#U BOOT SECURE BOOT HOW TO#
#U BOOT SECURE BOOT DRIVER#
#U BOOT SECURE BOOT VERIFICATION#

WarmBoot code reside in /home/myname/Desktop/jetson-tk1/Linux_for_Tegra/bootloader/ardbeg/u-boot. U-Booting securely Dmitry Janushkevich, This paper aims to provide an independent analysis of known pitfalls and production misconfigurations related to using U-Boot (officially: Das U-Boot) in secure embedded systems as well as provide developers with guidance towards securing their products. Linux: What is Secure Boot At its start a computer runs a specific program to detect and initialize its hardware components. Inject rsa-pss signature wb. into wb_header U_BOOT_SPL_ELF: /home/myname/Desktop/jetson-tk1/Linux_for_Tegra/bootloader/ardbeg/u-boot-splĮxtract the part of the binary that needs to be signedĬalculate rsa-pss signature and save to wb. U_BOOT_ELF: /home/myname/Desktop/jetson-tk1/Linux_for_Tegra/bootloader/ardbeg/u-boot KEY_FILE: /home/myname/Desktop/jetson-tk1/jetson_tk1_rsa_priv.pem IMAGE_FILE: /home/myname/Desktop/jetson-tk1/Linux_for_Tegra/bootloader/ardbeg/u-boot.bin A scheme of secure boot for embedded system is proposed. I see that secure monitor includes the warmboot code, but it is the same thing, can I have the document about the signing and programming process for it on jetson TK1 Jetson TK1 u-boot 'secure monitor' option (r21.8.0-sources. …/wb_sign.sh u-boot.bin …/…/…/jetson_tk1_rsa_priv.pem u-boot u-boot-spl In this paper the transitive trust of TPM and the secure boot of MTM are analyzed.

#U BOOT SECURE BOOT VERIFICATION#

Enable rsa signature verification in SPL framework before relocation for verification of main u-boot.

#U BOOT SECURE BOOT DRIVER#

I found that CONFIG_ARMV7_SECURE_BASE=0xffe00000, could this be the reason the wb_header is way too big?Ĭan you help give document about the u-boot signing process with rel-28? SECUREBOOT: Enable SD as a source for bootscript arm: ls1021atwr: Add SD secure boot target PATCH 1/4 DM: crypto/fsl: Enable rsa DM driver usage before relocation.

When I used “wb_sign.sh” to sign u-boot-dtb-tegra.bin being built from #2, the image became around 2.0 GB, I guess the SECURE_MONITOR_BASE configuration might be wrong, please read the italic lines in below result.

#U BOOT SECURE BOOT HOW TO#

I believe “secure monitor” in R21.8-source is the same thing with “secure boot” in R21.7-source, please help confirm, if so, then do we have any document about how to setup secure boot on TK1 with “secure monitor”?.u-boot in R21.7.0-source, with “secure monitor”, it could NOT boot on the board at all.secure U-Boot verifies and loads Semelis, or goes to FEL, if comething is wrong. u-boot in R21.7.0-source, without “secure monitor”, it could boot on the board very well 1) secure U-Boot not found > likely goto FEL (may be options, depending on SPL logic) 2) verify secure U-Boot with some keys (depends on SPL logic) verification failed > goto FEL. This product will implement the Secure Boot on your target NXP i.MX hardware through the specially crafted Yocto meta layer.

Let me put it in a simple way, I am using jetson-tk1 development board (model: TR375)

U boot secure boot