Re: [PATCH v9 4/6] bootm: Support boot measurement
On 8/7/23 09:52, Ilias Apalodimas wrote:
Hi,
On Mon, 7 Aug 2023 at 17:43, Eddie James wrote:
On 8/4/23 13:10, Sean Edmond wrote:
On 2023-03-08 1:25 p.m., Eddie James wrote:
Add a configuration option to measure the boot through the bootm
function. Add the measurement state to the booti and bootz paths
as well.
Signed-off-by: Eddie James
Reviewed-by: Simon Glass
---
Changes since v8:
- Added a configuration option to select to ignore any existing
event log. This would only be selected for systems that know
that U-Boot is the first stage bootloader. This is necessary
because the reserved memory region may persist through resets
and so U-Boot attempts to append to the previous boot's log.
Changes since v6:
- Added comment for bootm_measure
- Fixed line length in bootm_measure
boot/Kconfig| 32 +
boot/bootm.c| 74 +
cmd/booti.c | 1 +
cmd/bootm.c | 2 ++
cmd/bootz.c | 1 +
include/bootm.h | 11
include/image.h | 1 +
7 files changed, 122 insertions(+)
diff --git a/boot/Kconfig b/boot/Kconfig
index 5f491625c8..8119519c9f 100644
--- a/boot/Kconfig
+++ b/boot/Kconfig
@@ -629,6 +629,38 @@ config LEGACY_IMAGE_FORMAT
loaded. If a board needs the legacy image format support in this
case, enable it here.
+config MEASURED_BOOT
+bool "Measure boot images and configuration to TPM and event log"
+depends on HASH && TPM_V2
+help
+ This option enables measurement of the boot process. Measurement
+ involves creating cryptographic hashes of the binary images that
+ are booting and storing them in the TPM. In addition, a log of
+ these hashes is stored in memory for the OS to verify the booted
+ images and configuration. Enable this if the OS has configured
+ some memory area for the event log and you intend to use some
+ attestation tools on your system.
+
+if MEASURED_BOOT
+config MEASURE_DEVICETREE
+bool "Measure the devicetree image"
+default y if MEASURED_BOOT
+help
+ On some platforms, the devicetree is not static as it may contain
+ random MAC addresses or other such data that changes each boot.
+ Therefore, it should not be measured into the TPM. In that case,
+ disable the measurement here.
+
+config MEASURE_IGNORE_LOG
+bool "Ignore the existing event log"
+default n
+help
+ On platforms that use an event log memory region that persists
+ through system resets and are the first stage bootloader, then
+ this option should be enabled to ignore any existing data in the
+ event log memory region.
+endif # MEASURED_BOOT
+
config SUPPORT_RAW_INITRD
bool "Enable raw initrd images"
help
diff --git a/boot/bootm.c b/boot/bootm.c
index 2eec60ec7b..2685bdbd74 100644
--- a/boot/bootm.c
+++ b/boot/bootm.c
@@ -22,6 +22,7 @@
#include
#include
#include
+#include
#if defined(CONFIG_CMD_USB)
#include
#endif
@@ -659,6 +660,75 @@ int bootm_process_cmdline_env(int flags)
return 0;
}
+int bootm_measure(struct bootm_headers *images)
+{
+int ret = 0;
+
+/* Skip measurement if EFI is going to do it */
+if (images->os.os == IH_OS_EFI &&
+IS_ENABLED(CONFIG_EFI_TCG2_PROTOCOL) &&
+IS_ENABLED(CONFIG_BOOTM_EFI))
+return ret;
+
it looks like your measured boot implementation is hardcoding the
following PCR indexes:
PCR #8 - kernel image measurement
PCR #9 - initrd measurement
PCR #0 - kernel DTB measurement
PCR #1 - bootargs measurement
Hi,
Yes, I followed this document as closely as I could:
https://trustedcomputinggroup.org/wp-content/uploads/TCG_ServerManagementDomainFirmwareProfile_v1p00_11aug2020.pdf
Which provides what should go in what PCR. I can understand users
wanting a different setup, but as you say, that's probably out of the
scope of this series.
Completely out of scope* of the series. The purpose is follow the TCG
spec. The minor deviations is our choice of the DTB in PCR1 (but
that's what the spec does for ACPI tables) and the choice for initrd
(which is what we do in the linux kernel).
We can reuse the functions ofc to measure random blobs, but that would
require some kind of config (maybe in a dts??) of what to measure.
Eddie, I've pinged you in the past. I rebased and fixed a few issues
of your tree here [0]. Do you plan to resend it at some point?
[0]https://source.denx.de/u-boot/custodians/u-boot-tpm/-/commits/eddie2/
Yes, sorry for the delay. I'll resend it now. Thank you for rebasing!
Thanks,
Eddie
Cheers
/Ilias
Thanks,
Eddie
I wasn't able to find any specificaton on this measured boot
"profile". Are you able to provide a reference?
We've implemented our own version of measured boot, which maps
measurements to different PCR indexes. In many cases, the data we're
measuring is also different.
To make this
Re: [PATCH v9 4/6] bootm: Support boot measurement
Hi,
On Mon, 7 Aug 2023 at 17:43, Eddie James wrote:
>
>
> On 8/4/23 13:10, Sean Edmond wrote:
> > On 2023-03-08 1:25 p.m., Eddie James wrote:
> >> Add a configuration option to measure the boot through the bootm
> >> function. Add the measurement state to the booti and bootz paths
> >> as well.
> >>
> >> Signed-off-by: Eddie James
> >> Reviewed-by: Simon Glass
> >> ---
> >> Changes since v8:
> >> - Added a configuration option to select to ignore any existing
> >> event log. This would only be selected for systems that know
> >> that U-Boot is the first stage bootloader. This is necessary
> >> because the reserved memory region may persist through resets
> >> and so U-Boot attempts to append to the previous boot's log.
> >>
> >> Changes since v6:
> >> - Added comment for bootm_measure
> >> - Fixed line length in bootm_measure
> >>
> >> boot/Kconfig| 32 +
> >> boot/bootm.c| 74 +
> >> cmd/booti.c | 1 +
> >> cmd/bootm.c | 2 ++
> >> cmd/bootz.c | 1 +
> >> include/bootm.h | 11
> >> include/image.h | 1 +
> >> 7 files changed, 122 insertions(+)
> >>
> >> diff --git a/boot/Kconfig b/boot/Kconfig
> >> index 5f491625c8..8119519c9f 100644
> >> --- a/boot/Kconfig
> >> +++ b/boot/Kconfig
> >> @@ -629,6 +629,38 @@ config LEGACY_IMAGE_FORMAT
> >> loaded. If a board needs the legacy image format support in this
> >> case, enable it here.
> >> +config MEASURED_BOOT
> >> +bool "Measure boot images and configuration to TPM and event log"
> >> +depends on HASH && TPM_V2
> >> +help
> >> + This option enables measurement of the boot process. Measurement
> >> + involves creating cryptographic hashes of the binary images that
> >> + are booting and storing them in the TPM. In addition, a log of
> >> + these hashes is stored in memory for the OS to verify the booted
> >> + images and configuration. Enable this if the OS has configured
> >> + some memory area for the event log and you intend to use some
> >> + attestation tools on your system.
> >> +
> >> +if MEASURED_BOOT
> >> +config MEASURE_DEVICETREE
> >> +bool "Measure the devicetree image"
> >> +default y if MEASURED_BOOT
> >> +help
> >> + On some platforms, the devicetree is not static as it may contain
> >> + random MAC addresses or other such data that changes each boot.
> >> + Therefore, it should not be measured into the TPM. In that case,
> >> + disable the measurement here.
> >> +
> >> +config MEASURE_IGNORE_LOG
> >> +bool "Ignore the existing event log"
> >> +default n
> >> +help
> >> + On platforms that use an event log memory region that persists
> >> + through system resets and are the first stage bootloader, then
> >> + this option should be enabled to ignore any existing data in the
> >> + event log memory region.
> >> +endif # MEASURED_BOOT
> >> +
> >> config SUPPORT_RAW_INITRD
> >> bool "Enable raw initrd images"
> >> help
> >> diff --git a/boot/bootm.c b/boot/bootm.c
> >> index 2eec60ec7b..2685bdbd74 100644
> >> --- a/boot/bootm.c
> >> +++ b/boot/bootm.c
> >> @@ -22,6 +22,7 @@
> >> #include
> >> #include
> >> #include
> >> +#include
> >> #if defined(CONFIG_CMD_USB)
> >> #include
> >> #endif
> >> @@ -659,6 +660,75 @@ int bootm_process_cmdline_env(int flags)
> >> return 0;
> >> }
> >> +int bootm_measure(struct bootm_headers *images)
> >> +{
> >> +int ret = 0;
> >> +
> >> +/* Skip measurement if EFI is going to do it */
> >> +if (images->os.os == IH_OS_EFI &&
> >> +IS_ENABLED(CONFIG_EFI_TCG2_PROTOCOL) &&
> >> +IS_ENABLED(CONFIG_BOOTM_EFI))
> >> +return ret;
> >> +
> >
> > it looks like your measured boot implementation is hardcoding the
> > following PCR indexes:
> >
> > PCR #8 - kernel image measurement
> > PCR #9 - initrd measurement
> > PCR #0 - kernel DTB measurement
> > PCR #1 - bootargs measurement
>
>
> Hi,
>
>
> Yes, I followed this document as closely as I could:
> https://trustedcomputinggroup.org/wp-content/uploads/TCG_ServerManagementDomainFirmwareProfile_v1p00_11aug2020.pdf
>
> Which provides what should go in what PCR. I can understand users
> wanting a different setup, but as you say, that's probably out of the
> scope of this series.
>
Completely out of scope* of the series. The purpose is follow the TCG
spec. The minor deviations is our choice of the DTB in PCR1 (but
that's what the spec does for ACPI tables) and the choice for initrd
(which is what we do in the linux kernel).
We can reuse the functions ofc to measure random blobs, but that would
require some kind of config (maybe in a dts??) of what to measure.
Eddie, I've pinged you in the past. I rebased and fixed a few issues
of your tree here [0]. Do you plan to resend it at some point?
Re: [PATCH v9 4/6] bootm: Support boot measurement
On 8/4/23 13:10, Sean Edmond wrote:
On 2023-03-08 1:25 p.m., Eddie James wrote:
Add a configuration option to measure the boot through the bootm
function. Add the measurement state to the booti and bootz paths
as well.
Signed-off-by: Eddie James
Reviewed-by: Simon Glass
---
Changes since v8:
- Added a configuration option to select to ignore any existing
event log. This would only be selected for systems that know
that U-Boot is the first stage bootloader. This is necessary
because the reserved memory region may persist through resets
and so U-Boot attempts to append to the previous boot's log.
Changes since v6:
- Added comment for bootm_measure
- Fixed line length in bootm_measure
boot/Kconfig | 32 +
boot/bootm.c | 74 +
cmd/booti.c | 1 +
cmd/bootm.c | 2 ++
cmd/bootz.c | 1 +
include/bootm.h | 11
include/image.h | 1 +
7 files changed, 122 insertions(+)
diff --git a/boot/Kconfig b/boot/Kconfig
index 5f491625c8..8119519c9f 100644
--- a/boot/Kconfig
+++ b/boot/Kconfig
@@ -629,6 +629,38 @@ config LEGACY_IMAGE_FORMAT
loaded. If a board needs the legacy image format support in this
case, enable it here.
+config MEASURED_BOOT
+ bool "Measure boot images and configuration to TPM and event log"
+ depends on HASH && TPM_V2
+ help
+ This option enables measurement of the boot process. Measurement
+ involves creating cryptographic hashes of the binary images that
+ are booting and storing them in the TPM. In addition, a log of
+ these hashes is stored in memory for the OS to verify the booted
+ images and configuration. Enable this if the OS has configured
+ some memory area for the event log and you intend to use some
+ attestation tools on your system.
+
+if MEASURED_BOOT
+ config MEASURE_DEVICETREE
+ bool "Measure the devicetree image"
+ default y if MEASURED_BOOT
+ help
+ On some platforms, the devicetree is not static as it may contain
+ random MAC addresses or other such data that changes each boot.
+ Therefore, it should not be measured into the TPM. In that case,
+ disable the measurement here.
+
+ config MEASURE_IGNORE_LOG
+ bool "Ignore the existing event log"
+ default n
+ help
+ On platforms that use an event log memory region that persists
+ through system resets and are the first stage bootloader, then
+ this option should be enabled to ignore any existing data in the
+ event log memory region.
+endif # MEASURED_BOOT
+
config SUPPORT_RAW_INITRD
bool "Enable raw initrd images"
help
diff --git a/boot/bootm.c b/boot/bootm.c
index 2eec60ec7b..2685bdbd74 100644
--- a/boot/bootm.c
+++ b/boot/bootm.c
@@ -22,6 +22,7 @@
#include
#include
#include
+#include
#if defined(CONFIG_CMD_USB)
#include
#endif
@@ -659,6 +660,75 @@ int bootm_process_cmdline_env(int flags)
return 0;
}
+int bootm_measure(struct bootm_headers *images)
+{
+ int ret = 0;
+
+ /* Skip measurement if EFI is going to do it */
+ if (images->os.os == IH_OS_EFI &&
+ IS_ENABLED(CONFIG_EFI_TCG2_PROTOCOL) &&
+ IS_ENABLED(CONFIG_BOOTM_EFI))
+ return ret;
+
it looks like your measured boot implementation is hardcoding the
following PCR indexes:
PCR #8 - kernel image measurement
PCR #9 - initrd measurement
PCR #0 - kernel DTB measurement
PCR #1 - bootargs measurement
Hi,
Yes, I followed this document as closely as I could:
https://trustedcomputinggroup.org/wp-content/uploads/TCG_ServerManagementDomainFirmwareProfile_v1p00_11aug2020.pdf
Which provides what should go in what PCR. I can understand users
wanting a different setup, but as you say, that's probably out of the
scope of this series.
Thanks,
Eddie
I wasn't able to find any specificaton on this measured boot
"profile". Are you able to provide a reference?
We've implemented our own version of measured boot, which maps
measurements to different PCR indexes. In many cases, the data we're
measuring is also different.
To make this feature more usable by others it would be nice to see a
more generic interface that would allow the user to specify the PCR
indexes, and the data to hash into these indexes. This would allow
everyone to create their own custom measured boot "profile". This
request is probably beyond the scope of your current efforts, but I
except this implementation to evolve significantly if/when it's accepted.
+ if (IS_ENABLED(CONFIG_MEASURED_BOOT)) {
+ struct tcg2_event_log elog;
+ struct udevice *dev;
+ void *initrd_buf;
+ void *image_buf;
+ const char *s;
+ u32 rd_len;
+ bool ign;
+
+ elog.log_size = 0;
+ ign = IS_ENABLED(CONFIG_MEASURE_IGNORE_LOG);
+ ret = tcg2_measurement_init(, , ign);
+ if (ret)
+ return ret;
+
+
Re: [PATCH v9 4/6] bootm: Support boot measurement
On 2023-03-08 1:25 p.m., Eddie James wrote:
Add a configuration option to measure the boot through the bootm
function. Add the measurement state to the booti and bootz paths
as well.
Signed-off-by: Eddie James
Reviewed-by: Simon Glass
---
Changes since v8:
- Added a configuration option to select to ignore any existing
event log. This would only be selected for systems that know
that U-Boot is the first stage bootloader. This is necessary
because the reserved memory region may persist through resets
and so U-Boot attempts to append to the previous boot's log.
Changes since v6:
- Added comment for bootm_measure
- Fixed line length in bootm_measure
boot/Kconfig| 32 +
boot/bootm.c| 74 +
cmd/booti.c | 1 +
cmd/bootm.c | 2 ++
cmd/bootz.c | 1 +
include/bootm.h | 11
include/image.h | 1 +
7 files changed, 122 insertions(+)
diff --git a/boot/Kconfig b/boot/Kconfig
index 5f491625c8..8119519c9f 100644
--- a/boot/Kconfig
+++ b/boot/Kconfig
@@ -629,6 +629,38 @@ config LEGACY_IMAGE_FORMAT
loaded. If a board needs the legacy image format support in this
case, enable it here.
+config MEASURED_BOOT
+ bool "Measure boot images and configuration to TPM and event log"
+ depends on HASH && TPM_V2
+ help
+ This option enables measurement of the boot process. Measurement
+ involves creating cryptographic hashes of the binary images that
+ are booting and storing them in the TPM. In addition, a log of
+ these hashes is stored in memory for the OS to verify the booted
+ images and configuration. Enable this if the OS has configured
+ some memory area for the event log and you intend to use some
+ attestation tools on your system.
+
+if MEASURED_BOOT
+ config MEASURE_DEVICETREE
+ bool "Measure the devicetree image"
+ default y if MEASURED_BOOT
+ help
+ On some platforms, the devicetree is not static as it may contain
+ random MAC addresses or other such data that changes each boot.
+ Therefore, it should not be measured into the TPM. In that case,
+ disable the measurement here.
+
+ config MEASURE_IGNORE_LOG
+ bool "Ignore the existing event log"
+ default n
+ help
+ On platforms that use an event log memory region that persists
+ through system resets and are the first stage bootloader, then
+ this option should be enabled to ignore any existing data in the
+ event log memory region.
+endif # MEASURED_BOOT
+
config SUPPORT_RAW_INITRD
bool "Enable raw initrd images"
help
diff --git a/boot/bootm.c b/boot/bootm.c
index 2eec60ec7b..2685bdbd74 100644
--- a/boot/bootm.c
+++ b/boot/bootm.c
@@ -22,6 +22,7 @@
#include
#include
#include
+#include
#if defined(CONFIG_CMD_USB)
#include
#endif
@@ -659,6 +660,75 @@ int bootm_process_cmdline_env(int flags)
return 0;
}
+int bootm_measure(struct bootm_headers *images)
+{
+ int ret = 0;
+
+ /* Skip measurement if EFI is going to do it */
+ if (images->os.os == IH_OS_EFI &&
+ IS_ENABLED(CONFIG_EFI_TCG2_PROTOCOL) &&
+ IS_ENABLED(CONFIG_BOOTM_EFI))
+ return ret;
+
it looks like your measured boot implementation is hardcoding the
following PCR indexes:
PCR #8 - kernel image measurement
PCR #9 - initrd measurement
PCR #0 - kernel DTB measurement
PCR #1 - bootargs measurement
I wasn't able to find any specificaton on this measured boot "profile".
Are you able to provide a reference?
We've implemented our own version of measured boot, which maps
measurements to different PCR indexes. In many cases, the data we're
measuring is also different.
To make this feature more usable by others it would be nice to see a
more generic interface that would allow the user to specify the PCR
indexes, and the data to hash into these indexes. This would allow
everyone to create their own custom measured boot "profile". This
request is probably beyond the scope of your current efforts, but I
except this implementation to evolve significantly if/when it's accepted.
+ if (IS_ENABLED(CONFIG_MEASURED_BOOT)) {
+ struct tcg2_event_log elog;
+ struct udevice *dev;
+ void *initrd_buf;
+ void *image_buf;
+ const char *s;
+ u32 rd_len;
+ bool ign;
+
+ elog.log_size = 0;
+ ign = IS_ENABLED(CONFIG_MEASURE_IGNORE_LOG);
+ ret = tcg2_measurement_init(, , ign);
+ if (ret)
+ return ret;
+
+ image_buf = map_sysmem(images->os.image_start,
+ images->os.image_len);
+ ret = tcg2_measure_data(dev, , 8, images->os.image_len,
+
[PATCH v9 4/6] bootm: Support boot measurement
Add a configuration option to measure the boot through the bootm
function. Add the measurement state to the booti and bootz paths
as well.
Signed-off-by: Eddie James
Reviewed-by: Simon Glass
---
Changes since v8:
- Added a configuration option to select to ignore any existing
event log. This would only be selected for systems that know
that U-Boot is the first stage bootloader. This is necessary
because the reserved memory region may persist through resets
and so U-Boot attempts to append to the previous boot's log.
Changes since v6:
- Added comment for bootm_measure
- Fixed line length in bootm_measure
boot/Kconfig| 32 +
boot/bootm.c| 74 +
cmd/booti.c | 1 +
cmd/bootm.c | 2 ++
cmd/bootz.c | 1 +
include/bootm.h | 11
include/image.h | 1 +
7 files changed, 122 insertions(+)
diff --git a/boot/Kconfig b/boot/Kconfig
index 5f491625c8..8119519c9f 100644
--- a/boot/Kconfig
+++ b/boot/Kconfig
@@ -629,6 +629,38 @@ config LEGACY_IMAGE_FORMAT
loaded. If a board needs the legacy image format support in this
case, enable it here.
+config MEASURED_BOOT
+ bool "Measure boot images and configuration to TPM and event log"
+ depends on HASH && TPM_V2
+ help
+ This option enables measurement of the boot process. Measurement
+ involves creating cryptographic hashes of the binary images that
+ are booting and storing them in the TPM. In addition, a log of
+ these hashes is stored in memory for the OS to verify the booted
+ images and configuration. Enable this if the OS has configured
+ some memory area for the event log and you intend to use some
+ attestation tools on your system.
+
+if MEASURED_BOOT
+ config MEASURE_DEVICETREE
+ bool "Measure the devicetree image"
+ default y if MEASURED_BOOT
+ help
+ On some platforms, the devicetree is not static as it may contain
+ random MAC addresses or other such data that changes each boot.
+ Therefore, it should not be measured into the TPM. In that case,
+ disable the measurement here.
+
+ config MEASURE_IGNORE_LOG
+ bool "Ignore the existing event log"
+ default n
+ help
+ On platforms that use an event log memory region that persists
+ through system resets and are the first stage bootloader, then
+ this option should be enabled to ignore any existing data in the
+ event log memory region.
+endif # MEASURED_BOOT
+
config SUPPORT_RAW_INITRD
bool "Enable raw initrd images"
help
diff --git a/boot/bootm.c b/boot/bootm.c
index 2eec60ec7b..2685bdbd74 100644
--- a/boot/bootm.c
+++ b/boot/bootm.c
@@ -22,6 +22,7 @@
#include
#include
#include
+#include
#if defined(CONFIG_CMD_USB)
#include
#endif
@@ -659,6 +660,75 @@ int bootm_process_cmdline_env(int flags)
return 0;
}
+int bootm_measure(struct bootm_headers *images)
+{
+ int ret = 0;
+
+ /* Skip measurement if EFI is going to do it */
+ if (images->os.os == IH_OS_EFI &&
+ IS_ENABLED(CONFIG_EFI_TCG2_PROTOCOL) &&
+ IS_ENABLED(CONFIG_BOOTM_EFI))
+ return ret;
+
+ if (IS_ENABLED(CONFIG_MEASURED_BOOT)) {
+ struct tcg2_event_log elog;
+ struct udevice *dev;
+ void *initrd_buf;
+ void *image_buf;
+ const char *s;
+ u32 rd_len;
+ bool ign;
+
+ elog.log_size = 0;
+ ign = IS_ENABLED(CONFIG_MEASURE_IGNORE_LOG);
+ ret = tcg2_measurement_init(, , ign);
+ if (ret)
+ return ret;
+
+ image_buf = map_sysmem(images->os.image_start,
+ images->os.image_len);
+ ret = tcg2_measure_data(dev, , 8, images->os.image_len,
+ image_buf, EV_COMPACT_HASH,
+ strlen("linux") + 1, (u8 *)"linux");
+ if (ret)
+ goto unmap_image;
+
+ rd_len = images->rd_end - images->rd_start;
+ initrd_buf = map_sysmem(images->rd_start, rd_len);
+ ret = tcg2_measure_data(dev, , 9, rd_len, initrd_buf,
+ EV_COMPACT_HASH, strlen("initrd") + 1,
+ (u8 *)"initrd");
+ if (ret)
+ goto unmap_initrd;
+
+ if (IS_ENABLED(CONFIG_MEASURE_DEVICETREE)) {
+ ret = tcg2_measure_data(dev, , 0, images->ft_len,
+ (u8 *)images->ft_addr,
+ EV_TABLE_OF_DEVICES,
+ strlen("dts") + 1,
+
