3. Secure Image Generation

This chapterOverview CV184x Spinor Secure Boot under，FIP、FIT（Kernel/Device Tree）、SquashFS RootFS、DATA（userdata） SignatureorEncryptionandSignature Verificationof 。 Operation、CommandsandKeyGeneratePlease Chapter ：

• FIP Signing, Encryption, and eFuse — FIP Signing and Encryption、eFuse and FIP PartitionBurning

• FIT Secure Image Boot — FIT Signature VerificationandOptionalEncryption（boot.spinor、U-Boot）

• SquashFS RootFS Signing and Kernel Verification — RootFS（SquashFS）SignatureandKernel beforeSignature Verification

• DATA Partition (userdata) Signing and Verification — DATA Partition（JFFS2）Signatureandat startupSignature Verification、

3.1. Four-Layer Protection Comparison

	Image/Partition	Description
FIP	fip.bin / fip_enc.bin	ROM/BL1 FIP Verification and Decryption（Optional）；need CONFIG_FSBL_SECURE_BOOT_SUPPORT etc.Configuration， FIP Signing, Encryption, and eFuse
Kernel（FIT）	boot.spinor FIT	U-Boot FIT Signature VerificationandOptional ；and Enable kernel secure boot、U-Boot Security etc.OptionRelated， FIT Secure Image Boot
RootFS	rootfs.spinor（SquashFS）	Signature ，Kernel beforeSignature Verification， SquashFS RootFS Signing and Kernel Verification
userdata（DATA）	data.spinor（JFFS2）	trailer， Script verify_data_sig Throughafter ， DATA Partition (userdata) Signing and Verification

Note

Precautions

is Mass ProductionKey ， Mass ProductionKey ，andin under Signing and EncryptionOperation。

3.2. Keys and Tools（ ）

FIP CommonPrivate KeyandKeyFile ：rsa_hash0.pem、bl_priv.pem、loader_ek.key、bl_ek.key；FIT and RootFS、DATA Signature and ramdisk/keys/test_reeos.key and linux_5.10/certs/cert.pem Use。fipsign.py and eFuse FIP Signing, Encryption, and eFuse；FIT KeyandMenu FIT Secure Image Boot。FIP SignatureToolsPathExample：

python3 fsbl/plat/cvitek/cv184x/common/fipsign.py sign-enc --help

SignaturenotEncryption canUse sign Commands（ Tools --help Output）。U-Boot ImageGenerate Refer to《U-boot Porting 》etc. to fip.bin after SignatureorEncryption。