mirror of
https://github.com/AsahiLinux/u-boot
synced 2024-12-01 17:10:11 +00:00
450afc350c
Briefly describe the feature and specify the requirements. Signed-off-by: Eddie James <eajames@linux.ibm.com> Reviewed-by: Simon Glass <sjg@chromium.org> Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org> Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
31 lines
1.3 KiB
ReStructuredText
31 lines
1.3 KiB
ReStructuredText
.. SPDX-License-Identifier: GPL-2.0+
|
|
|
|
Measured Boot
|
|
=====================
|
|
|
|
U-Boot can perform a measured boot, the process of hashing various components
|
|
of the boot process, extending the results in the TPM and logging the
|
|
component's measurement in memory for the operating system to consume.
|
|
|
|
By default, U-Boot will measure the operating system (linux) image, the
|
|
initrd image, and the "bootargs" environment variable. By enabling
|
|
CONFIG_MEASURE_DEVICETREE, U-Boot will also measure the devicetree image.
|
|
|
|
The operating system typically would verify that the hashes found in the
|
|
TPM PCRs match the contents of the event log. This can further be checked
|
|
against the hash results of previous boots.
|
|
|
|
Requirements
|
|
---------------------
|
|
|
|
* A hardware TPM 2.0 supported by the U-Boot drivers
|
|
* CONFIG_TPM=y
|
|
* CONFIG_MEASURED_BOOT=y
|
|
* Device-tree configuration of the TPM device to specify the memory area
|
|
for event logging. The TPM device node must either contain a phandle to
|
|
a reserved memory region or "linux,sml-base" and "linux,sml-size"
|
|
indicating the address and size of the memory region. An example can be
|
|
found in arch/sandbox/dts/test.dts
|
|
* The operating system must also be configured to use the memory regions
|
|
specified in the U-Boot device-tree in order to make use of the event
|
|
log.
|