2.2. Secure Boot eFuse Setup Process

Note

After an eFuse bit is written as 1, it cannot be erased (it can only change from 0 to 1). Take care before writing.

A locked eFuse area cannot be read or written. Take care before locking.

2.2.1. View Key Contents

View the key contents on a PC:

# 查看AES加解密秘钥
host$ xxd -p -c 256 loader_ek.key
668f8b6655a89f7cb8ee5cbd6f2c914e

# 获取RSA验签所需 sha256 值
# 执行签署脚本fipsign.py时，脚本会打印所需sha256值，如下：
host$ ./fipsign.py ......
Host$ .......
Host$ INFO:root:KPUB_HASH:978bc2031b9377dadb4c7c34467ee985806a63a3ac8ee293a3f0eddcd2b789d8
Host$ .......

  • KPUB_HASH: The string following it is the required SHA-256 value

2.2.2. Burn the Key

  1. Burn the loader_ek.key data to the eFuse "encryption key" area. The data is 16 bytes represented as a hexadecimal string. Skip this step if encryption is not used.

u-boot# efusew LOADER_EK 668f8b6655a89f7cb8ee5cbd6f2c914e

  1. Burn the SHA-256 value required for signature verification to the eFuse "SHA-256 digest required for signature verification" area. The data is 32 bytes represented as a hexadecimal string.

u-boot# efusew HASH0_PUBLIC 978bc2031b9377dadb4c7c34467ee985806a63a3ac8ee293a3f0eddcd2b789d8

  1. Lock the relevant key areas to prevent accidental writes

u-boot# efusew LOCK_LOADER_EK 01
u-boot# efusew LOCK_HASH0_PUBLIC 01

2.2.3. Enable Secure Boot

  1. Enable the signature verification flow

u-boot# efusew SECUREBOOT 01

  1. Enable the signature verification and decryption flow

u-boot# efusew SECUREBOOT 02

Note

  1. Secure Boot cannot be changed after it is enabled. Verify the key and switch data before writing them.

  2. Enabling Secure Boot must match the data written to eFuse and fip.bin. For example, after enabling decryption, use a signed and encrypted FIP.bin; a signed-only FIP.bin cannot be burned or booted.