Hi all,

 

We encountered a problem that the virtual machine failed to start. Our

Configuration is as follows:
1. Use qemu 4.1.0 and edk2 202011 for x86 test, and qemu 7.1.0 and edk2 202011

for arm test
2. Enable secure boot and TPM 2.0.
3. Import the PK [1]\KEK [2]\db [3]\dbx [4]certificates.
4. VM started with 60 disks and 7 network cards

 

The log of serial port reported the errors:
```
Could not create MokListRT: Volume full
Could not create MokListXRT: Volume full
Could not create SbatlevelRT: Volume full
Could not create MokListTrustedRT: Volume full
Something has gone seriously wrong: import_mok_state() failed : Volume Full
```

TPM measures part of UEFI variables, include PK/KEK/db/dbx, BootOrder and so

on. It calls Tcg2HashLogExtendEvent (edk2 SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c)

to write to event log. Currently the event log length is 64 KB, if full,

Tcg2HashLogExtendEvent returned EFI_VOLUME_FULL which caused the VM

failed to start.

I found some description about variable area length and event log area length.

After using tpm2-tool to parse the event logs, we found that event log of a

variable contains variable data. Theoretically, the variable size can exceed

64KB, as long as it does not exceed 256KB. Maybe event log area length

should be greater than variable area length ?

 

In section 9.2 of TCG PC Client Platform Firmware Profile Specification [5]:
```
The Log Area Minimum Length for the TCG event log MUST be at least 64KB.
```

In source code [6] of edk2:

```
## This PCD defines minimum length(in bytes) of the system preboot TCG event log area(LAML).
# For PC Client Implementation spec up to and including 1.2 the minimum log size is 64KB.
# @Prompt Minimum length(in bytes) of the system preboot TCG event log area(LAML).
gEfiSecurityPkgTokenSpaceGuid.PcdTcgLogAreaMinLen|0x10000|UINT32|0x00010017
```

In source code [7] of edk2:

```
!if $(FD_SIZE_IN_KB) == 4096     <- - - - - -  # it is true in our configuration
# Size: 0x40000 (gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableSize) -
# 0x48 (size of EFI_FIRMWARE_VOLUME_HEADER) = 0x3ffb8
# This can speed up the Variable Dispatch a bit.
0xB8, 0xFF, 0x03, 0x00,
!endif
```

Based on the above analysis, We tried two solutions:
1. We modify the TcgCommLogEvent function in edk2 to ignore the

EFI_VOLUME_FULL error, return EFI_SUCCESS but not write event log. This idea

refers to [8].
2. We increase the value of PcdTcgLogAreaMinLen because TCG only defines

minimum length. And tpm2-tools has supported event logs longer than 64KB [9].

Both solutions can make the virtual machine start successfully but not sure if

they introduce other problems. For the first solution, we are worried that

the missing part of the event log will affect the TPM’s function. For the

second solution, we are not sure if this change will have any impact on other

components.

 

Could you give us some advices?

 

Thanks

 

References:

[1] https://go.microsoft.com/fwlink/?linkid=2255361

[2] https://go.microsoft.com/fwlink/p/?linkid=321185

[3] https://go.microsoft.com/fwlink/?LinkId=321192

[4] https://uefi.org/sites/default/files/resources/x64_DBXUpdate.bin

[5] https://trustedcomputinggroup.org/resource/pc-client-specific-platform-firmware-profile-specification/

[6] https://github.com/tianocore/edk2/blob/master/SecurityPkg/SecurityPkg.dec

[7] https://github.com/tianocore/edk2/blob/master/OvmfPkg/Bhyve/VarStore.fdf.inc

[8] https://github.com/rhboot/shim/pull/657

[9] https://github.com/tpm2-software/tpm2-tools/pull/2683