| .. SPDX-License-Identifier: GPL-2.0+ | |
| Measured Boot | |
| ============= | |
| U-Boot can perform a measured boot, the process of hashing various components | |
| of the boot process, extending the results in the TPM and logging the | |
| component's measurement in memory for the operating system to consume. | |
| By default, U-Boot will measure the operating system (linux) image, the | |
| initrd image, and the "bootargs" environment variable. By enabling | |
| CONFIG_MEASURE_DEVICETREE, U-Boot will also measure the devicetree image. | |
| The operating system typically would verify that the hashes found in the | |
| TPM PCRs match the contents of the event log. This can further be checked | |
| against the hash results of previous boots. | |
| Requirements | |
| ------------ | |
| * A hardware TPM 2.0 supported by the U-Boot drivers | |
| * CONFIG_TPM=y | |
| * CONFIG_MEASURED_BOOT=y | |
| * Device-tree configuration of the TPM device to specify the memory area | |
| for event logging. The TPM device node must either contain a phandle to | |
| a reserved memory region or "linux,sml-base" and "linux,sml-size" | |
| indicating the address and size of the memory region. An example can be | |
| found in arch/sandbox/dts/test.dts | |
| * The operating system must also be configured to use the memory regions | |
| specified in the U-Boot device-tree in order to make use of the event | |
| log. |