Hello Eddie and all, On Tue, 3 Jan 2023 at 21:42, Eddie James <[email protected]> wrote: > > Add a configuration option to measure the boot through the bootm > function. > > Signed-off-by: Eddie James <[email protected]> > --- > boot/bootm.c | 53 +++++++++++++++++++++++++++++++++++++++++++++++++ > cmd/bootm.c | 2 ++ > common/Kconfig | 6 ++++++ > include/image.h | 1 + > 4 files changed, 62 insertions(+) > > diff --git a/boot/bootm.c b/boot/bootm.c > index a4c0870c0f..7f64d79035 100644 > --- a/boot/bootm.c > +++ b/boot/bootm.c > @@ -22,6 +22,9 @@ > #include <asm/global_data.h> > #include <asm/io.h> > #include <linux/sizes.h> > +#if defined(CONFIG_MEASURED_BOOT) > +#include <tpm-v2.h> > +#endif > #if defined(CONFIG_CMD_USB) > #include <usb.h> > #endif > @@ -713,6 +716,56 @@ int do_bootm_states(struct cmd_tbl *cmdtp, int flag, int > argc, > if (!ret && (states & BOOTM_STATE_FINDOTHER)) > ret = bootm_find_other(cmdtp, flag, argc, argv); > > +#if defined(CONFIG_MEASURED_BOOT) > + if (!ret && (states & BOOTM_STATE_MEASURE)) { > + void *initrd_buf; > + void *image_buf; > + const char *s; > + u32 rd_len; > + > + ret = tcg2_measurement_init(); > + if (ret) > + goto measure_err; > + > + image_buf = map_sysmem(images->os.image_start, > + images->os.image_len); > + ret = tcg2_measure_data(8, images->os.image_len, image_buf, > + EV_COMPACT_HASH, strlen("linux") + 1, > + (u8 *)"linux"); > + if (ret) > + goto unmap_image; > + > + rd_len = images->rd_end - images->rd_start; > + initrd_buf = map_sysmem(images->rd_start, rd_len); > + ret = tcg2_measure_data(8, rd_len, initrd_buf, > EV_COMPACT_HASH, > + strlen("initrd") + 1, (u8 *)"initrd"); > + if (ret) > + goto unmap_initrd; > + > + ret = tcg2_measure_data(9, images->ft_len, > + (u8 *)images->ft_addr, > + EV_TABLE_OF_DEVICES, strlen("dts") + > 1, > + (u8 *)"dts");
This unconditionally measures DTB content but maybe there are information that may differ at each boot as a random MAC address or an ASLR seed. Do you think something should condition measurement of the passed DTB as proposed using a config switch in [1]? [1] https://lore.kernel.org/all/[email protected]/ Regards, Etienne > + if (ret) > + goto unmap_initrd; > + > + s = env_get("bootargs"); > + if (!s) > + s = ""; > + tcg2_measure_data(1, strlen(s) + 1, (u8 *)s, > + EV_PLATFORM_CONFIG_FLAGS, strlen(s) + 1, > + (u8 *)s); > + > +unmap_initrd: > + unmap_sysmem(initrd_buf); > +unmap_image: > + unmap_sysmem(image_buf); > + tcg2_measurement_term(); > +measure_err: > + ret = 0; > + } > +#endif > + > /* Load the OS */ > if (!ret && (states & BOOTM_STATE_LOADOS)) { > iflag = bootm_disable_interrupts(); > diff --git a/cmd/bootm.c b/cmd/bootm.c > index 37c2af96e0..0c4a713e02 100644 > --- a/cmd/bootm.c > +++ b/cmd/bootm.c > @@ -161,6 +161,8 @@ int do_bootm(struct cmd_tbl *cmdtp, int flag, int argc, > char *const argv[]) > BOOTM_STATE_OS_GO; > if (IS_ENABLED(CONFIG_SYS_BOOT_RAMDISK_HIGH)) > states |= BOOTM_STATE_RAMDISK; > + if (IS_ENABLED(CONFIG_MEASURED_BOOT)) > + states |= BOOTM_STATE_MEASURE; > if (IS_ENABLED(CONFIG_PPC) || IS_ENABLED(CONFIG_MIPS)) > states |= BOOTM_STATE_OS_CMDLINE; > ret = do_bootm_states(cmdtp, flag, argc, argv, states, &images, 1); > diff --git a/common/Kconfig b/common/Kconfig > index 21434c5cf1..57ef68e4f3 100644 > --- a/common/Kconfig > +++ b/common/Kconfig > @@ -799,6 +799,12 @@ config AVB_BUF_SIZE > > endif # AVB_VERIFY > > +config MEASURED_BOOT > + bool "Measure the boot to TPM and event log" > + depends on HASH && TPM_V2 > + help > + This option enables measurement of the boot process. > + > config SCP03 > bool "Build SCP03 - Secure Channel Protocol O3 - controls" > depends on OPTEE || SANDBOX > diff --git a/include/image.h b/include/image.h > index 6f21dafba8..b00803eeac 100644 > --- a/include/image.h > +++ b/include/image.h > @@ -406,6 +406,7 @@ struct bootm_headers { > #define BOOTM_STATE_OS_FAKE_GO 0x00000200 /* 'Almost' run the OS */ > #define BOOTM_STATE_OS_GO 0x00000400 > #define BOOTM_STATE_PRE_LOAD 0x00000800 > +#define BOOTM_STATE_MEASURE 0x00001000 > int state; > > #if defined(CONFIG_LMB) && !defined(USE_HOSTCC) > -- > 2.31.1 >
