]> git.ipfire.org Git - thirdparty/grub.git/commit
commands/efi/tpm: Re-enable measurements on confidential computing platforms
authorHector Cao <hector.cao@canonical.com>
Mon, 3 Jun 2024 21:36:25 +0000 (23:36 +0200)
committerDaniel Kiper <daniel.kiper@oracle.com>
Thu, 6 Jun 2024 14:55:16 +0000 (16:55 +0200)
commit86df79275d065d87f4de5c97e456973e8b4a649c
tree905a66c69dcce9f08b3d2a6438a498665e42fcf0
parent0b4d01794a08efc6f6de88c5a08ff81bb52122d4
commands/efi/tpm: Re-enable measurements on confidential computing platforms

The measurements for confidential computing has been introduced in the
commit 4c76565b6 (efi/tpm: Add EFI_CC_MEASUREMENT_PROTOCOL support).
Recently the patch 30708dfe3 (tpm: Disable the tpm verifier if the TPM
device is not present) has been introduced to optimize the memory usage
when a TPM device is not available on platforms. This fix prevents the
tpm module to be loaded on confidential computing platforms, e.g. Intel
machines with TDX enabled, where the TPM device is not available.

In this patch, we propose to load the tpm module for this use case by
generalizing the tpm feature detection in order to cover CC platforms.
Basically, we do it by detecting the availability of the
EFI_CC_MEASUREMENT_PROTOCOL EFI protocol.

Fixes: https://savannah.gnu.org/bugs/?65821
Fixes: 30708dfe3 (tpm: Disable the tpm verifier if the TPM device is not present)
Signed-off-by: Hector Cao <hector.cao@canonical.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
grub-core/commands/efi/tpm.c