feat(guest-agent): add CCEL binary event log to GetQuote response

Add `event_log_ccel` field to GetQuoteResponse carrying the merged TCG
binary Confidential Computing Event Log. Boot-time events are copied
verbatim from the ACPI CCEL table; runtime events (RTMR3) are appended
as TCG_PCR_EVENT2 records whose event data is the digest pre-image,
making sha384(event) == digest verifiable by any TCG parser without
dstack-specific schema knowledge.

Verified on a real TDX CVM: replaying the RTMR3 digests from the merged
CCEL produces a value that matches td10.rt_mr3 from a fresh TDX quote.

Author: kvinwang

Cargo.lock

@@ -26,4 +26,6 @@ serde_json = { workspace = true, features = ["alloc"] }
 sha2.workspace = true
 
 [dev-dependencies]
+dcap-qvl.workspace = true
 insta.workspace = true
+tdx-attest.workspace = true

cc-eventlog/Cargo.toml

@@ -0,0 +1,72 @@
+// End-to-end verification: runs on a real TDX CVM, reads the actual
+// /sys/firmware/acpi/tables/data/CCEL + /run/log/dstack/runtime_events.log,
+// builds the merged CCEL binary, decodes it back, and verifies invariants.
+
+use anyhow::{Context, Result};
+use cc_eventlog::{
+    tcg::TcgEventLog,
+    tdx::{build_ccel_event_log, read_event_log, TdxEvent},
+    DSTACK_RUNTIME_EVENT_TYPE,
+};
+use dcap_qvl::quote::Quote;
+use ez_hash::{Hasher, Sha384};
+
+fn main() -> Result<()> {
+    let events = read_event_log().context("read event log")?;
+    let orig_runtime = events.iter().filter(|e| e.is_runtime_event()).count();
+    eprintln!("runtime events: {orig_runtime}");
+    eprintln!("total events:   {}", events.len());
+
+    let merged = build_ccel_event_log(&events).context("build merged CCEL")?;
+    eprintln!("merged CCEL size: {} bytes", merged.len());
+
+    let parsed = TcgEventLog::decode(&mut merged.as_slice()).context("decode merged CCEL")?;
+    let decoded: Vec<TdxEvent> = parsed.to_cc_event_log().context("to_cc_event_log")?;
+    eprintln!("decoded events:   {}", decoded.len());
+
+    // Every runtime event in the output must satisfy sha384(event_data) == digest
+    let mut checked = 0usize;
+    for e in &decoded {
+        if e.event_type != DSTACK_RUNTIME_EVENT_TYPE {
+            continue;
+        }
+        let h = Sha384::hash([e.event_payload.as_slice()]);
+        anyhow::ensure!(
+            h.as_slice() == e.digest.as_slice(),
+            "digest mismatch for runtime event at imr={}",
+            e.imr,
+        );
+        checked += 1;
+    }
+    eprintln!("runtime events verified: {checked}");
+    anyhow::ensure!(
+        checked == orig_runtime,
+        "expected {orig_runtime} runtime events in merged CCEL, got {checked}"
+    );
+
+    // RTMR3 replay check: replay the runtime digests in order and compare with
+    // what the TD10 report says. We can't easily read the quote here without
+    // TDX attest, so just print the replayed RTMR3 for manual comparison.
+    let mut rtmr3 = [0u8; 48];
+    for e in decoded.iter().filter(|e| e.imr == 3) {
+        let mut data = [0u8; 96];
+        data[..48].copy_from_slice(&rtmr3);
+        data[48..].copy_from_slice(&e.digest);
+        rtmr3 = Sha384::hash([data.as_slice()]);
+    }
+    eprintln!("replayed RTMR3:   {}", hex::encode(rtmr3));
+
+    // Compare against the real RTMR3 from a fresh TDX quote.
+    let report_data = [0u8; 64];
+    let quote_bytes = tdx_attest::get_quote(&report_data).context("tdx_attest::get_quote")?;
+    let quote = Quote::parse(&quote_bytes).context("parse quote")?;
+    let td10 = quote.report.as_td10().context("missing td10 report")?;
+    eprintln!("td10 RTMR3:       {}", hex::encode(td10.rt_mr3));
+    anyhow::ensure!(
+        rtmr3 == td10.rt_mr3,
+        "replayed RTMR3 does not match td10 RTMR3"
+    );
+
+    println!("OK");
+    Ok(())
+}

cc-eventlog/examples/verify_ccel_device.rs

@@ -10,12 +10,15 @@ pub use tdx::TdxEvent;
 
 mod codecs;
 mod runtime_events;
-mod tcg;
+pub mod tcg;
 pub mod tdx;
 
 #[cfg(test)]
 mod tests {
     use super::*;
+    use dstack_types::EventLogVersion;
+    use ez_hash::{Hasher, Sha384};
+    use tdx::TdxEvent;
 
     #[test]
     fn parse_ccel() {
@@ -26,4 +29,56 @@ mod tests {
         let json = serde_json::to_string_pretty(&tdx_event_logs).unwrap();
         insta::assert_snapshot!(json);
     }
+
+    #[test]
+    fn encode_runtime_events_roundtrip() {
+        // Synthesize a CCEL: sample boot-time bytes + encoded runtime events.
+        // Decode with the same TcgEventLog parser and verify:
+        // 1. all boot-time events are preserved
+        // 2. runtime events appear with the expected pcrIndex / event_type / digest
+        // 3. sha384(event_data) == digest (the property we document)
+        let boot_raw = include_bytes!("../samples/ccel.bin");
+        let valid = tcg::ccel_content_len(boot_raw).unwrap();
+
+        let runtime_v1: TdxEvent = RuntimeEvent::new(
+            "app-id".to_string(),
+            vec![0xaa, 0xbb, 0xcc],
+            EventLogVersion::V1,
+        )
+        .into();
+        let runtime_v2: TdxEvent = RuntimeEvent::new(
+            "compose-hash".to_string(),
+            vec![0xde, 0xad, 0xbe, 0xef],
+            EventLogVersion::V2,
+        )
+        .into();
+        let runtime_events = vec![runtime_v1.clone(), runtime_v2.clone()];
+
+        let mut merged = boot_raw[..valid].to_vec();
+        merged.extend_from_slice(&tcg::encode_runtime_events_as_tcg(&runtime_events));
+        merged.extend_from_slice(&0xFFFF_FFFFu32.to_le_bytes());
+
+        let parsed = tcg::TcgEventLog::decode(&mut merged.as_slice()).unwrap();
+        let boot_count = tcg::TcgEventLog::decode(&mut boot_raw.as_slice())
+            .unwrap()
+            .event_logs
+            .len();
+        assert_eq!(parsed.event_logs.len(), boot_count + 2);
+
+        // Convert and verify runtime tail matches what we put in.
+        let converted = parsed.to_cc_event_log().unwrap();
+        let tail = &converted[converted.len() - 2..];
+        for (orig, got) in runtime_events.iter().zip(tail.iter()) {
+            assert_eq!(got.imr, orig.imr);
+            assert_eq!(got.event_type, orig.event_type);
+            assert_eq!(got.digest, orig.digest());
+            // The event_payload carried in TdxEvent after TCG round-trip is the
+            // hash_input bytes we stored as TCG event data.
+            let runtime = orig.to_runtime_event().unwrap();
+            assert_eq!(got.event_payload, runtime.hash_input());
+            // Property: sha384(event_data) == digest
+            let h = Sha384::hash([got.event_payload.as_slice()]);
+            assert_eq!(h.as_slice(), got.digest.as_slice());
+        }
+    }
 }

cc-eventlog/src/lib.rs

@@ -300,7 +300,7 @@ impl TcgEventLog {
     }
 
     pub fn decode_from_ccel_file() -> Result<Self> {
-        let data = fs_err::read(CCEL_FILE).context("Failed to read CCEL")?;
+        let data = read_ccel_raw()?;
         Self::decode(&mut data.as_slice())
     }
 
@@ -314,6 +314,51 @@ impl TcgEventLog {
     }
 }
 
+/// Read the raw ACPI CCEL table bytes from `/sys/firmware/acpi/tables/data/CCEL`.
+pub fn read_ccel_raw() -> Result<Vec<u8>> {
+    fs_err::read(CCEL_FILE).context("Failed to read CCEL")
+}
+
+/// Return the length of the valid TCG event log prefix within a raw CCEL buffer.
+///
+/// ACPI CCEL tables are fixed-size regions padded with 0xFF; the event stream
+/// either ends with a 0xFFFFFFFF terminator or by running into that padding.
+/// This parses the buffer to find where real events end so the trailer can be
+/// stripped before appending runtime events.
+pub fn ccel_content_len(raw: &[u8]) -> Result<usize> {
+    let input = &mut &raw[..];
+    TcgEventLog::decode(input)?;
+    Ok(raw.len() - input.len())
+}
+
+/// Encode dstack runtime events as TCG_PCR_EVENT2 records.
+///
+/// Non-runtime events in the slice are skipped. Each runtime event becomes:
+/// - pcrIndex  = imr + 1 (0-based TdxEvent -> 1-based TCG pcrIndex)
+/// - eventType = DSTACK_RUNTIME_EVENT_TYPE
+/// - digests   = [{ TPM_ALG_SHA384, <48-byte digest> }]
+/// - event     = the digest pre-image bytes (`hash_input`), so that
+///   sha384(event) == digest holds for any TCG parser.
+pub fn encode_runtime_events_as_tcg(events: &[TdxEvent]) -> Vec<u8> {
+    let mut out = Vec::new();
+    for event in events {
+        let Some(runtime) = event.to_runtime_event() else {
+            continue;
+        };
+        let hash_input = runtime.hash_input();
+        let digest = event.digest();
+        let pcr_index = event.imr.saturating_add(1);
+        out.extend_from_slice(&pcr_index.to_le_bytes());
+        out.extend_from_slice(&event.event_type.to_le_bytes());
+        out.extend_from_slice(&1u32.to_le_bytes());
+        out.extend_from_slice(&TPM_ALG_SHA384.to_le_bytes());
+        out.extend_from_slice(&digest);
+        out.extend_from_slice(&(hash_input.len() as u32).to_le_bytes());
+        out.extend_from_slice(&hash_input);
+    }
+    out
+}
+
 fn parse_spec_id_event_log<I: scale::Input>(
     input: &mut I,
 ) -> Result<(TcgEvent, TcgEfiSpecIdEvent)> {

cc-eventlog/src/tcg.rs

@@ -228,3 +228,19 @@ pub fn read_event_log() -> Result<Vec<TdxEvent>> {
     event_logs.extend(RuntimeEvent::read_all()?.into_iter().map(Into::into));
     Ok(event_logs)
 }
+
+/// Build a merged TCG binary event log: raw ACPI CCEL (boot-time) followed by
+/// the given runtime events encoded as TCG_PCR_EVENT2 records.
+///
+/// Non-runtime entries in `events` are ignored; only events with
+/// `event_type == DSTACK_RUNTIME_EVENT_TYPE` are appended.
+pub fn build_ccel_event_log(events: &[TdxEvent]) -> Result<Vec<u8>> {
+    let raw = crate::tcg::read_ccel_raw()?;
+    let end = crate::tcg::ccel_content_len(&raw)?;
+    let mut out = raw[..end].to_vec();
+    out.extend_from_slice(&crate::tcg::encode_runtime_events_as_tcg(events));
+    // Append the 0xFFFFFFFF terminator so parsers know where the event
+    // stream ends (the original ACPI table has trailing 0xFF padding).
+    out.extend_from_slice(&0xFFFF_FFFFu32.to_le_bytes());
+    Ok(out)
+}

cc-eventlog/src/tdx.rs

@@ -751,6 +751,18 @@ impl<T> Attestation<T> {
             .and_then(|q| Quote::parse(&q.quote).ok())
             .and_then(|quote| quote.report.as_td10().cloned())
     }
+
+    /// Get the merged TCG binary CCEL event log (boot-time CCEL + runtime
+    /// events encoded as TCG_PCR_EVENT2 records).
+    ///
+    /// Returns an empty `Vec` on platforms without a TDX quote (e.g. Nitro).
+    /// Propagates errors from reading or parsing the ACPI CCEL file.
+    pub fn get_tdx_event_log_ccel(&self) -> Result<Vec<u8>> {
+        let Some(q) = self.tdx_quote() else {
+            return Ok(Vec::new());
+        };
+        cc_eventlog::tdx::build_ccel_event_log(&q.event_log)
+    }
 }
 
 pub trait GetDeviceId {

dstack-attest/src/attestation.rs

@@ -43,6 +43,7 @@ pub fn simulated_quote_response(
             .unwrap_or_default(),
         report_data: report_data.to_vec(),
         vm_config: vm_config.to_string(),
+        event_log_ccel: Vec::new(),
     })
 }
 

guest-agent-simulator/src/simulator.rs

@@ -208,6 +208,27 @@ message GetQuoteResponse {
   bytes report_data = 3;
   // Hw config
   string vm_config = 4;
+  // TCG binary Confidential Computing Event Log (CCEL) containing both
+  // boot-time events (from the ACPI CCEL table) and dstack runtime events
+  // (RTMR3) merged into a single stream.
+  //
+  // Encoding per TCG PC Client Platform Firmware Profile:
+  // - Starts with a Spec ID header event (TCG_PCClientPCREvent).
+  // - Boot-time events are copied verbatim from the ACPI CCEL table
+  //   (TCG_PCR_EVENT2 with the digests the firmware wrote).
+  // - Runtime events (event_type = 0x08000001) are appended as
+  //   TCG_PCR_EVENT2 records with:
+  //     * pcrIndex  = imr + 1 (so RTMR3 becomes 4)
+  //     * eventType = 0x08000001
+  //     * digests   = [{ algId: TPM_ALG_SHA384 (0xC), hash: 48 bytes }]
+  //     * event     = the digest pre-image bytes, so that
+  //                   sha384(event) == digest holds independently of the
+  //                   dstack schema. The pre-image is:
+  //                     V1: event_type_le || ":" || name || ":" || payload
+  //                     V2: canonical JSON (UTF-8)
+  //
+  // Empty on platforms without an ACPI CCEL table (e.g. Nitro Enclaves).
+  bytes event_log_ccel = 5;
 }
 
 message EmitEventArgs {

guest-agent/rpc/proto/agent_rpc.proto

@@ -52,11 +52,15 @@ impl PlatformBackend for RealPlatform {
         let attestation = Attestation::quote(&report_data).context("Failed to get quote")?;
         let tdx_quote = attestation.get_tdx_quote_bytes();
         let tdx_event_log = attestation.get_tdx_event_log_string(include_hash_inputs);
+        let event_log_ccel = attestation
+            .get_tdx_event_log_ccel()
+            .context("failed to build CCEL event log")?;
         Ok(GetQuoteResponse {
             quote: tdx_quote.unwrap_or_default(),
             event_log: tdx_event_log.unwrap_or_default(),
             report_data: report_data.to_vec(),
             vm_config: vm_config.to_string(),
+            event_log_ccel,
         })
     }