Mirrors/u-boot
1
0
Fork 0
mirror of https://source.denx.de/u-boot/u-boot.git synced 2026-06-13 15:03:58 +03:00
Code Issues Packages Projects Releases Wiki Activity

Merge tag 'efi-2024-07-rc5-2' of https://source.denx.de/u-boot/custodians/u-boot-efi

Browse Source 
Pull request efi-2024-07-rc5-2

Documentation:

* Correct links and board names in PHYTEC board descriptions.
* Describe UEFI measured boot.
* Fix typos in include/bootmeth.h.
* Fix link reference to general verified boot docs.

UEFI:

* Measure device-tree into PCR1 instead of PCR0
This commit is contained in:
Tom Rini
2024-06-16 09:10:53 -06:00
parent d571e8c544 d1499a8b3f
commit 7d602334f6
7 changed files with 43 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
boot/bootm.c
View File

@@ -964,7 +964,7 @@ int bootm_measure(struct bootm_headers *images)
goto unmap_initrd;
if (IS_ENABLED(CONFIG_MEASURE_DEVICETREE)) {
ret = tcg2_measure_data(dev, &elog, 0, images->ft_len,
ret = tcg2_measure_data(dev, &elog, 1, images->ft_len,
(u8 *)images->ft_addr,
EV_TABLE_OF_DEVICES,
strlen("dts") + 1,

2
doc/board/phytec/phycore-am62x.rst
View File

@@ -155,4 +155,4 @@ Further Information
-------------------
Please see :doc:`../ti/am62x_sk` chapter for further AM62 SoC related documentation
and https://docs.phytec.com/phycore-am62x for vendor documentation.
and https://docs.phytec.com/projects/yocto-phycore-am62x/en/latest/ for vendor documentation.

4
doc/board/phytec/phycore-am64x.rst
View File

@@ -9,7 +9,7 @@ SoM (System on Module) featuring TI's AM64x SoC. It can be used in combination
with different carrier boards. This module can come with different sizes and
models for DDR, eMMC, SPI NOR Flash and various SoCs from the AM64x family.
A development Kit, called `phyBOARD-Lyra <https://www.phytec.com/product/phyboard-am64x>`_
A development Kit, called `phyBOARD-Electra <https://www.phytec.com/product/phyboard-am64x>`_
is used as a carrier board reference design around the AM64x SoM.
Quickstart
@@ -156,4 +156,4 @@ Further Information
-------------------
Please see :doc:`../ti/am64x_evm` chapter for further AM64 SoC related documentation
and https://docs.phytec.com/phycore-am64x for vendor documentation.
and https://docs.phytec.com/projects/yocto-phycore-am64x/en/latest/ for vendor documentation.

2
doc/usage/fit/signature.rst
View File

@@ -15,7 +15,7 @@ that it can be verified using a public key later. Provided that the private
key is kept secret and the public key is stored in a non-volatile place,
any image can be verified in this way.
See verified-boot.txt for more general information on verified boot.
See :doc:`verified-boot` for more general information on verified boot.
Concepts

35
doc/usage/measured_boot.rst
View File

@@ -7,19 +7,46 @@ U-Boot can perform a measured boot, the process of hashing various components
of the boot process, extending the results in the TPM and logging the
component's measurement in memory for the operating system to consume.
The functionality is available when booting via the EFI subsystem or 'bootm'
command.
UEFI measured boot
------------------
The EFI subsystem implements the `EFI TCG protocol
<https://trustedcomputinggroup.org/resource/tcg-efi-protocol-specification/>`_
and the `TCG PC Client Specific Platform Firmware Profile Specification
<https://trustedcomputinggroup.org/resource/pc-client-specific-platform-firmware-profile-specification/>`_
which defines the binaries to be measured and the corresponding PCRs to be used.
Requirements
~~~~~~~~~~~~
* A hardware TPM 2.0 supported by an enabled U-Boot driver
* CONFIG_EFI_TCG2_PROTOCOL=y
* CONFIG_EFI_TCG2_PROTOCOL_EVENTLOG_SIZE=y
* optional CONFIG_EFI_TCG2_PROTOCOL_MEASURE_DTB=y will measure the loaded DTB
in PCR 1
Legacy measured boot
--------------------
The commands booti, bootm, and bootz can be used for measured boot
using the legacy entry point of the Linux kernel.
By default, U-Boot will measure the operating system (linux) image, the
initrd image, and the "bootargs" environment variable. By enabling
CONFIG_MEASURE_DEVICETREE, U-Boot will also measure the devicetree image.
CONFIG_MEASURE_DEVICETREE, U-Boot will also measure the devicetree image in PCR1.
The operating system typically would verify that the hashes found in the
TPM PCRs match the contents of the event log. This can further be checked
against the hash results of previous boots.
Requirements
------------
~~~~~~~~~~~~
* A hardware TPM 2.0 supported by the U-Boot drivers
* CONFIG_TPM=y
* A hardware TPM 2.0 supported by an enabled U-Boot driver
* CONFIG_TPMv2=y
* CONFIG_MEASURED_BOOT=y
* Device-tree configuration of the TPM device to specify the memory area
for event logging. The TPM device node must either contain a phandle to

12
include/bootmeth.h
View File

@@ -40,7 +40,7 @@ struct bootmeth_ops {
/**
* get_state_desc() - get detailed state information
*
* Prodecues a textual description of the state of the bootmeth. This
* Produces a textual description of the state of the boot method. This
* can include newline characters if it extends to multiple lines. It
* must be a nul-terminated string.
*
@@ -138,7 +138,7 @@ struct bootmeth_ops {
* @dev: Bootmethod device to boot
* @bflow: Bootflow to boot
* Return: does not return on success, since it should boot the
* Operating Systemn. Returns -EFAULT if that fails, -ENOTSUPP if
* operating system. Returns -EFAULT if that fails, -ENOTSUPP if
* trying method resulted in finding out that is not actually
* supported for this boot and should not be tried again unless
* something changes, other -ve on other error
@@ -151,7 +151,7 @@ struct bootmeth_ops {
/**
* bootmeth_get_state_desc() - get detailed state information
*
* Prodecues a textual description of the state of the bootmeth. This
* Produces a textual description of the state of the boot method. This
* can include newline characters if it extends to multiple lines. It
* must be a nul-terminated string.
*
@@ -244,7 +244,7 @@ int bootmeth_read_file(struct udevice *dev, struct bootflow *bflow,
* @dev: Bootmethod device to use
* @bflow: Bootflow to read
* Return: does not return on success, since it should boot the
* Operating Systemn. Returns -EFAULT if that fails, other -ve on
* operating system. Returns -EFAULT if that fails, other -ve on
* other error
*/
int bootmeth_read_all(struct udevice *dev, struct bootflow *bflow);
@@ -255,7 +255,7 @@ int bootmeth_read_all(struct udevice *dev, struct bootflow *bflow);
* @dev: Bootmethod device to boot
* @bflow: Bootflow to boot
* Return: does not return on success, since it should boot the
* Operating Systemn. Returns -EFAULT if that fails, other -ve on
* operating system. Returns -EFAULT if that fails, other -ve on
* other error
*/
int bootmeth_boot(struct udevice *dev, struct bootflow *bflow);
@@ -264,7 +264,7 @@ int bootmeth_boot(struct udevice *dev, struct bootflow *bflow);
* bootmeth_setup_iter_order() - Set up the ordering of bootmeths to scan
*
* This sets up the ordering information in @iter, based on the selected
* ordering of the bootmethds in bootstd_priv->bootmeth_order. If there is no
* ordering of the boot methods in bootstd_priv->bootmeth_order. If there is no
* ordering there, then all bootmethods are added
*
* @iter: Iterator to update with the order

2
lib/efi_loader/efi_tcg2.c
View File

@@ -1331,7 +1331,7 @@ efi_status_t efi_tcg2_measure_dtb(void *dtb)
sha256_update(&hash_ctx, (u8 *)dtb + fdt_off_mem_rsvmap(dtb), rsvmap_size);
sha256_finish(&hash_ctx, blob->data + blob->blob_description_size);
ret = measure_event(dev, 0, EV_POST_CODE, event_size, (u8 *)blob);
ret = measure_event(dev, 1, EV_POST_CODE, event_size, (u8 *)blob);
free(blob);
return ret;