5. FIP Signing, Encryption, and eFuse¶

This chapterDescriptionin in fip.bin Signing and Encryption，and eFuse Burning， ROM/BL1 Execute of FIP。If need boot.spinor FIT ofSignature VerificationorEncryption， FIT Secure Image Boot。

Commands in mars Contents Execute（U-Boot eFuse Commands ）；must Execute source build/envsetup_soc.sh and defconfig ，willafter isActualBoard Variant 。

5.1. Generate Keys for FIP¶

，Key 。

KEY_DIR="$(pwd)/my_fip_keys"
mkdir -p "$KEY_DIR"
openssl genrsa -out "${KEY_DIR}/rsa_hash0.pem" -F4 2048
openssl genrsa -out "${KEY_DIR}/bl_priv.pem" -F4 2048
head -c 16 /dev/random > "${KEY_DIR}/loader_ek.key"
head -c 16 /dev/random > "${KEY_DIR}/bl_ek.key"
chmod 600 "${KEY_DIR}"/*.pem "${KEY_DIR}"/*.key 2>/dev/null || true

to：rsa_hash0.pem、bl_priv.pem、loader_ek.key、bl_ek.key。

5.2. Enable FSBL Secure Boot andBuild¶

in menuconfig in：FIP setting → Add secure boot support to FSBL → 。

or inBoard-level defconfig in ：

CONFIG_FSBL_SECURE_BOOT_SUPPORT=y

Execute build_all CompleteBuild。Completeafterin install/ under Board Variantof soc_* Contentsincan to fip.bin etc.（ withBoard-levelConfigurationis ）。

Note

If Kernel FIT Secure Boot， need FIT Secure Image Boot ConfigurationKerneland U-Boot，andandThis chapter build_all in ConfigurationunderComplete。

5.3. FIP Signing and Encryption¶

in mars ContentsExecute（will KEY_DIR、FIP_IN、FIP_OUT ActualPathand OutputContents）：

KEY_DIR="$(pwd)/my_fip_keys"
FIP_IN=install/soc_cv1842hp_wevb_0014a_spinor/fip.bin
FIP_OUT=install/soc_cv1842hp_wevb_0014a_spinor/fip_enc.bin
python3 fsbl/plat/cvitek/cv184x/common/fipsign.py sign-enc \
         --root-priv="${KEY_DIR}/rsa_hash0.pem" \
         --bl-priv="${KEY_DIR}/bl_priv.pem" \
         --ldr-ek="${KEY_DIR}/loader_ek.key" \
         --bl-ek="${KEY_DIR}/bl_ek.key" \
         "$FIP_IN" "$FIP_OUT"

to If install/soc_xxx/fip_enc.bin ofOutput（xxx isBoard VariantDirectory Name）。 SignaturenotEncryption can sign Commands， fipsign.py --help。

5.4. Obtain the value to burn to eFuse (development host)¶

5.4.1. HASH0_PUBLIC（64 ）¶

needInstall PyCryptodome：

python3 -c "
from Crypto.PublicKey import RSA
from Crypto.Hash import SHA256
key = RSA.import_key(open('my_fip_keys/rsa_hash0.pem').read())
n = key.n.to_bytes(256, 'big')
print(SHA256.new(n).digest().hex())
"

5.4.2. LOADER_EK（32 ）¶

xxd -p -c 256 my_fip_keys/loader_ek.key | tr -d '\n'

5.5. Burn eFuse (one-time and irreversible in U-Boot)¶

will Replaceison toofValueafter，in U-Boot in Execute：

efusew HASH0_PUBLIC <64 >
efusew LOADER_EK <32 >
efusew LOCK_WRITE_LOADER_EK  01
efusew LOCK_WRITE_HASH0_PUBLIC  01
efusew SECUREBOOT 02

with and is ； and SECUREBOOT Burnafter ，。

Note

Precautions

eFuse Burnis irreversible，ExecutebeforePleaseConfirmImageandKey already 。

5.6. Burn the image (after eFuse burning is complete)¶

FIP Partition：will fip_enc.bin isActualBurnContent， fip.bin and is fip.bin afterBurning。 Use Signatureof fip.bin or fip_spl.bin。
Partition：and ，for example boot.spinor → BOOT，rootfs.spinor → ROOTFS，data.spinor → DATA，yoc.bin → 2nd etc.。
： Complete eFuse Burning， Burn the Imageand Partition。If Encryption FIP eFuse，can ，need Encryptionof fip.bin FIP etc.Method 。

5.7. Process Summary (FIP Side)¶

stage	Steps	Content
	0	（Optional）FIT Secure Boot FIT Secure Image Boot
Key	1	Generate FIP KeyContents my_fip_keys
ConfigurationandBuild	2	`menuconfig` Enable FSBL Add secure boot support；`build_all`
SignatureEncryption	3	fipsign.py sign-enc to fip_enc.bin
eFuse Value	4	HASH0_PUBLIC；Read LOADER_EK
eFuse Burning	5	U-Boot in efusew（HASH0_PUBLIC、LOADER_EK、LOCK、SECUREBOOT）
PartitionBurning	6	with fip_enc.bin Replace fip.bin and is fip.bin after FIP； Partition

5.8. FIP Key Overview（my_fip_keys/）¶

File	Purpose
rsa_hash0.pem	FSBL（BL2）of RSA Private Key； eFuse HASH0_PUBLIC
bl_priv.pem	Monitor/U-Boot of RSA Private Key
loader_ek.key	Encryption FSBL of AES Key（16 Bytes）； eFuse LOADER_EK
bl_ek.key	Encryption Monitor/U-Boot of AES Key（16 Bytes）

5.9. and FIT of ¶

FIT： boot.spinor， U-Boot Signature Verificationor ， FIT Secure Image Boot。
FIP： fip.bin， ROM/BL1 Verification and Decryption。

can Use： Complete FIT PackageandBurning ， fip.bin sign-enc；Burning fip_enc.bin Replaceand is fip.bin FIP Partition，BOOT Partition alreadySignatureorEncryptionof boot.spinor。