6. FIT Secure Image Boot

This chapterDescription boot.spinor in FIT ImageofSignature VerificationandOptionalEncryption： U-Boot inLoadKernelandDevice TreebeforeComplete or 。FIT and FIP in ROM/BL1 of ； Complete FIT ConfigurationandPackage， fip.bin Signing and Encryption， FIP Signing, Encryption, and eFuse。

ramdisk/keys ContentsafterofCommands ， Commands in mars Contents Execute；must Execute source build/envsetup_soc.sh and defconfig ，willafter isActualBoard Variant 。

6.1. Generate Keys and Materials for FIT Verification and Encryption

，and FIP Key 。FIT of RSA Signature VerificationUse Private Key and Public-Key Certificate；If FIT Encryption， Need to AES-256 Key and IV。

in mars under the directory ramdisk/keys afterExecute（and ramdisk PackageScript ofPath ）：

cd ramdisk/keys
openssl genpkey -algorithm RSA -out test_reeos.key
openssl req -new -x509 -key test_reeos.key -out test_reeos.crt
openssl rand -out test_reeos_aes256.bin 32
openssl rand -out test_reeos_iv.bin 16

to：test_reeos.key、test_reeos.crt；If FIT Encryption， test_reeos_aes256.bin、test_reeos_iv.bin。ITS、PackageScript、U-Boot inofPathmustandon File andContents 。

6.2. Open the configuration (kernel and U-Boot)

  • Execute source build/envsetup_soc.sh、defconfig``（ActualBoard Variant ）afterRun ``menuconfig，in Kernel options under Enable kernel secure boot， 。

  • （Optional）in menuconfig in Menu Support FIT image encryption/decryption。 after FIT EncryptionandSignature Verification；not Signature Verification、notEncryption。

  • Execute menuconfig_uboot， Security support， Add secure boot support to kernel，andEnsure already ：Enable RSA support、Enable hash command、Enable libcrypto support etc.， 。

6.3. Build and Artifacts

Execute build_all CompleteBuild。Completeafterin install/ under Board Variantof soc_* Contentsincan to boot.spinor etc. （ withBoard-levelConfigurationis ）。Burning Flowwill SignatureorEncryptionof boot.spinor Write BOOT Partition。

6.4. FIT Related Key Overview（ramdisk/keys/）

File

Purpose

test_reeos.key

FIT RSA Private Key（Signature）

test_reeos.crt

FIT Public-Key Certificate

test_reeos_aes256.bin

FIT AES-256 Key（32 Bytes， FIT Encryption）

test_reeos_iv.bin

FIT Encryption IV（16 Bytes， FIT Encryption）

6.5. Process Summary (FIT Side)

Steps

Content

1

in ramdisk/keys underGenerate FIT Keys and Certificates；Optional AES/IV

2

menuconfig Enable Enable kernel secure boot；Optional Support FIT image encryption/decryption

3

menuconfig_uboot Enable Add secure boot support to kernel and need

4

Execute build_all， install under boot.spinor etc. and FlowBurning BOOT Partition

6.6. and FIP of

  • FIT： boot.spinor inof kernel、FDT etc.， U-Boot Execute。

  • FIP： fip.bin Image， U-Boot and BL2 etc.， ROM/BL1 Verification and Decryption， FIP Signing, Encryption, and eFuse。

CompleteSecure Boot in， inCompleteThis chapterConfigurationand to boot.spinor after， FIP Signing, Encryption, and eFuse Generate fip_enc.bin、 eFuse andBurning FIP Partition。