[SPR][EMR][GNR] TDX: efi: TD Measurement support for kernel cmdline/initrd sections from EFI stub

[Thibf]

This is a public version of https://bugs.launchpad.net/bugs/2058835

[Description]
  When a TD is created, during the boot process, steps like loading the firmware, bootloader, kernel image, etc are measured and stored in RTMR registers to support the trusted boot model. After boot, this measured value is used to validate the integrity of the boot process.

  During the direct boot process, bootloader is responsible for measuring the kernel image before loading the kernel. But if the kernel is loaded from EFI bootstub, the related measurements needs to be owned by the EFI bootstub. This support needs to be added to Linux EFI boot stub code.

  Also, as per the following discussion, the kernel command line or initrd section measurements also needs be owned by the EFI bootsub.

  https://edk2.groups.io/g/devel/topic/93737108?p=Created%2C%2C%2C20%2C2%2C0%2C0%3A%3A%2C%2C%2C0%2C0%2C0%2C93737108

[Fix]

Cherry pick cleanly:
    d228814b1913 efi/libstub: Add get_event_log() support for CC platforms
    ac93cbfc2a2c efi/libstub: Measure into CC protocol if TCG2 protocol is absent
    0bbe5b0ea97a efi/libstub: Add Confidential Computing (CC) measurement typedefs
    7a1381e8313f efi/tpm: Use symbolic GUID name from spec for final events table
    3e0b0f880e9e efi/libstub: Use TPM event typedefs from the TCG PC Client spec

  External Links:
    https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=70ef654469b371d0a71bcf967fa3dcbca05d4b25

Those are all merged into upstream.

[Test Plan]

Build/sign/boot with secure boot enabled.

[Where problems could occur]

At boot time, as this is modifying the efi libstub. Could be impacting secure boot.

[Andrea Righi (arighi)]

Applied all the listed commits to noble/linux, including also:

 9c55461040a9 ("x86/efistub: Remap kernel text read-only before dropping NX attribute")

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux/6.8.0-32.32 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-noble-linux' to 'verification-done-noble-linux'. If the problem still exists, change the tag 'verification-needed-noble-linux' to 'verification-failed-noble-linux'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 6.8.0-35.35

---------------
linux (6.8.0-35.35) noble; urgency=medium

  * noble/linux: 6.8.0-35.35 -proposed tracker (LP: #2065886)

  * CVE-2024-21823
    - VFIO: Add the SPR_DSA and SPR_IAX devices to the denylist
    - dmaengine: idxd: add a new security check to deal with a hardware erratum
    - dmaengine: idxd: add a write() method for applications to submit work

linux (6.8.0-34.34) noble; urgency=medium

  * noble/linux: 6.8.0-34.34 -proposed tracker (LP: #2065167)

  * Packaging resync (LP: #1786013)
    - [Packaging] debian.master/dkms-versions -- update from kernel-versions
      (main/2024.04.29)

linux (6.8.0-32.32) noble; urgency=medium

  * noble/linux: 6.8.0-32.32 -proposed tracker (LP: #2064344)

  * Packaging resync (LP: #1786013)
    - [Packaging] drop getabis data
    - [Packaging] update variants
    - [Packaging] update annotations scripts
    - [Packaging] debian.master/dkms-versions -- update from kernel-versions
      (main/2024.04.29)

  * Enable Nezha board (LP: #1975592)
    - [Config] Enable CONFIG_REGULATOR_FIXED_VOLTAGE on riscv64

  * Enable Nezha board (LP: #1975592) // Enable StarFive VisionFive 2 board
    (LP: #2013232)
    - [Config] Enable CONFIG_SERIAL_8250_DW on riscv64

  * RISC-V kernel config is out of sync with other archs (LP: #1981437)
    - [Config] Sync riscv64 config with other architectures

  * obsolete out-of-tree ivsc dkms in favor of in-tree one (LP: #2061747)
    - ACPI: scan: Defer enumeration of devices with a _DEP pointing to IVSC device
    - Revert "mei: vsc: Call wake_up() in the threaded IRQ handler"
    - mei: vsc: Unregister interrupt handler for system suspend
    - media: ipu-bridge: Add ov01a10 in Dell XPS 9315
    - SAUCE: media: ipu-bridge: Support more sensors

  * Fix after-suspend-mediacard/sdhc-insert test failed (LP: #2042500)
    - PCI/ASPM: Move pci_configure_ltr() to aspm.c
    - PCI/ASPM: Always build aspm.c
    - PCI/ASPM: Move pci_save_ltr_state() to aspm.c
    - PCI/ASPM: Save L1 PM Substates Capability for suspend/resume
    - PCI/ASPM: Call pci_save_ltr_state() from pci_save_pcie_state()
    - PCI/ASPM: Disable L1 before configuring L1 Substates
    - PCI/ASPM: Update save_state when configuration changes

  * RTL8852BE fw security fail then lost WIFI function during suspend/resume
    cycle (LP: #2063096)
    - wifi: rtw89: download firmware with five times retry

  * intel_rapl_common: Add support for ARL and LNL (LP: #2061953)
    - powercap: intel_rapl: Add support for Lunar Lake-M paltform
    - powercap: intel_rapl: Add support for Arrow Lake

  * Kernel panic during checkbox stress_ng_test on Grace running noble 6.8
    (arm64+largemem) kernel (LP: #2058557)
    - aio: Fix null ptr deref in aio_complete() wakeup

  * Avoid creating non-working backlight sysfs knob from ASUS board
    (LP: #2060422)
    - platform/x86: asus-wmi: Consider device is absent when the read is ~0

  * Include cifs.ko in linux-modules package (LP: #2042546)
    - [Packaging] Replace fs/cifs with fs/smb/client in inclusion list

  * Add Real-time Linux Analysis tool (rtla) to linux-tools (LP: #2059080)
    - SAUCE: rtla: fix deb build
 ...

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-aws/6.8.0-1009.9 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-noble-linux-aws' to 'verification-done-noble-linux-aws'. If the problem still exists, change the tag 'verification-needed-noble-linux-aws' to 'verification-failed-noble-linux-aws'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-gke/6.8.0-1004.7 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-noble-linux-gke' to 'verification-done-noble-linux-gke'. If the problem still exists, change the tag 'verification-needed-noble-linux-gke' to 'verification-failed-noble-linux-gke'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-azure/6.8.0-1008.8 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-noble-linux-azure' to 'verification-done-noble-linux-azure'. If the problem still exists, change the tag 'verification-needed-noble-linux-azure' to 'verification-failed-noble-linux-azure'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-gke/6.8.0-1004.7 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-noble-linux-gke' to 'verification-done-noble-linux-gke'. If the problem still exists, change the tag 'verification-needed-noble-linux-gke' to 'verification-failed-noble-linux-gke'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-gcp/6.8.0-1008.9 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-noble-linux-gcp' to 'verification-done-noble-linux-gcp'. If the problem still exists, change the tag 'verification-needed-noble-linux-gcp' to 'verification-failed-noble-linux-gcp'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-ibm/6.8.0-1006.6 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-noble-linux-ibm' to 'verification-done-noble-linux-ibm'. If the problem still exists, change the tag 'verification-needed-noble-linux-ibm' to 'verification-failed-noble-linux-ibm'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-intel/6.8.0-1005.12 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-noble-linux-intel' to 'verification-done-noble-linux-intel'. If the problem still exists, change the tag 'verification-needed-noble-linux-intel' to 'verification-failed-noble-linux-intel'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-nvidia/6.8.0-1007.7 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-noble-linux-nvidia' to 'verification-done-noble-linux-nvidia'. If the problem still exists, change the tag 'verification-needed-noble-linux-nvidia' to 'verification-failed-noble-linux-nvidia'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-oem-6.8/6.8.0-1006.6 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-noble-linux-oem-6.8' to 'verification-done-noble-linux-oem-6.8'. If the problem still exists, change the tag 'verification-needed-noble-linux-oem-6.8' to 'verification-failed-noble-linux-oem-6.8'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-nvidia/6.8.0-1007.7 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-noble-linux-nvidia' to 'verification-done-noble-linux-nvidia'. If the problem still exists, change the tag 'verification-needed-noble-linux-nvidia' to 'verification-failed-noble-linux-nvidia'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-riscv/6.8.0-35.35.1 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-noble-linux-riscv' to 'verification-done-noble-linux-riscv'. If the problem still exists, change the tag 'verification-needed-noble-linux-riscv' to 'verification-failed-noble-linux-riscv'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-raspi-realtime/6.8.0-2004.4 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-noble-linux-raspi-realtime' to 'verification-done-noble-linux-raspi-realtime'. If the problem still exists, change the tag 'verification-needed-noble-linux-raspi-realtime' to 'verification-failed-noble-linux-raspi-realtime'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-lowlatency/6.8.0-35.35.1 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-noble-linux-lowlatency' to 'verification-done-noble-linux-lowlatency'. If the problem still exists, change the tag 'verification-needed-noble-linux-lowlatency' to 'verification-failed-noble-linux-lowlatency'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-oracle/6.8.0-1006.6 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-noble-linux-oracle' to 'verification-done-noble-linux-oracle'. If the problem still exists, change the tag 'verification-needed-noble-linux-oracle' to 'verification-failed-noble-linux-oracle'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-ibm-gt/6.8.0-1004.5 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-noble-linux-ibm-gt' to 'verification-done-noble-linux-ibm-gt'. If the problem still exists, change the tag 'verification-needed-noble-linux-ibm-gt' to 'verification-failed-noble-linux-ibm-gt'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!