From 98f1a2c8c540fa88dc80660622f8444acaf82579 Mon Sep 17 00:00:00 2001 From: Alex Zenla Date: Sat, 26 Sep 2026 20:09:35 -0700 Subject: [PATCH] fix(tpm): treat a full event log as a successful measurement The TCG2 specification says HashLogExtendEvent returns VOLUME_FULL when the PCR was extended but the event log had no room for the event. This was treated as a failure, which aborted loading the configuration and booting Edera. Log a warning and continue instead. --- crates/eficore/src/platform/tpm.rs | 29 +++++++++++++++++++++++------ 1 file changed, 23 insertions(+), 6 deletions(-) diff --git a/crates/eficore/src/platform/tpm.rs b/crates/eficore/src/platform/tpm.rs index 5ea04e7..e4d2f9e 100644 --- a/crates/eficore/src/platform/tpm.rs +++ b/crates/eficore/src/platform/tpm.rs @@ -1,8 +1,10 @@ use anyhow::{Context, Result}; +use log::warn; use uefi::ResultExt; use uefi::boot::ScopedProtocol; use uefi::proto::tcg::PcrIndex; use uefi::proto::tcg::v2::{PcrEventInputs, Tcg}; +use uefi_raw::Status; use uefi_raw::protocol::tcg::EventType; use uefi_raw::protocol::tcg::v2::{Tcg2HashLogExtendEventFlags, Tcg2Protocol, Tcg2Version}; @@ -121,18 +123,33 @@ impl PlatformTpm { }; // Encode the description as UTF-8. - let description = description.as_bytes().to_vec(); + let encoded_description = description.as_bytes().to_vec(); // Construct an event input for the TPM. - let event = PcrEventInputs::new_in_box(pcr_index, EventType::IPL, &description) + let event = PcrEventInputs::new_in_box(pcr_index, EventType::IPL, &encoded_description) .discard_errdata() .context("unable to construct pcr event inputs")?; // Log the event into the TPM. - handle - .protocol() - .hash_log_extend_event(Tcg2HashLogExtendEventFlags::empty(), buffer, &event) - .context("unable to log event to tpm")?; + let result = handle.protocol().hash_log_extend_event( + Tcg2HashLogExtendEventFlags::empty(), + buffer, + &event, + ); + + // A full event log means the PCR was extended, but the event could not be logged. + // The measurement still happened, so this should not prevent booting. + if let Err(ref error) = result + && error.status() == Status::VOLUME_FULL + { + warn!( + "tpm event log is full, unable to log event: {}", + description + ); + return Ok(()); + } + + result.context("unable to log event to tpm")?; Ok(()) } }