Add Maintainers and Reviewers: Jiewen Yao > Rebecca Cran > Corvin Köhne > Could you give us some advice? Thanks From: Zhoujian (jay) Sent: Monday, April 29, 2024 12:07 PM To: 'devel@edk2.groups.io' Cc: zhengyaohui (A) ; Wangxin (Alexander) Subject: [Question] VM failed to start with secure boot and TPM 2.0 Hi all, We encountered a problem that the virtual machine failed to start. Our Configuration is as follows: 1. Use qemu 4.1.0 and edk2 202011 for x86 test, and qemu 7.1.0 and edk2 202011 for arm test 2. Enable secure boot and TPM 2.0. 3. Import the PK [1]\KEK [2]\db [3]\dbx [4]certificates. 4. VM started with 60 disks and 7 network cards The log of serial port reported the errors: ``` Could not create MokListRT: Volume full Could not create MokListXRT: Volume full Could not create SbatlevelRT: Volume full Could not create MokListTrustedRT: Volume full Something has gone seriously wrong: import_mok_state() failed : Volume Full ``` TPM measures part of UEFI variables, include PK/KEK/db/dbx, BootOrder and so on. It calls Tcg2HashLogExtendEvent (edk2 SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c) to write to event log. Currently the event log length is 64 KB, if full, Tcg2HashLogExtendEvent returned EFI_VOLUME_FULL which caused the VM failed to start. I found some description about variable area length and event log area length. After using tpm2-tool to parse the event logs, we found that event log of a variable contains variable data. Theoretically, the variable size can exceed 64KB, as long as it does not exceed 256KB. Maybe event log area length should be greater than variable area length ? In section 9.2 of TCG PC Client Platform Firmware Profile Specification [5]: ``` The Log Area Minimum Length for the TCG event log MUST be at least 64KB. ``` In source code [6] of edk2: ``` ## This PCD defines minimum length(in bytes) of the system preboot TCG event log area(LAML). # For PC Client Implementation spec up to and including 1.2 the minimum log size is 64KB. # @Prompt Minimum length(in bytes) of the system preboot TCG event log area(LAML). gEfiSecurityPkgTokenSpaceGuid.PcdTcgLogAreaMinLen|0x10000|UINT32|0x00010017 ``` In source code [7] of edk2: ``` !if $(FD_SIZE_IN_KB) == 4096 <- - - - - - # it is true in our configuration # Size: 0x40000 (gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableSize) - # 0x48 (size of EFI_FIRMWARE_VOLUME_HEADER) = 0x3ffb8 # This can speed up the Variable Dispatch a bit. 0xB8, 0xFF, 0x03, 0x00, !endif ``` Based on the above analysis, We tried two solutions: 1. We modify the TcgCommLogEvent function in edk2 to ignore the EFI_VOLUME_FULL error, return EFI_SUCCESS but not write event log. This idea refers to [8]. 2. We increase the value of PcdTcgLogAreaMinLen because TCG only defines minimum length. And tpm2-tools has supported event logs longer than 64KB [9]. Both solutions can make the virtual machine start successfully but not sure if they introduce other problems. For the first solution, we are worried that the missing part of the event log will affect the TPM's function. For the second solution, we are not sure if this change will have any impact on other components. Could you give us some advices? Thanks References: [1] https://go.microsoft.com/fwlink/?linkid=2255361 [2] https://go.microsoft.com/fwlink/p/?linkid=321185 [3] https://go.microsoft.com/fwlink/?LinkId=321192 [4] https://uefi.org/sites/default/files/resources/x64_DBXUpdate.bin [5] https://trustedcomputinggroup.org/resource/pc-client-specific-platform-firmware-profile-specification/ [6] https://github.com/tianocore/edk2/blob/master/SecurityPkg/SecurityPkg.dec [7] https://github.com/tianocore/edk2/blob/master/OvmfPkg/Bhyve/VarStore.fdf.inc [8] https://github.com/rhboot/shim/pull/657 [9] https://github.com/tpm2-software/tpm2-tools/pull/2683 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#118590): https://edk2.groups.io/g/devel/message/118590 Mute This Topic: https://groups.io/mt/105797435/7686176 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io] -=-=-=-=-=-=-=-=-=-=-=-