From patchwork Fri Jun 14 09:40:30 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ilias Apalodimas X-Patchwork-Id: 804150 Delivered-To: patch@linaro.org Received: by 2002:a5d:6545:0:b0:35b:5a80:51b4 with SMTP id z5csp221535wrv; Fri, 14 Jun 2024 02:40:41 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCVm9F2rym6W6jWezObyPGL1kBukgW/nZqf9GvoZG9yTdXYVveSMSZZMaPYNeZLQIN58Y4ULBTdi1pn++igA4eAj X-Google-Smtp-Source: AGHT+IGKA8c3TW/aYHLic07gh69LpzsL8SNR9BymWvIZaax74rzgWWN3wBEkevQhSg7gx/ssuiY5 X-Received: by 2002:a17:906:1584:b0:a6f:16b2:cffd with SMTP id a640c23a62f3a-a6f60d42139mr125821566b.33.1718358041596; Fri, 14 Jun 2024 02:40:41 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1718358041; cv=none; d=google.com; s=arc-20160816; b=XJmw/K1xcjpYVaRNw9on4sSTwSCK/4QV+IMLd/O/JVIUbuM539+bbH/DOJEmiIaMdZ WqrwWFKM5LhyE4ATIWpctgb7vqI2zu4vEnsdrAOaRPq0zK9OL4RubxEqd3xvIpdJsNAV DhsPMQphFemzYXqYTXQFlV8n5FeyeL2/SFVnIRljKc6zz3w1uTJ8Hi1JHQxmG3BULg9X z1V1/l3MdFMCKGm44Jfd32/ZZuArvj40CX23Ecxu1K8Nr+pfg6Vus5vNM+ZkgirrNx6U YkjLJ2mdbCGg7p6RDGABpD7T/Dt83s6DePMqothsRsN3/QfNwyJDz0ygrrCjJRsUUcxb h1tQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:message-id:date:subject:cc:to:from:dkim-signature; bh=a3VAu3452EYj3StLYM2MCrNVWbFfM3CFBmatFjAMTx0=; fh=tf7X0hSnrg5qQcefnvDsn8DMBCjEFt+xP6KZYt5PlLA=; b=o5oGlH5eG/Zef9tK/3ItR5tg4lp+tf5/R7G0d23TPam+mpNqVDSaQkKtNQ5FQdEgQi id+PMbca65qhTgQEeTGgP1dsEKgIQw7xZucDVSnWAFfa2X6kk3v2mzipd+VNP5M0u2wi uzEvAIecATwz5BAfjM6ONtczXh9r08O7jrTcUlqgQmvJpHJ3TUvs+zDYSJVKQNGejsdJ o1JnA7POc+Jf/8NYDfk2vhPMo7r8ye8zai5Tydx+UV5kQ0fMJqn8529Gr+cb616KhovW cLtEBY5/AWL2DczabsNnViRn+ybCy/tMeqj9UsDNvJB4Z/c39M7qzJQYghrvgJ72eyUe DlZw==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=onnXuu0C; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 2a01:238:438b:c500:173d:9f52:ddab:ee01 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from phobos.denx.de (phobos.denx.de. [2a01:238:438b:c500:173d:9f52:ddab:ee01]) by mx.google.com with ESMTPS id a640c23a62f3a-a6f56dd65b5si156778266b.409.2024.06.14.02.40.41 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 14 Jun 2024 02:40:41 -0700 (PDT) Received-SPF: pass (google.com: domain of u-boot-bounces@lists.denx.de designates 2a01:238:438b:c500:173d:9f52:ddab:ee01 as permitted sender) client-ip=2a01:238:438b:c500:173d:9f52:ddab:ee01; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=onnXuu0C; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 2a01:238:438b:c500:173d:9f52:ddab:ee01 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id 5951988993; Fri, 14 Jun 2024 11:40:40 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=linaro.org header.i=@linaro.org header.b="onnXuu0C"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id 00ED7889A2; Fri, 14 Jun 2024 11:40:39 +0200 (CEST) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de X-Spam-Level: X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_PASS, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.2 Received: from mail-wr1-x42a.google.com (mail-wr1-x42a.google.com [IPv6:2a00:1450:4864:20::42a]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id 99E9288991 for ; Fri, 14 Jun 2024 11:40:36 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=ilias.apalodimas@linaro.org Received: by mail-wr1-x42a.google.com with SMTP id ffacd0b85a97d-35f23f3da44so1816202f8f.0 for ; Fri, 14 Jun 2024 02:40:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1718358036; x=1718962836; darn=lists.denx.de; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=a3VAu3452EYj3StLYM2MCrNVWbFfM3CFBmatFjAMTx0=; b=onnXuu0CRlLSeHDCBUNx7cFmIfIh9d80IPBs9xKG2iTiJ7xv2eOr6x2344/KaNMtni DBT4nUGMSTNcmurAaG3IqTVDltqaj4cTjyguB0KJ+jXGq2wMZoXsETJLBjb9802gRS5N gY2ct/4a7PQEwro1VHHKhvcmGZK435M8XRmf8MtU3utsdoH4niL938YbfcYcNfi3QrFv QeWn0J0+ivMkuI045Kv5sEvRp4mH8gO6K8RuPkvDKtYqHC5eyLnSxaxhNMh9okZDOMzj wXHlxq0El7EJKACwno+c+HYwRYc4qwBfhjhXbjKjK8FXC77b7UMi47UjAZFUfZSvKZh8 /m2A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1718358036; x=1718962836; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=a3VAu3452EYj3StLYM2MCrNVWbFfM3CFBmatFjAMTx0=; b=HnGocowQePHMwQXiZflLm7T3uzTZBzBSEIHGl69qWomfoRFLsjJFizxfj+hGt6s8tu KJH/fXanJG/8pLBEpQ8cuaypiiPuhvrM3Er+4/ucIlirqVviRkM92Db8qQihS6keyQz+ KrrMs5mEZ81TcPN22eHM1O2C0O07SBGv547CIru29j3zGMWLX6j7blU7S9+TA+lyxGPb qdpofm9mkus/O4o4ZrUfJNujxiK+eB8h68Tp8SMcZSnis9QxQJAG9lS3Rq4yLMh8FkDf cRB7BxEW3y9OOAahEUXnBXCwUDriX30PF/OCvet1+aE0EZZt59RxgDEbMhvsQ4ddP8IE cHLg== X-Forwarded-Encrypted: i=1; AJvYcCWoCXYlu8sX8yFYTw12+Se760mkQWgFHuGdBjKqaZiFA//rTEXJTYVeceQgxaC9Y0jyI3fINjs7vB1Jz9aqlNGnFvKPRg== X-Gm-Message-State: AOJu0YwCajRkTbfNfImYyo6z7Spq0VJzs9lbTueqfQOI5yaNjRAROKIJ IpV5YevchJylXAljyZA9Njz8NJ/uL552Xs7OcJRQkylR58iMzs/RX1aPq2vhI0U= X-Received: by 2002:a05:6000:d09:b0:360:7a0b:9bd3 with SMTP id ffacd0b85a97d-3607a771d52mr1345713f8f.0.1718358035844; Fri, 14 Jun 2024 02:40:35 -0700 (PDT) Received: from localhost.localdomain (ppp046103020130.access.hol.gr. [46.103.20.130]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-360750ad177sm3871451f8f.56.2024.06.14.02.40.34 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 14 Jun 2024 02:40:35 -0700 (PDT) From: Ilias Apalodimas To: heinrich.schuchardt@canonical.com Cc: Ilias Apalodimas , Tom Rini , Eddie James , Simon Glass , Heinrich Schuchardt , u-boot@lists.denx.de Subject: [PATCH] doc: describe UEFI measured boot Date: Fri, 14 Jun 2024 12:40:30 +0300 Message-ID: <20240614094031.6013-1-ilias.apalodimas@linaro.org> X-Mailer: git-send-email 2.45.1 MIME-Version: 1.0 X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.39 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.8 at phobos.denx.de X-Virus-Status: Clean We currently only describe the process to enable measured boot using bootm. Describe the UEFI requirements as well which predate bootm. Signed-off-by: Ilias Apalodimas --- doc/usage/measured_boot.rst | 24 ++++++++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-) diff --git a/doc/usage/measured_boot.rst b/doc/usage/measured_boot.rst index 9691904a9d8a..1b5dd1dcc438 100644 --- a/doc/usage/measured_boot.rst +++ b/doc/usage/measured_boot.rst @@ -7,6 +7,26 @@ U-Boot can perform a measured boot, the process of hashing various components of the boot process, extending the results in the TPM and logging the component's measurement in memory for the operating system to consume. +The functionality is available when booting via the EFI subsystem or 'bootm' +command. + +UEFI subsystem +-------------- +The EFI subsystem implements the `EFI TCG protocol +`_ +and the `TCG PC Client Specific Platform Firmware Profile Specification +`_ +which defines the binaries to be measured and the corresponding PCRs used. + +UEFI requirements +~~~~~~~~~~~~~~~~~ +* A hardware TPM 2.0 supported by the U-Boot drivers +* CONFIG_EFI_TCG2_PROTOCOL=y +* CONFIG_EFI_TCG2_PROTOCOL_EVENTLOG_SIZE=y +* optional CONFIG_EFI_TCG2_PROTOCOL_MEASURE_DTB=y will measure the loaded DTB in PCR 0 + +bootm +----- By default, U-Boot will measure the operating system (linux) image, the initrd image, and the "bootargs" environment variable. By enabling CONFIG_MEASURE_DEVICETREE, U-Boot will also measure the devicetree image. @@ -15,8 +35,8 @@ The operating system typically would verify that the hashes found in the TPM PCRs match the contents of the event log. This can further be checked against the hash results of previous boots. -Requirements ------------- +bootm requirements +~~~~~~~~~~~~~~~~~~ * A hardware TPM 2.0 supported by the U-Boot drivers * CONFIG_TPM=y