UEFI Secure Boot in U-Boot
summary
U-Boot ships a native implementation of the UEFI ABI and boots standard EFI binaries so distributions like Fedora and openSUSE can use a single ARM image; a QEMU demo boots Tumbleweed via U-Boot and GRUB successfully. Secure Boot support exists as prototype patches but is incomplete because UEFI variable semantics clash with U-Boot’s all‑or‑nothing env store. UEFI secure variables use a DB/DBX/KEK/PK hierarchy for signing and revocation, and proposals use standalone SMM in secure world and UEFI ABI in mainline U-Boot for rollback protection.
AI-written summary · about
chapters (13)
- 0:00Intro
- 1:02UEFI is a set of standards for firmware
- 3:38UEFI simplifies development and deployment of embedded Linux systems
- 7:56UEFI defines an executable format and API for pre-boot applications
- 10:08UEFI also defines an API for runtime services
- 13:41U-Boot UEFI is in active development and maturing fast
- 17:57UEFI Secure Boot is an extension that verifies application code is signed before execution
- 20:08UEFI Secure Boot adds concept of secure variables
- 24:42UEFI Variable semantics don't match U-Boot's
- 28:46Vast majority of Secure Boat can be implemented in U-Boot proper
- 29:49Unless you care about rollback protection
- 31:00Proposed A Archó secure variable architecture using Trusted Firmware and OP-TEE
- 34:45Questions?
related talks
30mEnabling UEFI Secure Boot Across Modern Build Systems
27mSecuring Arm Servers
22mBoot Requirements and Strategies for the Edge
27mSecure Boot auto enrollment
45mUsing Secure Boot for the powers of good
43mTowards Secure Unified Kernel Images for Generic Linux Distributions and Every...
48mVerified Boot on ARM
40mWhat should I know about secure boot and TEEs?