doc/uImage.FIT/beaglebone_vboot.txt

21 U-Boot has its device tree packaged wtih it, and the kernel's device tree is
22 packaged with the kernel. In particular this is important with verified boot,
26 everything verifies. On the other hand the kernel's device tree typically
27 changes when the kernel changes, so it is useful to package an updated device
28 tree with the kernel binary. U-Boot supports the latter with its flexible FIT
39 2. Obtain a suitable Linux kernel
42 kernel to be packaged, compressed and signed.
46 5. Sign the kernel
50 7. Put U-Boot and the kernel onto the board
59 this for U-Boot and also for the kernel if you build it. For example if you
86 a. Find the kernel image ('Image') and device tree (.dtb) file you plan to
87 use. In our case it is am335x-boneblack.dtb and it is built with the kernel.
92 You can write this to an SD card and then mount it to extract the kernel and
95 You can also build a kernel. Instructions for this are are here:
100 produces a kernel Image and device tree files. For the record the steps were:
102    export KERNEL=/path/to/kernel
103    cd $KERNEL
104    git clone git://github.com/beagleboard/kernel.git .
107    cp configs/beaglebone kernel/arch/arm/configs/beaglebone_defconfig
108    cd kernel
111    export OKERNEL=$KERNEL/kernel/arch/arm/boot
133 		kernel {
135 			type = "kernel";
159 			kernel = "kernel";
164 				sign-images = "fdt", "kernel";
172 But briefly it packages a kernel and device tree, and provides a single
173 configuration to be signed with a key named 'dev'. The kernel is compressed
191 Step 5: Sign the kernel
195 Linux kernel into a FIT (Flat Image Tree, a flexible file format that U-Boot
214  Image 0 (kernel)
217   Type:         Kernel Image
238   Kernel:       kernel
243 the signed kernel. Jump to step 6 if you like, or continue reading to increase
253 ## Loading kernel from FIT Image at 7fc6ee469000 ...
259    Trying 'kernel' kernel subimage
262      Type:         Kernel Image
306 load each of the images. We have a kernel and an FDT but no ramkdisk. In each
314 like ghex, and change a byte in the kernel:
316    $UOUT/tools/fit_info -f image.fit -n /images/kernel -p data
317 NAME: kernel
321 This tells us that the kernel starts at byte offset 168 (decimal) in image.fit
326 ## Loading kernel from FIT Image at 7f5a39571000 ...
332    Trying 'kernel' kernel subimage
335      Type:         Kernel Image
346 Bad hash value for 'hash-1' hash node in 'kernel' image node
373 It has detected the change in the kernel.
405 / /configurations/conf-1 /images/fdt-1 /images/fdt-1/hash /images/kernel /images/kernel/hash-1
410 Say we want to change the kernel that this configuration uses
411 (/images/kernel). We could just put a new kernel in the image, but we will
415     fdtget -tx image.fit /images/kernel/hash-1 value
417     fdtput -tx image.fit /images/kernel/hash-1 value c9436464 6427e10f 423837e5 59898ef0 2c97b981
469 kernel that you sign with the private key as in step 5.
493 7. Put U-Boot and the kernel onto the board
498 for Linux. Put it into your machine and write U-Boot and the kernel to it.
523 ## Loading kernel from FIT Image at 82000000 ...
526    Trying 'kernel' kernel subimage
529      Type:         Kernel Image
554    Uncompressing Kernel Image ... OK
557 Starting kernel ...
580 Angstrom v2012.12 - Kernel 3.14.1+
584 At this point your kernel has been verified and you can be sure that it is one
593 capital if signing and packaging a kernel were easy, perhaps a simple make
594 target in the kernel.