From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from phobos.denx.de (phobos.denx.de [85.214.62.61]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 41B2EC3DA7D for ; Tue, 3 Jan 2023 20:42:44 +0000 (UTC) Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id 75BC68551C; Tue, 3 Jan 2023 21:42:24 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=none (p=none dis=none) header.from=linux.ibm.com Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=ibm.com header.i=@ibm.com header.b="GbWPmkFW"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id 0FC4D8544F; Tue, 3 Jan 2023 21:42:19 +0100 (CET) Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id 410158549C for ; Tue, 3 Jan 2023 21:42:14 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=none (p=none dis=none) header.from=linux.ibm.com Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=eajames@linux.ibm.com Received: from pps.filterd (m0127361.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 303IPSJD025279; Tue, 3 Jan 2023 20:42:12 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=x55g0Quy4/bqsggmytZUkIYkqO9rH+GR0cqguvD0aNA=; b=GbWPmkFWeOL3pmfx3o36uEHsjQfwyHRr5EBelubj1i4Q8uBnQCRao+1A8OOPJMbMhY7E kjgPy3yoYqLqNtHE2Q2AzBGHFH/xhfxRRI6YEOksG1FAuA6qaHLbvX3q2YlQs+TUTDrF eMe9G+vFs79j4eAN/yjkYiLFATv8Y2qP0VvPJiuzjW12j7iIL/O8Vm+Fnz0+zWKeZhqc 4sejy9qiY8ja7kZCGnrXQkHiZSG58ZwfRtK7COBJTp073kX0mLuXgIFSQrK7fq4dHxns K3emR2JlkMuLcGqazxE0VYXG/SrhDFX4KCoSEouGxxYaagteHpSeIhJm/k4EO8LbWYfm 5w== Received: from ppma02wdc.us.ibm.com (aa.5b.37a9.ip4.static.sl-reverse.com [169.55.91.170]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3mvjvf5fq7-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 03 Jan 2023 20:42:12 +0000 Received: from pps.filterd (ppma02wdc.us.ibm.com [127.0.0.1]) by ppma02wdc.us.ibm.com (8.17.1.19/8.17.1.19) with ESMTP id 303ILxDF019444; Tue, 3 Jan 2023 20:42:11 GMT Received: from smtprelay01.wdc07v.mail.ibm.com ([9.208.129.119]) by ppma02wdc.us.ibm.com (PPS) with ESMTPS id 3mtcq7kvfj-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 03 Jan 2023 20:42:11 +0000 Received: from smtpav02.dal12v.mail.ibm.com (smtpav02.dal12v.mail.ibm.com [10.241.53.101]) by smtprelay01.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 303Kg9ic41615680 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 3 Jan 2023 20:42:10 GMT Received: from smtpav02.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id CD0B85805C; Tue, 3 Jan 2023 20:42:09 +0000 (GMT) Received: from smtpav02.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 5534D5805A; Tue, 3 Jan 2023 20:42:09 +0000 (GMT) Received: from slate16.aus.stglabs.ibm.com (unknown [9.65.211.96]) by smtpav02.dal12v.mail.ibm.com (Postfix) with ESMTP; Tue, 3 Jan 2023 20:42:09 +0000 (GMT) From: Eddie James To: u-boot@lists.denx.de Cc: ilias.apalodimas@linaro.org, Eddie James Subject: [PATCH 3/3] bootm: Support boot measurement Date: Tue, 3 Jan 2023 14:42:02 -0600 Message-Id: <20230103204202.417074-4-eajames@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20230103204202.417074-1-eajames@linux.ibm.com> References: <20230103204202.417074-1-eajames@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: 5eYo0MpU8ymd57-pXVIBIHUVnAkiRDgh X-Proofpoint-GUID: 5eYo0MpU8ymd57-pXVIBIHUVnAkiRDgh X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.923,Hydra:6.0.545,FMLib:17.11.122.1 definitions=2023-01-03_07,2023-01-03_02,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 spamscore=0 suspectscore=0 lowpriorityscore=0 bulkscore=0 mlxlogscore=999 adultscore=0 impostorscore=0 mlxscore=0 phishscore=0 malwarescore=0 clxscore=1015 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2212070000 definitions=main-2301030174 X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.39 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.6 at phobos.denx.de X-Virus-Status: Clean Add a configuration option to measure the boot through the bootm function. Signed-off-by: Eddie James --- boot/bootm.c | 53 +++++++++++++++++++++++++++++++++++++++++++++++++ cmd/bootm.c | 2 ++ common/Kconfig | 6 ++++++ include/image.h | 1 + 4 files changed, 62 insertions(+) diff --git a/boot/bootm.c b/boot/bootm.c index a4c0870c0f..7f64d79035 100644 --- a/boot/bootm.c +++ b/boot/bootm.c @@ -22,6 +22,9 @@ #include #include #include +#if defined(CONFIG_MEASURED_BOOT) +#include +#endif #if defined(CONFIG_CMD_USB) #include #endif @@ -713,6 +716,56 @@ int do_bootm_states(struct cmd_tbl *cmdtp, int flag, int argc, if (!ret && (states & BOOTM_STATE_FINDOTHER)) ret = bootm_find_other(cmdtp, flag, argc, argv); +#if defined(CONFIG_MEASURED_BOOT) + if (!ret && (states & BOOTM_STATE_MEASURE)) { + void *initrd_buf; + void *image_buf; + const char *s; + u32 rd_len; + + ret = tcg2_measurement_init(); + if (ret) + goto measure_err; + + image_buf = map_sysmem(images->os.image_start, + images->os.image_len); + ret = tcg2_measure_data(8, images->os.image_len, image_buf, + EV_COMPACT_HASH, strlen("linux") + 1, + (u8 *)"linux"); + if (ret) + goto unmap_image; + + rd_len = images->rd_end - images->rd_start; + initrd_buf = map_sysmem(images->rd_start, rd_len); + ret = tcg2_measure_data(8, rd_len, initrd_buf, EV_COMPACT_HASH, + strlen("initrd") + 1, (u8 *)"initrd"); + if (ret) + goto unmap_initrd; + + ret = tcg2_measure_data(9, images->ft_len, + (u8 *)images->ft_addr, + EV_TABLE_OF_DEVICES, strlen("dts") + 1, + (u8 *)"dts"); + if (ret) + goto unmap_initrd; + + s = env_get("bootargs"); + if (!s) + s = ""; + tcg2_measure_data(1, strlen(s) + 1, (u8 *)s, + EV_PLATFORM_CONFIG_FLAGS, strlen(s) + 1, + (u8 *)s); + +unmap_initrd: + unmap_sysmem(initrd_buf); +unmap_image: + unmap_sysmem(image_buf); + tcg2_measurement_term(); +measure_err: + ret = 0; + } +#endif + /* Load the OS */ if (!ret && (states & BOOTM_STATE_LOADOS)) { iflag = bootm_disable_interrupts(); diff --git a/cmd/bootm.c b/cmd/bootm.c index 37c2af96e0..0c4a713e02 100644 --- a/cmd/bootm.c +++ b/cmd/bootm.c @@ -161,6 +161,8 @@ int do_bootm(struct cmd_tbl *cmdtp, int flag, int argc, char *const argv[]) BOOTM_STATE_OS_GO; if (IS_ENABLED(CONFIG_SYS_BOOT_RAMDISK_HIGH)) states |= BOOTM_STATE_RAMDISK; + if (IS_ENABLED(CONFIG_MEASURED_BOOT)) + states |= BOOTM_STATE_MEASURE; if (IS_ENABLED(CONFIG_PPC) || IS_ENABLED(CONFIG_MIPS)) states |= BOOTM_STATE_OS_CMDLINE; ret = do_bootm_states(cmdtp, flag, argc, argv, states, &images, 1); diff --git a/common/Kconfig b/common/Kconfig index 21434c5cf1..57ef68e4f3 100644 --- a/common/Kconfig +++ b/common/Kconfig @@ -799,6 +799,12 @@ config AVB_BUF_SIZE endif # AVB_VERIFY +config MEASURED_BOOT + bool "Measure the boot to TPM and event log" + depends on HASH && TPM_V2 + help + This option enables measurement of the boot process. + config SCP03 bool "Build SCP03 - Secure Channel Protocol O3 - controls" depends on OPTEE || SANDBOX diff --git a/include/image.h b/include/image.h index 6f21dafba8..b00803eeac 100644 --- a/include/image.h +++ b/include/image.h @@ -406,6 +406,7 @@ struct bootm_headers { #define BOOTM_STATE_OS_FAKE_GO 0x00000200 /* 'Almost' run the OS */ #define BOOTM_STATE_OS_GO 0x00000400 #define BOOTM_STATE_PRE_LOAD 0x00000800 +#define BOOTM_STATE_MEASURE 0x00001000 int state; #if defined(CONFIG_LMB) && !defined(USE_HOSTCC) -- 2.31.1