User Tools
products:sbc:vim3:applications:secureboot
Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
|
products:sbc:vim3:applications:secureboot [2023/08/30 02:28] nick |
products:sbc:vim3:applications:secureboot [2023/08/30 02:48] (current) nick |
||
|---|---|---|---|
| Line 3: | Line 3: | ||
| ===== Introduction ===== | ===== Introduction ===== | ||
| - | The default image compiled by Fenix for Ubuntu/ | + | The default image compiled by [[kg> |
| - | Enabling Secureboot means that the board can only flash image signed with the same key. It won't be possible to flash any other unsigned image or image signed with a different key. | + | Enabling Secureboot means that the board can only flash image signed with the same key, it won't be possible to flash any other unsigned image or image signed with a different key anymore. |
| - | Additionally, the process of flashing the key is irreversible. | + | If you want to enable the Secureboot feature, you can follow this documentation to apply extra patches and sign the image. |
| + | |||
| + | <WRAP important > | ||
| + | * Only support eMMC installation image. | ||
| + | </ | ||
| - | If you need to add Secureboot support, you will require additional patches to enable it. | ||
| ===== Warning ===== | ===== Warning ===== | ||
| Line 41: | Line 44: | ||
| There 2 patches, one is for Fenix, and the other one is for u-boot. | There 2 patches, one is for Fenix, and the other one is for u-boot. | ||
| - | ===== Compile the images | + | ===== Compile the image ===== |
| - | You can compile the images | + | You can compile the image after apply the patches. |
| ===== Generate the signing key ===== | ===== Generate the signing key ===== | ||
| Line 60: | Line 63: | ||
| {{: | {{: | ||
| - | The path of generated keys is in the '' | + | The path of generated keys is in the '' |
| {{: | {{: | ||
| Line 66: | Line 69: | ||
| You need to save the files '' | You need to save the files '' | ||
| - | - aml-user-key.sig - Used to sign the images | + | * '' |
| - | - SECURE_BOOT_SET - Used to burn the key | + | * '' |
| - | ===== Encrypt the images | + | ===== Encrypt the image ===== |
| + | <WRAP important > | ||
| + | * Only support sign tool under Windows system. | ||
| + | </ | ||
| - | Still using the sign tool '' | + | Also using the sign tool '' |
| - | and also check '' | + | and also check '' |
| {{: | {{: | ||
| - | |||
| Line 95: | Line 100: | ||
| After successful signing, a new encrypted image will be generated in the original image directory, with a filename containing the '' | After successful signing, a new encrypted image will be generated in the original image directory, with a filename containing the '' | ||
| - | e.g. if the orignal file is '' | + | e.g. if the orignal file is '' |
| Line 103: | Line 108: | ||
| ===== Flash encrypted image ===== | ===== Flash encrypted image ===== | ||
| + | <WRAP important > | ||
| + | * Only support USB flash tool under Windows system. | ||
| + | </ | ||
| - | Download and install the [[dl> | + | Download and install the [[dl> |
| '' | '' | ||
| Line 116: | Line 124: | ||
| <WRAP important > | <WRAP important > | ||
| The key can only be flashed once, meaning you should only check '' | The key can only be flashed once, meaning you should only check '' | ||
| - | Do not check it again for subsequent flashes or it will fail. | + | |
| + | Do not check it again for next time flashing with the same board. | ||
| </ | </ | ||
| + | |||
| + | ===== See Also ===== | ||
| + | |||
| + | You can find some documentations about how to flash the keys with Amlogic USB Flash Tool from the USB Flash Tool: '' | ||
| + | |||
| + | {{: | ||
| + | |||
| + | |||
| + | |||
| + | |||
Last modified: 2023/08/30 02:28 by nick