From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from phobos.denx.de (phobos.denx.de [85.214.62.61]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 4F653C05027 for ; Thu, 26 Jan 2023 06:54:26 +0000 (UTC) Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id 0DF5C854F1; Thu, 26 Jan 2023 07:54:24 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=linaro.org header.i=@linaro.org header.b="WCsGSf87"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id 62A5A85662; Thu, 26 Jan 2023 07:54:22 +0100 (CET) Received: from mail-ed1-x529.google.com (mail-ed1-x529.google.com [IPv6:2a00:1450:4864:20::529]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id 71A6B854C5 for ; Thu, 26 Jan 2023 07:54:19 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=ilias.apalodimas@linaro.org Received: by mail-ed1-x529.google.com with SMTP id v10so996141edi.8 for ; Wed, 25 Jan 2023 22:54:19 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=oI7QvB5uwC0V6pmSXiZbUvh9dNExDT6FeYDkV+NZJh0=; b=WCsGSf87yICFQDHUIU4h9swQrerUX5TDqR1DfRmYbTT9iFZ4qO3vzfx0MZZN1v76zw D54yDBuo9VNbaXdYV+07IIcvfk5DMY/HAji092IkfSGNAu4a8PEcJkJCVzWdFD6C6D8U dZeVaofuSpHuPu+j05d/kOzRb89aVx7B8ejKF/1iulq9gxkJ/EZWC1g57tPV6FwHU3ex U35RpgKsMhWTD2flZFr/6K0+gJ3VPkw8Y2x9ZNQVo49jEw3oEvnB/iPWnFoewl0Khf5m sZKve09t0MNTBoU6xkChe/l72OZyIiwi0MF5GI/+hLxuHkbtPQV03hq6owPfo+6ARmyp 9v3A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=oI7QvB5uwC0V6pmSXiZbUvh9dNExDT6FeYDkV+NZJh0=; b=kEazbEsw0Ck/DjHI7kkLJ8ATm0sh7pxDq33lFnbWgeTGbFu68F9GqDCEg5xHbt+MxV jPb7u8VoumMeackre6FnJM35HrcWE0a9ZVGCjXQYzA1pi8Xi9Q8YGEJRSKjkT3YEzfBZ eQgEDqdA0+6q5SMSxxyuVNcgRTrvgWEH/ERYugFkK2ShIPztHi2EWBovHFyuKpu9A3YY dPF7WNzVFoPiXaMaxauvGsrFLqIy3JqVF9ia4LkGvOpHDDAxA3gDKS/jHIKuNdpneRUh MhX/aqNZqTAwL1z/s7AASApqCzByxTSi2buKh6H/exboJ8KRuSQqfL81mOlXVTaCqiQI hpsA== X-Gm-Message-State: AFqh2kp+wC58oll7lDe8Uvoo8xtL1P1lqEdjbR4ljebH2KGpRSkDMEbn zvBPWd/xUa49ITH0NkRjZPEH0g== X-Google-Smtp-Source: AMrXdXs6T9iGVIViC5R51u+R8qbXHQS2wuClvqGxvSrClio4UhLqBc7m1+P24hI7CSiB5D3AsmQ5Wg== X-Received: by 2002:a05:6402:e94:b0:47e:d7ea:d980 with SMTP id h20-20020a0564020e9400b0047ed7ead980mr37524604eda.14.1674716058981; Wed, 25 Jan 2023 22:54:18 -0800 (PST) Received: from hera (ppp079167090036.access.hol.gr. [79.167.90.36]) by smtp.gmail.com with ESMTPSA id t17-20020aa7d711000000b0049dc0123f29sm287461edq.61.2023.01.25.22.54.17 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 25 Jan 2023 22:54:18 -0800 (PST) Date: Thu, 26 Jan 2023 08:54:16 +0200 From: Ilias Apalodimas To: Eddie James Cc: u-boot@lists.denx.de, sjg@chromium.org, xypron.glpk@gmx.de Subject: Re: [PATCH v4 3/6] bootm: Support boot measurement Message-ID: References: <20230125171810.3724530-1-eajames@linux.ibm.com> <20230125171810.3724530-4-eajames@linux.ibm.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20230125171810.3724530-4-eajames@linux.ibm.com> X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.39 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.6 at phobos.denx.de X-Virus-Status: Clean Hi Eddie, On Wed, Jan 25, 2023 at 11:18:07AM -0600, Eddie James wrote: > Add a configuration option to measure the boot through the bootm > function. Add the measurement state to the booti and bootz paths > as well. > > Signed-off-by: Eddie James > --- > boot/Kconfig | 23 ++++++++++++++++ > boot/bootm.c | 70 +++++++++++++++++++++++++++++++++++++++++++++++++ > cmd/booti.c | 1 + > cmd/bootm.c | 2 ++ > cmd/bootz.c | 1 + > include/bootm.h | 2 ++ > include/image.h | 1 + > 7 files changed, 100 insertions(+) > > diff --git a/boot/Kconfig b/boot/Kconfig > index fdcfbae7b2..831b9e954c 100644 > --- a/boot/Kconfig > +++ b/boot/Kconfig > @@ -601,6 +601,29 @@ config LEGACY_IMAGE_FORMAT > loaded. If a board needs the legacy image format support in this > case, enable it here. > > +config MEASURED_BOOT > + bool "Measure boot images and configuration to TPM and event log" > + depends on HASH && TPM_V2 > + help > + This option enables measurement of the boot process. Measurement > + involves creating cryptographic hashes of the binary images that > + are booting and storing them in the TPM. In addition, a log of > + these hashes is stored in memory for the OS to verify the booted > + images and configuration. Enable this if the OS has configured > + some memory area for the event log and you intend to use some > + attestation tools on your system. > + > +if MEASURED_BOOT > + config MEASURE_DEVICETREE > + bool "Measure the devicetree image" > + default y if MEASURED_BOOT > + help > + On some platforms, the devicetree is not static as it may contain > + random MAC addresses or other such data that changes each boot. > + Therefore, it should not be measured into the TPM. In that case, > + disable the measurement here. > +endif # MEASURED_BOOT > + > config SUPPORT_RAW_INITRD > bool "Enable raw initrd images" > help > diff --git a/boot/bootm.c b/boot/bootm.c > index 15fce8ad95..c8423f2c60 100644 > --- a/boot/bootm.c > +++ b/boot/bootm.c > @@ -22,6 +22,7 @@ > #include > #include > #include > +#include > #if defined(CONFIG_CMD_USB) > #include > #endif > @@ -659,6 +660,72 @@ int bootm_process_cmdline_env(int flags) > return 0; > } > > +int bootm_measure(struct bootm_headers *images) > +{ > + int ret = 0; > + > + /* Skip measurement if EFI is going to do it */ > + if (images->os.os == IH_OS_EFI && > + IS_ENABLED(CONFIG_EFI_TCG2_PROTOCOL) && > + IS_ENABLED(CONFIG_BOOTM_EFI)) > + return ret; > + > + if (IS_ENABLED(CONFIG_MEASURED_BOOT)) { > + struct tcg2_event_log elog; > + struct udevice *dev; > + void *initrd_buf; > + void *image_buf; > + const char *s; > + u32 rd_len; > + > + ret = tcg2_measurement_init(&dev, &elog); > + if (ret) > + return ret; > + > + image_buf = map_sysmem(images->os.image_start, > + images->os.image_len); > + ret = tcg2_measure_data(dev, &elog, 8, images->os.image_len, > + image_buf, EV_COMPACT_HASH, > + strlen("linux") + 1, (u8 *)"linux"); > + if (ret) > + goto unmap_image; > + > + rd_len = images->rd_end - images->rd_start; > + initrd_buf = map_sysmem(images->rd_start, rd_len); > + ret = tcg2_measure_data(dev, &elog, 8, rd_len, initrd_buf, > + EV_COMPACT_HASH, strlen("initrd") + 1, > + (u8 *)"initrd"); The kernel, if loaded with EFI, measures the initrd data into PCR9. Although it's not important can we please use the same PCR here? > + if (ret) > + goto unmap_initrd; > + > + if (IS_ENABLED(CONFIG_MEASURE_DEVICETREE)) { > + ret = tcg2_measure_data(dev, &elog, 9, images->ft_len, > + (u8 *)images->ft_addr, > + EV_TABLE_OF_DEVICES, > + strlen("dts") + 1, > + (u8 *)"dts"); The PC client spec describes how ACPI data should be measured. Although it has no wording on the DTB, I think it should be treated in a similar fashion. This [0] was trying to do the same thing for EFI. Any reason we can't use PCR0 here? > + if (ret) > + goto unmap_initrd; > + } > + > + s = env_get("bootargs"); > + if (!s) > + s = ""; > + ret = tcg2_measure_data(dev, &elog, 1, strlen(s) + 1, (u8 *)s, > + EV_PLATFORM_CONFIG_FLAGS, > + strlen(s) + 1, (u8 *)s); > + > +unmap_initrd: > + unmap_sysmem(initrd_buf); [0] https://lore.kernel.org/u-boot/20221207151110.529106-1-etienne.carriere@linaro.org/ Regards /Ilias