Enable measurements for Intel TDX

Bug #2047922 reported by Hector CAO
10
This bug affects 1 person
Affects Status Importance Assigned to Milestone
edk2 (Ubuntu)
Fix Released
Undecided
dann frazier

Bug Description

In the scope of enabling the TDX on 24.04, remote attestation feature of TDX needs measurements to be enabled in the firmware.

Right now, the feature is disable (CC_MEASUREMENT_ENABLE=FALSE) by default, we would like to have it enabled.

Here is an snippet example on how to do it:

diff --git a/debian/rules b/debian/rules
index 116c9c74b7..89b20259e2 100755
--- a/debian/rules
+++ b/debian/rules
@@ -30,6 +30,7 @@ COMMON_FLAGS = -DNETWORK_HTTP_BOOT_ENABLE=TRUE
 COMMON_FLAGS += -DNETWORK_IP6_ENABLE=TRUE
 COMMON_FLAGS += -DNETWORK_TLS_ENABLE
 COMMON_FLAGS += -DSECURE_BOOT_ENABLE=TRUE
+COMMON_FLAGS += -DCC_MEASUREMENT_ENABLE=TRUE
 COMMON_FLAGS += $(PCD_FLAGS)
 OVMF_COMMON_FLAGS = $(COMMON_FLAGS)
 OVMF_COMMON_FLAGS += -DTPM2_ENABLE=TRUE

The firmware with this change has been tested and did not show any regression. The test cases can be found here : https://github.com/intel/tdx/wiki/Tests

Revision history for this message
Paride Legovini (paride) wrote :

@dann I am not familiar with the package but this looks reasonable. Will you handle this on the Debian side?

Revision history for this message
dann frazier (dannf) wrote :

Yeah, I'll take a look.

Changed in edk2 (Ubuntu):
assignee: nobody → dann frazier (dannf)
dann frazier (dannf)
Changed in edk2 (Ubuntu):
status: New → Fix Committed
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package edk2 - 2023.11-4

---------------
edk2 (2023.11-4) unstable; urgency=medium

  * ovmf: Enable EFI_CC_MEASUREMENT_PROTOCOL. LP: #2047922.

 -- dann frazier <email address hidden> Sat, 06 Jan 2024 11:16:34 -0700

Changed in edk2 (Ubuntu):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.