep 2022 19:28:24 -0700 (PDT) X-Va-A: X-Va-T-CD: 62ed9bb1464565bc024b92571bc24fa7 X-Va-E-CD: b7fca271f79aec36c11a1def16071542 X-Va-R-CD: da6f6e21cb8395c50849f07871065ff5 X-Va-CD: 0 X-Va-ID: aeb62c2c-4164-46d1-abb7-81df5acf479c X-V-A: X-V-T-CD: 62ed9bb1464565bc024b92571bc24fa7 X-V-E-CD: b7fca271f79aec36c11a1def16071542 X-V-R-CD: da6f6e21cb8395c50849f07871065ff5 X-V-CD: 0 X-V-ID: a2cdd124-e719-44c7-a89f-a03e57f9c884 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.528,18.0.895 definitions=2022-09-16_14:2022-09-15,2022-09-16 signatures=0 Received: from smtpclient.apple (unknown [17.235.56.224]) by rn-mailsvcp-mmp-lapp03.rno.apple.com (Oracle Communications Messaging Server 8.1.0.19.20220711 64bit (built Jul 11 2022)) with ESMTPSA id <0RIC00JF31JAS100@rn-mailsvcp-mmp-lapp03.rno.apple.com>; Fri, 16 Sep 2022 19:28:24 -0700 (PDT) From: "Andrew Fish" MIME-version: 1.0 (Mac OS X Mail 16.0 \(3731.200.22\)) Subject: Re: [edk2-devel] TPM2 EventLog EFI vs. ACPI Date: Fri, 16 Sep 2022 19:28:11 -0700 References: To: devel@edk2.groups.io, jandryuk@gmail.com In-reply-to: Message-id: X-Mailer: Apple Mail (2.3731.200.22) X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.528,18.0.895 definitions=2022-09-16_14:2022-09-15,2022-09-16 signatures=0 Content-type: multipart/alternative; boundary="Apple-Mail=_C2E6234A-02EF-4538-A6B1-A763191D1BD9" --Apple-Mail=_C2E6234A-02EF-4538-A6B1-A763191D1BD9 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Is it possible to query the address from fw_cfg? Thanks, Andrew Fish > On Sep 16, 2022, at 12:45 PM, Jason Andryuk wrote: >=20 > Hi, >=20 > I've noticed an issue with the TPM2 EventLog. OVMF exposes the TPM > Event Log via EFI and ACPI, but they have different addresses. The > EFI one retrievable by GetEventLog() is populated. The ACPI is empty. > Oh, there are actually two EFI Event Logs for the two formats: > EFI_TCG2_EVENT_LOG_FORMAT_TCG_1_2 > EFI_TCG2_EVENT_LOG_FORMAT_TCG_2 >=20 > The debug log from the Fedora 36 OVMF shows: > Tcg2GetEventLog (EventLogLocation - 7EEB2000) > which matches the address retrieved with GetEventLog(). > And hexdump-ing the TPM2 ACPI table shows 0x7fbe6000. >=20 > On a different build, I added output for both EFI logs, and the addresses= are: > 0x7ec3d000 - EFI_TCG2_EVENT_LOG_FORMAT_TCG_1_2 > 0x7ec1b000 - EFI_TCG2_EVENT_LOG_FORMAT_TCG_2 > 0x7fbe6000 - ACPI >=20 > The ACPI one is a little more user friendly as its address is > available through the table during runtime. The EFI addresses can > only be grabbed before exiting boot services. >=20 > I think the issue is that the ACPI tables are created from Qemu fw_cfg > data, which allocates memory for the log and places the address in > ACPI tables. Meanwhile, > SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c:SetupEventLog() allocates its own > event log memory. SetupEventLog() saves the size and address in > PcdTpm2AcpiTableLaml & PcdTpm2AcpiTableLasa, but nothing puts those > values in the actual ACPI tables. >=20 > It seems like SetupEventLog would be better structured to check > existing ACPI tables and look for a log in a TPM2 section. If found, > use that, otherwise create a new log area. >=20 > The other wrinkle is that the Tcg2 code is keeping two event logs in > the two formats. It seems to me that for TPM2, it would be easier to > just keep only the newer EFI_TCG2_EVENT_LOG_FORMAT_TCG_2. If support > for both is needed, then the EFI_TCG2_EVENT_LOG_FORMAT_TCG_2 one > should share the same region as the ACPI table. >=20 > Regards, > Jason >=20 >=20 >=20 --Apple-Mail=_C2E6234A-02EF-4538-A6B1-A763191D1BD9 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii Is it possible to query the ad= dress from fw_cfg?

Thanks,

Andrew Fish

On Sep 16, 2022, at= 12:45 PM, Jason Andryuk <jandryuk@gmail.com> wrote:

Hi,

I've noticed an issue with the TPM2 EventLog= .  OVMF exposes the TPM
Event Log via EFI and = ACPI, but they have different addresses.  The
= EFI one retrievable by GetEventLog() is populated.  The ACPI is empty.=
Oh, there are actually two EFI Event Logs for the = two formats:
EFI_TCG2_EVENT_LOG_FORMAT_TCG_1_2
EFI_TCG2_EVENT_LOG_FORMAT_TCG_2

The debug log from the Fedora 36 OVMF shows:
Tcg2GetEventLog (EventLogLocation - 7EEB2000)which matches the address retrieved with GetEventLog().
And hexdump-ing the TPM2 ACPI table shows 0x7fbe6000.

On a different build, I add= ed output for both EFI logs, and the addresses are:
0x7ec3d000 - EFI_TCG2_EVENT_LOG_FORMAT_TCG_1_2
0x7= ec1b000 - EFI_TCG2_EVENT_LOG_FORMAT_TCG_2
0x7fbe600= 0 - ACPI

The ACPI one is a= little more user friendly as its address is
availa= ble through the table during runtime.  The EFI addresses canonly be grabbed before exiting boot services.

I think the issue is that the ACPI table= s are created from Qemu fw_cfg
data, which alloca= tes memory for the log and places the address in
AC= PI tables.  Meanwhile,
SecurityPkg/Tcg/Tcg2Dxe= /Tcg2Dxe.c:SetupEventLog() allocates its own
event = log memory.  SetupEventLog() saves the size and address in
PcdTpm2AcpiTableLaml & PcdTpm2AcpiTableLasa, but nothing p= uts those
values in the actual ACPI tables.<= br style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 1= 2px; font-style: normal; font-variant-caps: normal; font-weight: 400; lette= r-spacing: normal; text-align: start; text-indent: 0px; text-transform: non= e; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none;">
It seems like SetupEventLog would= be better structured to check
existing ACPI tabl= es and look for a log in a TPM2 section.  If found,
use that, otherwise create a new log area.

The other wrinkle is that the Tcg2 code is keeping t= wo event logs in
the two formats.  It seems to= me that for TPM2, it would be easier to
just keep = only the newer EFI_TCG2_EVENT_LOG_FORMAT_TCG_2.  If support
for both is needed, then the EFI_TCG2_EVENT_LOG_FORMAT_TCG_2 = one
should share the same region as the ACPI table.=

Regards,
Jason



--Apple-Mail=_C2E6234A-02EF-4538-A6B1-A763191D1BD9--