Linux 7.3 TPM Makes Cleanup Preparations For TrenchBoot

The Trusted Platform Module (TPM) subsystem changes for the Linux 7.3 kernel are centered around code clean-ups and improvements being made as a precursor toward TrenchBoot support.

TrenchBoot is years in the making as an open-source effort for enhancing boot secuirty and integrity by leveraging hardware-backed features for a Dynamic Root of Trust for Measurement (DRTM). Oracle has been among the big supporters of TrenchBoot over the years for securing the boot process.

TrenchBoot makes use of AMD and Intel security technologies and also requires changes to the likes of the GRUB bootloader and Linux kernel. The Linux kernel patches haven't been upstreamed yet but the TPM changes merged for Linux 7.3 are necessary for allowing that possibility of TrenchBoot reaching the mainline kernel.

Jarkko Sakkinen explained in the TPM merge for Linux 7.3:

"The bulk of this is Ross Philipson's TPM enablement for Trenchboot. That exposes TPM constants, and decouple and improve robustness of tpm_buf a bit in order to implement a minimal early TPM driver.

Early boot code will call either SKINIT on AMD or GETSEC[SENTER] on Intel before jumping into kernel's entry point. They re-initalize TPM PCRs but leave up to the early boot code measure initrd, boot_params and Trenchboot associated metadata.

The motivation here is just that we would want in future iterations of the series put our full focus to the x86 part of the review, and call it a day as per TPM changes. Further, even if Trenchboot turned out to be empty lottery the worst possible outcome for TPM driver is that things get cleaned up a bit."

So it's a win in any event. While TrenchBoot itself isn't coming for the Linux 7.3 kernel cycle, those wanting to learn more about this boot security functionality can do so at TrenchBoot.org.