Missing measurements on confidential computing platforms (Intel TDX)

[Hector CAO]

When we run a Confidential VM with grub bootlodaer on Intel TDX platform, the module tpm is not loaded and boot measurements are not done for the guest VM.

This bug will prevent grub of doing measurements on confidential computing platform
(the bug has been confirmed on Intel TDX). This lack of measurements will break the
remote attestation

See upstream bug : https://savannah.gnu.org/bugs/?65821

Upstream fix : https://git.savannah.gnu.org/cgit/grub.git/commit/?id=86df79275d065d87f4de5c97e456973e8b4a649c

[Julian Andres Klode (juliank)]

Reassigning to the correct package. This also needs a grub2-signed task.

We can pick this patch up or if you have experience working with a gbp-pq managed repository you could propose a merge for that. Either way, only the UEFI team can actually release any grub updates due to signing.

[Mate Kukri (mkukri)]

@hectorcao, I am including your upstream patch in the next Ubuntu GRUB

[Hector CAO (hectorcao)]

@mkukri and @juliank

Thanks so much for the feedback and work
Now, i would like to ask if we can consider to SRU it to 24.04 because we are having CC story for 24.04 with our Kobuk project

[Mate Kukri (mkukri)]

As per SRU requirements it needs to go into the development release first, but I don't see anything preventing it from being SRUd afterwards.

[Launchpad Janitor (janitor)]

This bug was fixed in the package grub2-unsigned - 2.12-1ubuntu9

---------------
grub2-unsigned (2.12-1ubuntu9) oracular; urgency=medium

  * Cherry-pick upstream efi mm patches to avoid crashing at exit on Mu
  * peimage: Improve section consistency checks, use grub_dprintf for errors
  * peimage: Make sure partially loaded images are unloaded on error
  * Implement support for UEFI NX mitigation
  * Cherry-pick missing TDX measurements fix (LP: #2069232)
  * grub-common.service: Add After/Requires=boot-complete.target (LP: #1992643)
  * d/postinst.in: Remove upgrade check for GRUB version we can no longer upgrade from
  * Cherry-pick fdtdump patch
  * Source package generated from src:grub2 using make -f ./debian/rules
    generate-grub2-unsigned

 -- Mate Kukri <email address hidden> Wed, 19 Jun 2024 11:47:16 +0100