Skip to content

Commit

Permalink
post: odroid-m1-secure-boot: add more explanations
Browse files Browse the repository at this point in the history
Signed-off-by: Michał Iwanicki <michal.iwanicki@3mdeb.com>
  • Loading branch information
m-iwanicki committed Dec 11, 2024
1 parent 051dcbe commit f7982c4
Showing 1 changed file with 19 additions and 0 deletions.
19 changes: 19 additions & 0 deletions blog/content/post/2024-04-12-odroid-m1-secure-boot.md
Original file line number Diff line number Diff line change
Expand Up @@ -523,6 +523,7 @@ After configuration, we build by using `make`. It should build signed U-Boot wit
public key embedded inside SPL.

```text
make odroid-m1-sb-rk3568_defconfig
make -j$(nproc)
(...)
Default Configuration: 'config-1'
Expand All @@ -544,6 +545,10 @@ Signature written to 'u-boot.itb', node '/configurations/config-1/signature'
OFCHK .config
```

By default, `odroid-m1-sb-rk3568_defconfig` enables signing of only
configuration. Anyone interested why can read more on
[https://github.com/u-boot/u-boot](https://github.com/u-boot/u-boot/blob/master/doc/usage/fit/signature.rst#signed-configurations).

### Signing idbloader

Signing idbloader is similar to [Signing Loader](#signing-loader) section except
Expand All @@ -560,6 +565,17 @@ failed to get key = sign_algo
signing idbloader ok
```

You can verify whether `idbloader.img` is signed correctly by using

```shell
tools/rk_sign_tool vb --idb ../u-boot/idbloader.img
********sign_tool ver 1.4********
IDB binary is ../u-boot/idbloader.img
verifying idbloader ok
```

In case of unsigned file command would return `invalid idblock tag`

### U-Boot Verification

To check if SPL is signed correctly and that it correctly verifies U-Boot I have
Expand All @@ -586,6 +602,9 @@ Trying to boot from MMC2
=>
```

Expected output should contain `sha256,rsa2048:dev+ OK` which means signature
was verified correctly (`+` sign).

## What's next

While I managed to enable Secure Boot on Odroid it would be good to more
Expand Down

0 comments on commit f7982c4

Please sign in to comment.