Module boot 

Secure Boot Verification

Verifies the integrity of the boot chain using cryptographic measurements, signature verification, and TPM PCR extensions.

Boot Measurement Flow

1. Compute SHA-256 hash of the kernel image in memory
2. Verify kernel signature (if a signature is provided)
3. Record measurement in the boot measurement log
4. Extend TPM PCR 0 with the kernel measurement
5. Return verification status

PCR Allocation

• PCR 0: Kernel image measurement
• PCR 1: Kernel configuration / command line
• PCR 2: Boot stage measurements (bootloader, early init)

Structs

BootMeasurement

A single boot measurement entry in the measurement log

BootMeasurementLog

Boot measurement log recording all measurements taken during boot.

BootSignature

Boot signature for kernel image verification

SecureBootConfig

Secure boot configuration

Enums

BootStatus

Boot verification status

SignatureAlgorithm

Supported signature algorithms

Functions

compute_kernel_hash

Compute a SHA-256 hash of the kernel image in memory.

disable

Disable secure boot.

enable

Enable secure boot with optional enforcement.

get_measurement

Get a recorded boot measurement by index.

get_status

Get the current boot verification status.

measure_boot_stage

Record a boot stage measurement.

measurement_count

Get the number of recorded boot measurements.

print_measurement_log

Print all boot measurements to the kernel console.

set_expected_hash

Set the expected kernel hash for verification.

set_signature

Set the boot signature and signer public key.

verify

Verify secure boot chain.