The patchset fixes some issue in the generation of the imx image
Get series with b4
b4 am [email protected]Versions newest first
- v1 Latest0 of 7 patches 0 repliesNew
Patches in v1 No applies recorded yet
None of the 7 patches the cover letter announces are in this archive.
Reviews trailers per patch
No Reviewed-by, Acked-by or Tested-by trailers for v1 yet.
Cover letter [U-Boot] [PATCH v1 0/7] The patchset fixes some issue in the generation of the imx image
Thanks Stefano,
Quoted 18 lines · Stefano Babic
(header for Freescale's i.MX processors) to allow the usage of Freescale's tools to sign the u-boot image and provide a secure boot.
This has nothing to do with the Secure Boot extensions implemented by Simon Glass, that can be in any case used to boot later a secure image. Freescale's secure boot ensures that a signed bootloader
is started only if it is verified with a key that is burned into the iMX fuses. Documentation about the Freescale's secure process can be read from the AN4591, available on the Freescale's Website.The patchset allows to add to the imx Header the CSF (command Sequence File) generated by the tools provided by Freescale. The CSF is then simply concatenated to the u-boot image, making a signed bootloader, that the processor can verify if the fuses for the keys are burned. The processor (i.MX53 / i.MX6x) will not start a bootloader that cannot be verified - further infos how to configure the SOC to verify the bootloader can be found in the User Manual of the specific SOC.
Quoted 3 lines
Next step is to verify the kernel, that can be still done using Simon's patches for verified boot (
CONFIG_OF_CONTROLmust be set in the board configuarion file).
I compile-tested the series against all of our boards (boundary/boundary/* and board/freescale/mx6qsabrelite).
Run-time tests (without signing) against nitrogen6s (solo) and nitrogen6q (quad). Both ran without a hitch.
Now we need to get configured for signing and burn some fuses!