CV184x Secure Boot

Revision History

Revision	Date	Description
1.0.0	2025-03-04	Initial Draft
1.0.1	2025-06-26	Flow
1.0.2	2026-04-08	FIT/FIP、RootFS、DATA（userdata）Signing and EncryptionDescription
1.0.3	2026-04-08	FIT and FIP Chapter；RootFS、DATA Chapter
1.0.4	2026-04-08	Contentsin FIP Chapter FIT Chapter before

Contents

• 1. Disclaimer
• 2. Secure Boot Introduction
  • 2.1. Image Structure
  • 2.2. Secure Boot Flow
• 3. Secure Image Generation
  • 3.1. Four-Layer Protection Comparison
  • 3.2. Keys and Tools（ ）
• 4. eFuse Burn
• 5. FIP Signing, Encryption, and eFuse
  • 5.1. Generate Keys for FIP
  • 5.2. Enable FSBL Secure Boot andBuild
  • 5.3. FIP Signing and Encryption
  • 5.4. Obtain the value to burn to eFuse (development host)
    • 5.4.1. HASH0_PUBLIC（64 ）
    • 5.4.2. LOADER_EK（32 ）
  • 5.5. Burn eFuse (one-time and irreversible in U-Boot)
  • 5.6. Burn the image (after eFuse burning is complete)
  • 5.7. Process Summary (FIP Side)
  • 5.8. FIP Key Overview（my_fip_keys/）
  • 5.9. and FIT of
• 6. FIT Secure Image Boot
  • 6.1. Generate Keys and Materials for FIT Verification and Encryption
  • 6.2. Open the configuration (kernel and U-Boot)
  • 6.3. Build and Artifacts
  • 6.4. FIT Related Key Overview（ramdisk/keys/）
  • 6.5. Process Summary (FIT Side)
  • 6.6. and FIP of
• 7. SquashFS RootFS Signing and Kernel Verification
  • 7.1. Overall Goal
  • 7.2. Useand
  • 7.3. Related Files
• 8. DATA Partition (userdata) Signing and Verification
  • 8.1. Overview
  • 8.2. UseandVerificationMethod
  • 8.3. Related Files