mirror of
https://github.com/smaeul/u-boot.git
synced 2025-11-03 21:48:15 +00:00
4d0985295b
While signing images is useful, it does not provide complete protection against several types of attack. For example, it it possible to create a FIT with the same signed images, but with the configuration changed such that a different one is selected (mix and match attack). It is also possible to substitute a signed image from an older FIT version into a newer FIT (roll-back attack). Add support for signing of FIT configurations using the libfdt's region support. Please see doc/uImage.FIT/signature.txt for more information. Signed-off-by: Simon Glass <sjg@chromium.org>
46 lines
789 B
Plaintext
46 lines
789 B
Plaintext
/dts-v1/;
|
|
|
|
/ {
|
|
description = "Chrome OS kernel image with one or more FDT blobs";
|
|
#address-cells = <1>;
|
|
|
|
images {
|
|
kernel@1 {
|
|
data = /incbin/("test-kernel.bin");
|
|
type = "kernel_noload";
|
|
arch = "sandbox";
|
|
os = "linux";
|
|
compression = "lzo";
|
|
load = <0x4>;
|
|
entry = <0x8>;
|
|
kernel-version = <1>;
|
|
hash@1 {
|
|
algo = "sha1";
|
|
};
|
|
};
|
|
fdt@1 {
|
|
description = "snow";
|
|
data = /incbin/("sandbox-kernel.dtb");
|
|
type = "flat_dt";
|
|
arch = "sandbox";
|
|
compression = "none";
|
|
fdt-version = <1>;
|
|
hash@1 {
|
|
algo = "sha1";
|
|
};
|
|
};
|
|
};
|
|
configurations {
|
|
default = "conf@1";
|
|
conf@1 {
|
|
kernel = "kernel@1";
|
|
fdt = "fdt@1";
|
|
signature@1 {
|
|
algo = "sha1,rsa2048";
|
|
key-name-hint = "dev";
|
|
sign-images = "fdt", "kernel";
|
|
};
|
|
};
|
|
};
|
|
};
|