The EFI stub currently allocates the TPM event log as
EFI_ACPI_RECLAIM_MEMORY. On x86, this becomes an ACPI data entry
in the E820 map.

On a Framework Laptop 16 (AMD Ryzen AI 300 Series), the EFI allocator
can place this allocation at different physical addresses across boots.
Since x86 hibernation validates architecture-specific data from
the firmware E820 map, this causes an otherwise valid hibernation image
to be rejected on resume with the following error:

  Hibernate inconsistent memory map detected!
  PM: hibernation: Image mismatch: architecture specific data

Allocating the event log as EFI_LOADER_DATA avoids changing the E820
map, but doing that alone would regress the kexec corruption issue fixed
by commit 77d48d39e991 ("efistub/tpm: Use ACPI reclaim memory for event
log to avoid corruption").

This patch series instead installs the Linux EFI memreserve table on the
x86 stub path and then uses efi_mem_reserve_persistent() to preserve the
TPM event log across kexec while keeping the allocation as
EFI_LOADER_DATA.

The series was also backported to Linux 7.2 for validation on the
affected system.

Results:

- stock 7.2:
  TPM event log allocation changes the E820 map across boots;
  hibernation resume fails

- EFI_LOADER_DATA-only diagnostic build:
  E820 map remains stable;
  hibernation resume succeeds

- this series:
  TPM range is persistently reserved;
  hibernation resume succeeds with the normal device drivers;
  kexec_file_load() succeeds with the TPM range preserved;
  kexec_load() succeeds with the TPM range preserved

For kexec_file_load(), the event log had the same size and SHA256 digest
before and after kexec. For kexec_load(), the before and after event log
files compared byte-for-byte identical.

The original report and investigation are here:
  https://lore.kernel.org/all/DL3MNWW4VEBR.K3K6A92WMHUY@gmail.com/

Patch 1 makes the existing EFI memreserve table installer available to
the x86 EFI stub path.

Patch 2 switches the TPM event log allocation back to EFI_LOADER_DATA
and persistently reserves it after the normal TPM event log reservation
has succeeded.

Jasmeet (Jazz) Bhatia (2):
  efi/libstub: Install memreserve table on x86
  efi/tpm: Persistently reserve the TPM event log

 .../firmware/efi/libstub/efi-stub-helper.c    | 23 ++++++++++++++++
 drivers/firmware/efi/libstub/efi-stub.c       | 23 ----------------
 drivers/firmware/efi/libstub/efistub.h        |  1 +
 drivers/firmware/efi/libstub/tpm.c            |  2 +-
 drivers/firmware/efi/libstub/x86-stub.c       |  2 ++
 drivers/firmware/efi/tpm.c                    | 27 +++++++++++++++++++
 6 files changed, 54 insertions(+), 24 deletions(-)


base-commit: 786262be6048deab760f68c8acc2c85607165894
-- 
2.55.0

Hi Jazz,

On Tue, 1 Sep 2026, at 13:34, Jasmeet (Jazz) Bhatia wrote:
> The EFI stub currently allocates the TPM event log as
> EFI_ACPI_RECLAIM_MEMORY. On x86, this becomes an ACPI data entry
> in the E820 map.
>
> On a Framework Laptop 16 (AMD Ryzen AI 300 Series), the EFI allocator
> can place this allocation at different physical addresses across boots.
> Since x86 hibernation validates architecture-specific data from
> the firmware E820 map, this causes an otherwise valid hibernation image
> to be rejected on resume with the following error:
>
>   Hibernate inconsistent memory map detected!
>   PM: hibernation: Image mismatch: architecture specific data
>
> Allocating the event log as EFI_LOADER_DATA avoids changing the E820
> map, but doing that alone would regress the kexec corruption issue fixed
> by commit 77d48d39e991 ("efistub/tpm: Use ACPI reclaim memory for event
> log to avoid corruption").
>

As I replied in the other thread, I am not convinced preserving the TPM
event log across a kexec makes sense to begin with. This is the firmware's
view of the state of the TPM PCRs when it handed over the system to the
first OS.

If the first OS boots, loads a kexec kernel and then boots it without
measuring any of that into the TPM, the TPM event log will match the
TPM state, but this is meaningless because of the missing measurements,
and the attestation chain is broken.

If the first OS does perform TPM measurements, it would need to record
them into a log and pass that on to the kexec'ed in some implementation
specific way - it cannot use the existing TPM event log for that.

TL;DR perhaps we should just discard the TPM event log reference from
the EFI config tables after consuming it. Or add a special case to the
kexec code to disregard it.

On Thu Sep 3, 2026 at 7:18 AM PDT, Ard Biesheuvel wrote:
> Hi Jazz,
>
> On Tue, 1 Sep 2026, at 13:34, Jasmeet (Jazz) Bhatia wrote:
>> The EFI stub currently allocates the TPM event log as
>> EFI_ACPI_RECLAIM_MEMORY. On x86, this becomes an ACPI data entry
>> in the E820 map.
>>
>> On a Framework Laptop 16 (AMD Ryzen AI 300 Series), the EFI allocator
>> can place this allocation at different physical addresses across boots.
>> Since x86 hibernation validates architecture-specific data from
>> the firmware E820 map, this causes an otherwise valid hibernation image
>> to be rejected on resume with the following error:
>>
>>   Hibernate inconsistent memory map detected!
>>   PM: hibernation: Image mismatch: architecture specific data
>>
>> Allocating the event log as EFI_LOADER_DATA avoids changing the E820
>> map, but doing that alone would regress the kexec corruption issue fixed
>> by commit 77d48d39e991 ("efistub/tpm: Use ACPI reclaim memory for event
>> log to avoid corruption").
>>
>
> As I replied in the other thread, I am not convinced preserving the TPM
> event log across a kexec makes sense to begin with. This is the firmware's
> view of the state of the TPM PCRs when it handed over the system to the
> first OS.
>
> If the first OS boots, loads a kexec kernel and then boots it without
> measuring any of that into the TPM, the TPM event log will match the
> TPM state, but this is meaningless because of the missing measurements,
> and the attestation chain is broken.
>
> If the first OS does perform TPM measurements, it would need to record
> them into a log and pass that on to the kexec'ed in some implementation
> specific way - it cannot use the existing TPM event log for that.
>
> TL;DR perhaps we should just discard the TPM event log reference from
> the EFI config tables after consuming it. Or add a special case to the
> kexec code to disregard it.
Ok, honestly that makes a lot of sense I see what you are saying and I
tend to agree. I'm treating the copied event log at something that
survives kexec in this patch because of the corruption fix so I'll look
at dropping that LINUX_EFI_TPM_EVENT_LOG_GUID reference and rewrite this
patch. Hopefully, that will avoid that x86 E820 instability as well.

Appreciate the guidance!

On Fri, 4 Sep 2026, at 17:45, Jasmeet (Jazz) Bhatia wrote:
> On Thu Sep 3, 2026 at 7:18 AM PDT, Ard Biesheuvel wrote:
>> Hi Jazz,
>>
>> On Tue, 1 Sep 2026, at 13:34, Jasmeet (Jazz) Bhatia wrote:
>>> The EFI stub currently allocates the TPM event log as
>>> EFI_ACPI_RECLAIM_MEMORY. On x86, this becomes an ACPI data entry
>>> in the E820 map.
>>>
>>> On a Framework Laptop 16 (AMD Ryzen AI 300 Series), the EFI allocator
>>> can place this allocation at different physical addresses across boots.
>>> Since x86 hibernation validates architecture-specific data from
>>> the firmware E820 map, this causes an otherwise valid hibernation image
>>> to be rejected on resume with the following error:
>>>
>>>   Hibernate inconsistent memory map detected!
>>>   PM: hibernation: Image mismatch: architecture specific data
>>>
>>> Allocating the event log as EFI_LOADER_DATA avoids changing the E820
>>> map, but doing that alone would regress the kexec corruption issue fixed
>>> by commit 77d48d39e991 ("efistub/tpm: Use ACPI reclaim memory for event
>>> log to avoid corruption").
>>>
>>
>> As I replied in the other thread, I am not convinced preserving the TPM
>> event log across a kexec makes sense to begin with. This is the firmware's
>> view of the state of the TPM PCRs when it handed over the system to the
>> first OS.
>>
>> If the first OS boots, loads a kexec kernel and then boots it without
>> measuring any of that into the TPM, the TPM event log will match the
>> TPM state, but this is meaningless because of the missing measurements,
>> and the attestation chain is broken.
>>
>> If the first OS does perform TPM measurements, it would need to record
>> them into a log and pass that on to the kexec'ed in some implementation
>> specific way - it cannot use the existing TPM event log for that.
>>
>> TL;DR perhaps we should just discard the TPM event log reference from
>> the EFI config tables after consuming it. Or add a special case to the
>> kexec code to disregard it.
> Ok, honestly that makes a lot of sense I see what you are saying and I
> tend to agree. I'm treating the copied event log at something that
> survives kexec in this patch because of the corruption fix so I'll look
> at dropping that LINUX_EFI_TPM_EVENT_LOG_GUID reference and rewrite this
> patch. Hopefully, that will avoid that x86 E820 instability as well.
>
> Appreciate the guidance!

Please don't send any patches yet - I'd like to get some input from other
folks as well.

Hi Ard,

On Fri, 4 Sept 2026 at 19:39, Ard Biesheuvel <ardb@kernel.org> wrote:
>
>
>
> On Fri, 4 Sep 2026, at 17:45, Jasmeet (Jazz) Bhatia wrote:
> > On Thu Sep 3, 2026 at 7:18 AM PDT, Ard Biesheuvel wrote:
> >> Hi Jazz,
> >>
> >> On Tue, 1 Sep 2026, at 13:34, Jasmeet (Jazz) Bhatia wrote:
> >>> The EFI stub currently allocates the TPM event log as
> >>> EFI_ACPI_RECLAIM_MEMORY. On x86, this becomes an ACPI data entry
> >>> in the E820 map.
> >>>
> >>> On a Framework Laptop 16 (AMD Ryzen AI 300 Series), the EFI allocator
> >>> can place this allocation at different physical addresses across boots.
> >>> Since x86 hibernation validates architecture-specific data from
> >>> the firmware E820 map, this causes an otherwise valid hibernation image
> >>> to be rejected on resume with the following error:
> >>>
> >>>   Hibernate inconsistent memory map detected!
> >>>   PM: hibernation: Image mismatch: architecture specific data
> >>>
> >>> Allocating the event log as EFI_LOADER_DATA avoids changing the E820
> >>> map, but doing that alone would regress the kexec corruption issue fixed
> >>> by commit 77d48d39e991 ("efistub/tpm: Use ACPI reclaim memory for event
> >>> log to avoid corruption").
> >>>
> >>
> >> As I replied in the other thread, I am not convinced preserving the TPM
> >> event log across a kexec makes sense to begin with. This is the firmware's
> >> view of the state of the TPM PCRs when it handed over the system to the
> >> first OS.

It doesn't make sense imho. The only thing you prove is that you
kexeced from a 'previous good OS', but without knowledge of what that
OS did before kexecing.

> >>
> >> If the first OS boots, loads a kexec kernel and then boots it without
> >> measuring any of that into the TPM, the TPM event log will match the
> >> TPM state, but this is meaningless because of the missing measurements,
> >> and the attestation chain is broken.
> >>
> >> If the first OS does perform TPM measurements, it would need to record
> >> them into a log and pass that on to the kexec'ed in some implementation
> >> specific way - it cannot use the existing TPM event log for that.

Hrmm, that might be problematic. The EventLog needs to illustrate the
state of the TPM PCRs. IOW replaying the EventLog in memory should
match the current TPM PCRs. But that also means we'll have to teach
kexec how to properly extend the PCRs and update the EventLog.

> >>
> >> TL;DR perhaps we should just discard the TPM event log reference from
> >> the EFI config tables after consuming it. Or add a special case to the
> >> kexec code to disregard it.

I can't decide what's best here. IIRC we don't expose the final event
log config table in systab right? So we won't break any user-space app
that depends on it.  We just copy it in
/sys/kernel/security/tpm0/binary_bios_measurements. In that case
getting rid of it would work.

Cheers
/Ilias

> > Ok, honestly that makes a lot of sense I see what you are saying and I
> > tend to agree. I'm treating the copied event log at something that
> > survives kexec in this patch because of the corruption fix so I'll look
> > at dropping that LINUX_EFI_TPM_EVENT_LOG_GUID reference and rewrite this
> > patch. Hopefully, that will avoid that x86 E820 instability as well.
> >
> > Appreciate the guidance!
>
> Please don't send any patches yet - I'd like to get some input from other
> folks as well.
>

On Mon Sep 7, 2026 at 8:57 AM PDT, Ilias Apalodimas wrote:
> Hi Ard,
>
> On Fri, 4 Sept 2026 at 19:39, Ard Biesheuvel <ardb@kernel.org> wrote:
>>
>>
>>
>> On Fri, 4 Sep 2026, at 17:45, Jasmeet (Jazz) Bhatia wrote:
>> > On Thu Sep 3, 2026 at 7:18 AM PDT, Ard Biesheuvel wrote:
>> >> Hi Jazz,
>> >>
>> >> On Tue, 1 Sep 2026, at 13:34, Jasmeet (Jazz) Bhatia wrote:
>> >>> The EFI stub currently allocates the TPM event log as
>> >>> EFI_ACPI_RECLAIM_MEMORY. On x86, this becomes an ACPI data entry
>> >>> in the E820 map.
>> >>>
>> >>> On a Framework Laptop 16 (AMD Ryzen AI 300 Series), the EFI allocator
>> >>> can place this allocation at different physical addresses across boots.
>> >>> Since x86 hibernation validates architecture-specific data from
>> >>> the firmware E820 map, this causes an otherwise valid hibernation image
>> >>> to be rejected on resume with the following error:
>> >>>
>> >>>   Hibernate inconsistent memory map detected!
>> >>>   PM: hibernation: Image mismatch: architecture specific data
>> >>>
>> >>> Allocating the event log as EFI_LOADER_DATA avoids changing the E820
>> >>> map, but doing that alone would regress the kexec corruption issue fixed
>> >>> by commit 77d48d39e991 ("efistub/tpm: Use ACPI reclaim memory for event
>> >>> log to avoid corruption").
>> >>>
>> >>
>> >> As I replied in the other thread, I am not convinced preserving the TPM
>> >> event log across a kexec makes sense to begin with. This is the firmware's
>> >> view of the state of the TPM PCRs when it handed over the system to the
>> >> first OS.
>
> It doesn't make sense imho. The only thing you prove is that you
> kexeced from a 'previous good OS', but without knowledge of what that
> OS did before kexecing.
>
>> >>
>> >> If the first OS boots, loads a kexec kernel and then boots it without
>> >> measuring any of that into the TPM, the TPM event log will match the
>> >> TPM state, but this is meaningless because of the missing measurements,
>> >> and the attestation chain is broken.
>> >>
>> >> If the first OS does perform TPM measurements, it would need to record
>> >> them into a log and pass that on to the kexec'ed in some implementation
>> >> specific way - it cannot use the existing TPM event log for that.
>
> Hrmm, that might be problematic. The EventLog needs to illustrate the
> state of the TPM PCRs. IOW replaying the EventLog in memory should
> match the current TPM PCRs. But that also means we'll have to teach
> kexec how to properly extend the PCRs and update the EventLog.
>
>> >>
>> >> TL;DR perhaps we should just discard the TPM event log reference from
>> >> the EFI config tables after consuming it. Or add a special case to the
>> >> kexec code to disregard it.

Assuming we drop the LINUX_EFI_TPM_EVENT_LOG_GUID reference after the
kernel consumes the log, is that going to impact any in-kernel kexec
path that expects that efi.tpm_log to remain valid? Or is that reference
only needed during the initial TPM event log import?

I'm trying to understand whether removing that reference is just for
stopping the next kernel from re-importing the stale firmware log, or
whether other there exists other users of that reference.

>
> I can't decide what's best here. IIRC we don't expose the final event
> log config table in systab right? So we won't break any user-space app
> that depends on it.  We just copy it in
> /sys/kernel/security/tpm0/binary_bios_measurements. In that case
> getting rid of it would work.
>
> Cheers
> /Ilias
>
>> > Ok, honestly that makes a lot of sense I see what you are saying and I
>> > tend to agree. I'm treating the copied event log at something that
>> > survives kexec in this patch because of the corruption fix so I'll look
>> > at dropping that LINUX_EFI_TPM_EVENT_LOG_GUID reference and rewrite this
>> > patch. Hopefully, that will avoid that x86 E820 instability as well.
>> >
>> > Appreciate the guidance!
>>
>> Please don't send any patches yet - I'd like to get some input from other
>> folks as well.
>>