如何使用带有多个密钥的u引导验证启动进行签名验证？

Question

我正在尝试使用u引导验证引导来支持我的用例。理想情况下，我希望有两组内核，ramdisk，dtb 1)。仅用于生产，2)。为发展设想。

我用相应的public key生成了两个键-- dev.key，dev.crt，prod.key，prod.crt.

为了进行测试，我创建了一个FIT源文件，如下所示，但是u-boot.dtb只生成在二进制文件中的产生键，没有显示开发密钥的迹象(结构在那里，但缺少rsa,r-squared和rsa,modulus)。有什么办法做得对吗？谢谢!

/dts-v1/;
/ {
    description = "fitImage for Tegra TX2";
    #address-cells = <1>;
    images {
        kernel-1 {
            description = "Linux kernel";
            data = /incbin/("Image");
            ...
            hash-1 {
                algo = "sha256";
            };
        };
        fdt-1 {
            description = "DTB for Tegra TX2";
            data = /incbin/("tegra186-base.dtb");
            ...
            hash-1 {
                algo = "sha256";
            };
        };
        ramdisk-1 {
            description = "Ramdisk Image for Tegra TX2";
            data = /incbin/("initrd");
            ...
            hash-1 {
                algo = "sha256";
            };
        };
    };
    configurations {
        default = "conf-1";
        conf-1 {
            description = "Production build";
            kernel = "kernel-1";
            fdt = "fdt-1";
            ramdisk = "ramdisk-1";
            signature-1 {
                algo = "sha256,rsa2048";
                key-name-hint = "prod";
                sign-images = "kernel", "fdt", "ramdisk";
            };
        };
        conf-2 {
            description = "Development build";
            kernel = "kernel-1";
            fdt = "fdt-1";
            ramdisk = "ramdisk-1";
            signature {
                algo = "sha256,rsa2048";
                key-name-hint = "dev";
                sign-images = "kernel", "fdt", "ramdisk";
            };
        };
    };
};

通过有限的测试，mkimage命令将两个键添加到u-boot.dtb中的唯一方法是进行以下设置。本质上，第二个键只是用作备份选项。这似乎与U引导文档相对应。但这不适合我的用例。文件上说

• 密钥-名称-提示:用于签名的密钥名称。这只是一个提示，因为可以更改名称。验证可以通过检查所有可用的签名密钥来进行，直到一个匹配为止。“

/dts-v1/;
/ {
    description = "fitImage for Tegra TX2";
    #address-cells = <1>;
    images {
        kernel-1 {
            description = "Linux kernel";
            data = /incbin/("Image");
            ...
            hash-1 {
                algo = "sha256";
            };
        };
        fdt-1 {
            description = "DTB for Tegra TX2";
            data = /incbin/("tegra186-base.dtb");
            ...
            hash-1 {
                algo = "sha256";
            };
        };
        ramdisk-1 {
            description = "Ramdisk Image for Tegra TX2";
            data = /incbin/("initrd");
            ...
            hash-1 {
                algo = "sha256";
            };
        };
    };
    configurations {
        default = "conf-1";
        conf-1 {
            description = "Production build";
            kernel = "kernel-1";
            fdt = "fdt-1";
            ramdisk = "ramdisk-1";
            signature-1 {
                algo = "sha256,rsa2048";
                key-name-hint = "prod";
                sign-images = "kernel", "fdt", "ramdisk";
            };
            signature-2 {
                algo = "sha256,rsa2048";
                key-name-hint = "dev";
                sign-images = "kernel", "fdt", "ramdisk";
            };
        };
    };
};

Answer 1

您可以在u-boot编译时使用ubootpubkey将密钥嵌入到您的u-boot dts文件中。