Secure Boot

Reading List

• http://boundarydevices.com/secure-boot-on-i-mx6-nitrogen6x-boards/
• http://cache.freescale.com/files/32bit/doc/app_note/AN4581.pdf
• http://bunniefoo.com/novena/IMX6DQ6SDLSRM_security.pdf
• http://www.denx-cs.de/doku/?q=m28verifiedboot
• http://lwn.net/Articles/571031/
• https://community.freescale.com/docs/DOC-96451
• https://community.freescale.com/docs/DOC-96409
• https://community.freescale.com/thread/264827
• https://github.com/ckuethe/uboot-denx/tree/master/doc/uImage.FIT
• https://github.com/ckuethe/uboot-denx/blob/master/doc/README.mxc_hab
• http://www.edlangley.co.uk/blog/2014/06/rescuing-bricked-secure-mode-i.mx6/
• http://events.linuxfoundation.org/sites/events/files/slides/elce-2014.pdf
• http://www.denx.de/wiki/pub/U-Boot/MiniSummitELCE2013/U-Boot_verified_RSA_boot_flow_on_arm_target.pdf
• https://github.com/rabeeh/android-imx6-kitkat/blob/master/platform/external/linux-test.git/0328-ENGR00217417-MX6-Provide-Secure-Boot-releated-config.patch
• https://github.com/rabeeh/android-imx6-kitkat/blob/master/platform/external/linux-test.git/0376-ENGR00000000-secure-boot-add-support-for-V2012-Secur.patch

HowTo

1. uboot: make vexpress_ca9x4_config
2. uboot: add "#define CONFIG_RSA" to vexpress_common.h
3. uboot: make menuconfig # enable FIT images with signature checking
4. uboot: env CROSS_COMPILE=arm-linux-gnueabihf- make -j4
5. uboot: do some stuff to make a signed FIT ...
6. qemu: how to emulate high assurance boot with code signing in qemu?
7. qemu: how to boot a disk image through uboot?
8. linux/uboot: build small verified initrd, embedded in the FIT?
9. linux: how to verify disk integrity?
10. linux: how to sign userland?
11. linux: how to execute only signed userland?