Setup secure boot chain of trust for self built images

VIM3
1

Which Khadas SBC do you use?

VIM3

Which system do you use? Android, Ubuntu, OOWOW or others?

Ubuntu

Which version of system do you use? Khadas official images, self built images, or others?

self built images

Please describe your issue below:

Hello,

Is there a detailed procedure explaining how to setup the chain of trust (using a set of keys generated at random) for building an image with secure boot enabled ?

Looking at the U-Boot source code on github is seems that secure boot is already enabled by default
u-boot/kvim3.h at khadas-vims-v2015.01 · khadas/u-boot · GitHub
//support secure boot

#define CONFIG_AML_SECURE_UBOOT 1

And there is also a default signature key file present:
h ttps://github.com/khadas/u-boot/blob/khadas-vims-v2015.01/board/khadas/kvim3/aml-user-key.sig

There are also Amlogic tools available on the download page to generate a aml-user-key.sig file with ramdom keys:
https://dl.khadas.com/Tools/Aml-signtool-G12A.zip

But it would help to have more details on:

  • how to use the Aml-signtool
  • what is required to do on the Amlogic chip (write data in OTP, how ? something else ?)
  • what has to be done in U-Boot (simply put the new aml-user-key.sig and build ? something else ?)
  • some more steps ?

Thanks a lot in advance for your help

1 Like
2

Hello, we have the same questions. Is there any update? Best regards

3

Hello @jwick

We haven’t tried Secureboot on Fenix build images we need to check and update you here.

4

Hello @JJ1997 @jwick

I have send the documentation to you about how to enable Secureboot, please check the private message.

Before you start, please note:

  • You know what you are doing and what you want to do.
  • Once the board is secured, we can’t provide proper support for it anymore.
  • The Secureboot key can only be flashed once, and it is irreversible, so caution is advised when flashing.
  • The generated key must be securely stored because once the key is flashed, you will only be able to flash images signed with this key in the future.
  • Make sure to conduct thorough testing and ensure that the image is production-ready before enabling the Secureboot feature.
5

Hi, is it possible to get that info? why is it in private message only?

Regards,
Rytis

6

Hi @numbqq!

I’m also trying to enable secure boot on a Khadas VIM3 board, could you please send me the documentation?

Thanks!