Implementing UEFI-based Secure Boot + OTA Update for Embedded ARM De...
summary
Implemented UEFI-based Secure Boot on 64-bit ARM using UEFI-based Secure Boot via U-Boot, hardened U-Boot (locked down console, selective env writes, start watchdog in bootloader) and upstreamed the plumbing into the Civil Infrastructure Platform and Isar. Built a unified kernel image with multiple device tree overrides (PE/UEFI image, objcopy tooling fixes), integrated A/B OTA with watchdog-armed rollback using SWUpdate and u-boot bootcard, and mounted a read-only rootfs plus integrity protection (verity-style root hash checked from image) on an iot2050 demo; solutions worked after resolving vendor firmware and toolchain rough edges.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 0:17Civil Infrastructure Platform
- 1:10From x86 to ARM Updates
- 2:44x86 Secure Boot Recap
- 5:31ARM Boot Challenges
- 8:31UEFI Provider Options
- 10:29Securing U-Boot on ARM
- 14:58Unified Kernel Challenges
- 19:48OS Integrity and Updates
- 25:07Root FS Protection
- 27:24CIP Core Reference
- 29:40Q&A and Conclusions
related talks
42mBecoming a tyrant: Implementing secure boot in embedded devices
42mwolfBoot: Open Source Secure Boot and Remote Firmware Updates in Safety-critical..
06mSecure IoT updates bootloader on NXP FRDM-K64F ARM Cortex-M4
24mSecure boot, TEEs, different OSes and more
41mWill it Boot? -- The Case for Platform Standards in Embedded
33mUsing Open Source Software to Build an Industrial-grade Embedded Linux Platform...
49mEmbedded Linux BOF
49mGeneric System for Safe Rootfs/Kernel Upgrades without Single-Point of Failure