(Ab)using Linux as a Trusted Bootloader by Eric Richter, IBM

### Overview Eric Richter from IBM presents an approach to implementing trusted boot by utilizing the Linux kernel itself as a bootloader, specifically in the context of Petitboot on OpenPOWER systems. Rather than reinventing storage, network, and display drivers inside traditional firmware environments like UEFI or GRUB, Petitboot runs as a user space application on top of a Linux kernel and uses kexec to transition into the target operating system. The presentation outlines the architectural decisions and technical obstacles encountered when adding Trusted Platform Module (TPM) measurements and event logging across this kexec boundary.

### Key Topics - **Reusing Linux as a Bootloader:** Leveraging the existing Linux kernel driver stack (filesystems, network, disk, USB) and user space instead of duplicating complex driver logic inside firmware. - **Kexec Transition:** Using `kexec_file_load` and the reboot system call to jump from the bootloader kernel into the target OS kernel via an intermediary step known as Purgatory. - **Measurement Architecture & IMA Integration:** Rejecting user-space TPM measurements due to security and interface limitations, and instead leveraging Linux's Integrity Measurement Architecture (IMA) to measure components into TPM Platform Configuration Registers (PCRs). - **Log Preservation Across Kexec:** Retaining the IMA measurement log across kernel transitions so that the target OS can verify the complete chain of trust. - **Device Tree and Configuration Integrity:** Handling device tree pass-through and evaluating the security implications of unmeasured configurations.

### Technical Details Initially, the team considered performing TPM measurements directly in Petitboot user space or inside `kexec-tools`. However, user space approaches faced several hurdles: interacting with `/dev/tpm*` would require complex stack logic, the existing firmware event log was read-only at the kernel stage, and having an interactive shell in Petitboot meant the user-space measurement step could be bypassed or spoofed.

To solve this cleanly and upstream the changes, the team turned to the kernel's Integrity Measurement Architecture (IMA): - **Kexec Measurement Hooks:** By utilizing `kexec_file_load` (with work contributed by Mimi Zohar), common file loader hooks allow IMA to measure the target kernel and `initramfs` before execution based on policy. - **Configurable PCR Extensions:** By default, IMA measured exclusively into PCR 10. Richter authored a kernel patch (upstreamed in Linux 4.8) allowing policy rules to specify target PCRs (e.g., `pcr=11`, or bootloader registers like PCR 4 and 5) to support finer granularity and key sealing. - **Preserving the IMA Log:** When kexec replaces the kernel, memory normally disappears. On OpenPOWER architectures, the IMA log is serialized and passed via memory references defined in device tree nodes. Upon initialization, the secondary kernel checks these nodes and appends subsequent measurements after a second boot aggregate. - **Device Tree Challenges:** Unlike `kexec_load`, `kexec_file_load` did not natively support passing a device tree argument, creating an ongoing challenge regarding how to pass and measure device tree configurations without allowing unauthorized tampering.

### Takeaways Using Linux and IMA as a trusted bootloader is feasible and works across platforms (demonstrated on OpenPOWER hardware and x86 virtual machines). While core file measurement and PCR configuration are functional and upstreamed, several challenges remain. These include measuring in-memory buffers such as kernel command lines and Petitboot boot options, standardizing log-passing mechanisms on non-device-tree architectures (e.g., via EFI configuration tables), and establishing clear policies separating what is measured into the log versus what is used for TPM PCR sealing. Performance impact was reported as negligible during console boot observation.