Re: Problem with U-boot | Configuration Signature not being checked while booting

On Sat, Sep 18, 2021 at 01:15:07PM +0200, Mark Kettenis wrote: > > From: Simon Glass > > Date: Sat, 18 Sep 2021 03:27:48 -0600 > > > > Hi Tom, > > > > On Fri, 17 Sept 2021 at 11:26, Tom Rini wrote: > > > > > > On Fri, Sep 17, 2021 at 10:19:18AM -0600, Simon Glass wrote: > > > > Hi Mark, > > >

Re: Problem with U-boot | Configuration Signature not being checked while booting

On Sat, Sep 18, 2021 at 12:26:00PM +0200, François Ozog wrote: > Le sam. 18 sept. 2021 à 12:10, Mark Kettenis a > écrit : > > > > From: Moiz Imtiaz > > > Date: Sat, 18 Sep 2021 14:47:51 +0500 > > > > > > >Nice! If you want to write something up extending the >documentation on > > > >how you

Re: Problem with U-boot | Configuration Signature not being checked while booting

On Sat, Sep 18, 2021 at 03:27:48AM -0600, Simon Glass wrote: > Hi Tom, > > On Fri, 17 Sept 2021 at 11:26, Tom Rini wrote: > > > > On Fri, Sep 17, 2021 at 10:19:18AM -0600, Simon Glass wrote: > > > Hi Mark, > > > > > > On Wed, 15 Sept 2021 at 05:52, Mark Kettenis > > > wrote: > > > > > > > > >

Re: Problem with U-boot | Configuration Signature not being checked while booting

Hi Mark, On Sat, 18 Sept 2021 at 05:15, Mark Kettenis wrote: > > > From: Simon Glass > > Date: Sat, 18 Sep 2021 03:27:48 -0600 > > > > Hi Tom, > > > > On Fri, 17 Sept 2021 at 11:26, Tom Rini wrote: > > > > > > On Fri, Sep 17, 2021 at 10:19:18AM -0600, Simon Glass wrote: > > > > Hi Mark, > > >

Re: Problem with U-boot | Configuration Signature not being checked while booting

I will try to learn how to create a dtbo, and do a PR to documentation. I ain't an embedded or kernel guru like you guys. I have a complete security background with primarily appsec :) But I agree that we should have some documentation because 1. It's a common reference platform 2. At the moment

Re: Problem with U-boot | Configuration Signature not being checked while booting

Tbh, the reason why I didn't do overlay is that I am not comfortable with it. I still have to learn how to do dtbo, and that is why I didn't add a PR to the documentation. I understand adding a dtbo is more robust and better way. What I replaced with was a copy of the original device tree that

Re: Problem with U-boot | Configuration Signature not being checked while booting

On Sat, Sep 18, 2021 at 03:27:40AM -0600, Simon Glass wrote: > Hi Tom, > > On Fri, 17 Sept 2021 at 11:42, Tom Rini wrote: > > > > On Fri, Sep 17, 2021 at 10:21:15AM -0600, Simon Glass wrote: > > > Hi Tom, > > > > > > On Wed, 15 Sept 2021 at 07:35, Tom Rini wrote: > > > > > > > > On Wed, Sep 15,

Re: Problem with U-boot | Configuration Signature not being checked while booting

> From: Simon Glass > Date: Sat, 18 Sep 2021 03:27:48 -0600 > > Hi Tom, > > On Fri, 17 Sept 2021 at 11:26, Tom Rini wrote: > > > > On Fri, Sep 17, 2021 at 10:19:18AM -0600, Simon Glass wrote: > > > Hi Mark, > > > > > > On Wed, 15 Sept 2021 at 05:52, Mark Kettenis > > > wrote: > > > > > > > >

Re: Problem with U-boot | Configuration Signature not being checked while booting

Le sam. 18 sept. 2021 à 12:10, Mark Kettenis a écrit : > > From: Moiz Imtiaz > > Date: Sat, 18 Sep 2021 14:47:51 +0500 > > > > >Nice! If you want to write something up extending the >documentation on > > >how you made this work for Pi it would be much appreciated. > > > > Sure, would love to

Re: Problem with U-boot | Configuration Signature not being checked while booting

> From: Moiz Imtiaz > Date: Sat, 18 Sep 2021 14:47:51 +0500 > > >Nice! If you want to write something up extending the >documentation on > >how you made this work for Pi it would be much appreciated. > > Sure, would love to do a PR. > > I basically replaced the dtb that pi loads with

Re: Problem with U-boot | Configuration Signature not being checked while booting

>Nice! If you want to write something up extending the >documentation on >how you made this work for Pi it would be much appreciated. Sure, would love to do a PR. I basically replaced the dtb that pi loads with control Dtb of uboot, but will do a PR of documentation addition in respect to pi_4,

Re: Problem with U-boot | Configuration Signature not being checked while booting

Hi Tom, On Fri, 17 Sept 2021 at 11:26, Tom Rini wrote: > > On Fri, Sep 17, 2021 at 10:19:18AM -0600, Simon Glass wrote: > > Hi Mark, > > > > On Wed, 15 Sept 2021 at 05:52, Mark Kettenis > > wrote: > > > > > > > From: Simon Glass > > > > Date: Wed, 15 Sep 2021 04:13:24 -0600 > > > > > > Hi

Re: Problem with U-boot | Configuration Signature not being checked while booting

Hi Tom, On Fri, 17 Sept 2021 at 11:42, Tom Rini wrote: > > On Fri, Sep 17, 2021 at 10:21:15AM -0600, Simon Glass wrote: > > Hi Tom, > > > > On Wed, 15 Sept 2021 at 07:35, Tom Rini wrote: > > > > > > On Wed, Sep 15, 2021 at 01:51:51PM +0200, Mark Kettenis wrote: > > > > > From: Simon Glass > >

Re: Problem with U-boot | Configuration Signature not being checked while booting

On Fri, Sep 17, 2021 at 10:21:38AM -0600, Simon Glass wrote: > Hi François, > > On Wed, 15 Sept 2021 at 04:26, François Ozog wrote: > > > > > > > > Le mer. 15 sept. 2021 à 12:13, Simon Glass a écrit : > >> > >> Hi Mark, > >> > >> On Sat, 11 Sept 2021 at 13:18, Mark Kettenis > >> wrote: > >> >

Re: Problem with U-boot | Configuration Signature not being checked while booting

On Fri, Sep 17, 2021 at 10:21:15AM -0600, Simon Glass wrote: > Hi Tom, > > On Wed, 15 Sept 2021 at 07:35, Tom Rini wrote: > > > > On Wed, Sep 15, 2021 at 01:51:51PM +0200, Mark Kettenis wrote: > > > > From: Simon Glass > > > > Date: Wed, 15 Sep 2021 04:13:24 -0600 > > > > > > Hi Simon, > > > >

Re: Problem with U-boot | Configuration Signature not being checked while booting

On Fri, Sep 17, 2021 at 10:19:18AM -0600, Simon Glass wrote: > Hi Mark, > > On Wed, 15 Sept 2021 at 05:52, Mark Kettenis wrote: > > > > > From: Simon Glass > > > Date: Wed, 15 Sep 2021 04:13:24 -0600 > > > > Hi Simon, > > > > > Hi Mark, > > > > > > On Sat, 11 Sept 2021 at 13:18, Mark Kettenis

Re: Problem with U-boot | Configuration Signature not being checked while booting

HI Simon, On Fri, 17 Sept 2021 at 18:21, Simon Glass wrote: > Hi François, > > On Wed, 15 Sept 2021 at 04:26, François Ozog > wrote: > > > > > > > > Le mer. 15 sept. 2021 à 12:13, Simon Glass a écrit : > >> > >> Hi Mark, > >> > >> On Sat, 11 Sept 2021 at 13:18, Mark Kettenis > wrote: > >> >

Re: Problem with U-boot | Configuration Signature not being checked while booting

Hi François, On Wed, 15 Sept 2021 at 04:26, François Ozog wrote: > > > > Le mer. 15 sept. 2021 à 12:13, Simon Glass a écrit : >> >> Hi Mark, >> >> On Sat, 11 Sept 2021 at 13:18, Mark Kettenis wrote: >> > >> > > From: Moiz Imtiaz >> > > Date: Sat, 11 Sep 2021 23:19:05 +0500 >> > > >> > > Hi

Re: Problem with U-boot | Configuration Signature not being checked while booting

Hi Tom, On Wed, 15 Sept 2021 at 07:35, Tom Rini wrote: > > On Wed, Sep 15, 2021 at 01:51:51PM +0200, Mark Kettenis wrote: > > > From: Simon Glass > > > Date: Wed, 15 Sep 2021 04:13:24 -0600 > > > > Hi Simon, > > > > > Hi Mark, > > > > > > On Sat, 11 Sept 2021 at 13:18, Mark Kettenis > > >

Re: Problem with U-boot | Configuration Signature not being checked while booting

Hi Mark, On Wed, 15 Sept 2021 at 05:52, Mark Kettenis wrote: > > > From: Simon Glass > > Date: Wed, 15 Sep 2021 04:13:24 -0600 > > Hi Simon, > > > Hi Mark, > > > > On Sat, 11 Sept 2021 at 13:18, Mark Kettenis > > wrote: > > > > > > > From: Moiz Imtiaz > > > > Date: Sat, 11 Sep 2021 23:19:05

Re: Problem with U-boot | Configuration Signature not being checked while booting

On Wed, 15 Sept 2021 at 15:36, Tom Rini wrote: > On Wed, Sep 15, 2021 at 01:51:51PM +0200, Mark Kettenis wrote: > > > From: Simon Glass > > > Date: Wed, 15 Sep 2021 04:13:24 -0600 > > > > Hi Simon, > > > > > Hi Mark, > > > > > > On Sat, 11 Sept 2021 at 13:18, Mark Kettenis > wrote: > > > > > >

Re: Problem with U-boot | Configuration Signature not being checked while booting

On Wed, Sep 15, 2021 at 01:51:51PM +0200, Mark Kettenis wrote: > > From: Simon Glass > > Date: Wed, 15 Sep 2021 04:13:24 -0600 > > Hi Simon, > > > Hi Mark, > > > > On Sat, 11 Sept 2021 at 13:18, Mark Kettenis > > wrote: > > > > > > > From: Moiz Imtiaz > > > > Date: Sat, 11 Sep 2021 23:19:05

Re: Problem with U-boot | Configuration Signature not being checked while booting

On Mon, Sep 13, 2021 at 01:45:56AM +0500, Moiz Imtiaz wrote: > Thanks a lot Tom and U-boot Team, > > What I did is that I made a control FDT (with Public_key and > signature_node) and replaced the default dtb (bcm2711-rpi-4-b.dtb) in the > boot directory of rpi_4-b(the board I am using) with the

Re: Problem with U-boot | Configuration Signature not being checked while booting

> From: Simon Glass > Date: Wed, 15 Sep 2021 04:13:24 -0600 Hi Simon, > Hi Mark, > > On Sat, 11 Sept 2021 at 13:18, Mark Kettenis wrote: > > > > > From: Moiz Imtiaz > > > Date: Sat, 11 Sep 2021 23:19:05 +0500 > > > > > > Hi Simon, > > > > > > Thanks for the reply. I already followed the

Re: Problem with U-boot | Configuration Signature not being checked while booting

Le mer. 15 sept. 2021 à 12:13, Simon Glass a écrit : > Hi Mark, > > On Sat, 11 Sept 2021 at 13:18, Mark Kettenis > wrote: > > > > > From: Moiz Imtiaz > > > Date: Sat, 11 Sep 2021 23:19:05 +0500 > > > > > > Hi Simon, > > > > > > Thanks for the reply. I already followed the steps mentioned in >

Re: Problem with U-boot | Configuration Signature not being checked while booting

Hi Mark, On Sat, 11 Sept 2021 at 13:18, Mark Kettenis wrote: > > > From: Moiz Imtiaz > > Date: Sat, 11 Sep 2021 23:19:05 +0500 > > > > Hi Simon, > > > > Thanks for the reply. I already followed the steps mentioned in > > "doc/uImage.FIT/beaglebone_vboot.txt". > > > > >I wonder if rpi is not

Re: Problem with U-boot | Configuration Signature not being checked while booting

Thanks a lot Tom and U-boot Team, What I did is that I made a control FDT (with Public_key and signature_node) and replaced the default dtb (bcm2711-rpi-4-b.dtb) in the boot directory of rpi_4-b(the board I am using) with the Control FDT I compiled U-boot with "Config_OF_BOARD" and thought that

Re: Problem with U-boot | Configuration Signature not being checked while booting

On Sun, Sep 12, 2021 at 02:58:12AM +0500, Moiz Imtiaz wrote: > Completely agreed, that a fully secure boot on pi won't be achievable > because the Root of Trust (ROT) cant be established from the BOTROM/EEPROM. > Plus Pi doesn't have any High Assurance Boot (HAB). But given the > scenerio,

Re: Problem with U-boot | Configuration Signature not being checked while booting

Completely agreed, that a fully secure boot on pi won't be achievable because the Root of Trust (ROT) cant be established from the BOTROM/EEPROM. Plus Pi doesn't have any High Assurance Boot (HAB). But given the scenerio, whatever we can achieve i.e if we can verify the kernel, the device tree,

Re: Problem with U-boot | Configuration Signature not being checked while booting

On Sat, Sep 11, 2021 at 11:30:00PM +0200, Mark Kettenis wrote: > > Date: Sat, 11 Sep 2021 17:05:45 -0400 > > From: Tom Rini > > > > On Sat, Sep 11, 2021 at 09:18:46PM +0200, Mark Kettenis wrote: > > > > From: Moiz Imtiaz > > > > Date: Sat, 11 Sep 2021 23:19:05 +0500 > > > > > > > > Hi Simon, >

Re: Problem with U-boot | Configuration Signature not being checked while booting

> Date: Sat, 11 Sep 2021 17:05:45 -0400 > From: Tom Rini > > On Sat, Sep 11, 2021 at 09:18:46PM +0200, Mark Kettenis wrote: > > > From: Moiz Imtiaz > > > Date: Sat, 11 Sep 2021 23:19:05 +0500 > > > > > > Hi Simon, > > > > > > Thanks for the reply. I already followed the steps mentioned in >

Re: Problem with U-boot | Configuration Signature not being checked while booting

On Sat, Sep 11, 2021 at 09:18:46PM +0200, Mark Kettenis wrote: > > From: Moiz Imtiaz > > Date: Sat, 11 Sep 2021 23:19:05 +0500 > > > > Hi Simon, > > > > Thanks for the reply. I already followed the steps mentioned in > > "doc/uImage.FIT/beaglebone_vboot.txt". > > > > >I wonder if rpi is not

Re: Problem with U-boot | Configuration Signature not being checked while booting

> From: Moiz Imtiaz > Date: Sat, 11 Sep 2021 23:19:05 +0500 > > Hi Simon, > > Thanks for the reply. I already followed the steps mentioned in > "doc/uImage.FIT/beaglebone_vboot.txt". > > >I wonder if rpi is not using the devicetree compiled with U-Boot, but > instead one provided by the

Re: Problem with U-boot | Configuration Signature not being checked while booting

Hi Simon, Thanks for the reply. I already followed the steps mentioned in "doc/uImage.FIT/beaglebone_vboot.txt". >I wonder if rpi is not using the devicetree compiled with U-Boot, but instead one provided by the earlier-stage firmware? Not sure, but seems like this is the case. I checked and

Re: Problem with U-boot | Configuration Signature not being checked while booting

+Tom Rini Hi Moiz, On Thu, 9 Sept 2021 at 14:21, Moiz Imtiaz wrote: > > Hope you are doing well and everything is going good at your end. I am using > Raspi 4B and Compute Model 4 and trying to configure U-boot with Verified > boot support, but while booting the signing of the configuration