Hi Tiger,
On Sun, Feb 3, 2013 at 5:52 PM, TigerLiu@viatech.com.cn wrote:
Hi, Simon: Thanks for your answer! I have a PandaBoard (OMAP 4460). I am studying Uboot code.
If uboot integrates this verifying kernel function, then it would have a security feature.(seams as UEFI firmware supported)
Yes. It can be used to verify a kernel, and also to verify a second-stage firmware (if upgradable firmware is required and you want to always avoid bricking the device). It can verify any image that can be put in a FIT, and any combination of images that can be put in a FIT configuration.
Regards, Simon
Best wishes,
-----邮件原件----- 发件人: sjg@google.com [mailto:sjg@google.com] 代表 Simon Glass 发送时间: 2013年2月1日 22:25 收件人: Tiger Liu 抄送: u-boot@lists.denx.de 主题: Re: [U-Boot] [U-boot] mkimage -F parameter
Hi Tiger,
On Thu, Jan 31, 2013 at 3:36 AM, TigerLiu@viatech.com.cn wrote:
Hi, experts:
It seems mkimage has supported signing a image.
This code is not yet merged, as you have discovered.
So, I have a question about signed linux kernel image:
if kernel image is signed by mkimage tool.Could uboot verify this signed linux kernel image bf jumping to its entry point function?
Yes the bootm command will do this automatically.
if uboot could verify the signed linux kernel imagehow to management these different vendors' public keys in uboot code? Using env variable?
The keys are not easily kept in an environment variable as we have several bits of information.
In the current implementation the device tree is used, so you need to enable CONFIG_OF_CONTROL. Then mkimage will put the public keys in the FDT, and you attach that to U-Boot.
Multiple keys are supported and it is possible to sign the same image with several different keys. Keys can be marked 'required' so that they must verify.
What platform/board are you using?
Regards, Simon
Best wishes,
U-Boot mailing list U-Boot@lists.denx.de http://lists.denx.de/mailman/listinfo/u-boot