Introduction: This document is dedicated for usage help of Amlogic Script Signing Tool Set which is a tool set for Amlogic secure boot solution. It includes two topic as following: a. support sign uboot/kernel/recovery/dtb with the tool b. support usb password feature SIGNING PROCESS FOR UBOOT/KERNEL |--UBOOT prepare | |-1. get the latest version which support script sign uboot feature | |-2. then open the switch #define CONFIG_AML_SIGNED_UBOOT 1 //gxl_skt_v1.h | |-3. build uboot successfully with command ./mk gxl_skt_v1 | 1-4. get package file for v3 script gxl_skt_v1-u-boot.aml.zip | |--KERNEL/RECOVERY/DTB prepare | |-1. kernel/recovery/dtb image should be ready and place them to folder ./input | |--KEY prepare | |-1. run ./key.create.bash keypath to generate keys to folder keypath | | |-1. for uboot signing you must afford RSA/AES key for bl2/bl3x and place them to folder ./key | | |-2. for kernel/recovery/dtb signing you must afford RSA/AES key and place them to folder ./key | |-2. for those project which use aml_encrypt_gxl/txlx/axg/g12a/g12b/tl1/tm2/c1/t5/t5d/t5w/txhd2 etc for secure boot, please use following mapping table for key transfer | |------former key <----> script tool key(14 key files)------- | |-1. /aml-key/bl2aesiv //dd if=/dev/zero of=bl2aesiv conv=notrunc bs=1 count=16 >& /dev/null | |-2. /userkey/key.aes /aml-key/bl2aeskey | |-3. /usekey/key.kxa.pem /aml-key/bl2.pem | |-4. /userkey/key.aes /aml-key/bl3xaeskey | |-5. /aml-key/bl3xaesiv //dd if=/dev/zero of=bl3xaesiv conv=notrunc bs=1 count=16 >& /dev/null | |-6. /usekey/key.kxa.pem /aml-key/bl3xkey.pem | |-7. /userkey/key.aes /aml-key/kernelaeskey | |-8. /aml-key/kernelaesiv //dd if=/dev/zero of=kernelaesiv conv=notrunc bs=1 count=16 >& /dev/null | |-9. /usekey/key.kxa.pem /aml-key/kernelkey.pem | |-10. /rootkey_1/key.kxa.pem /aml-key/root.pem | |-11. /rootkey_1/key.kxa.pem /aml-key/root0.pem | |-12. /rootkey_2/key.kxa.pem /aml-key/root1.pem | |-13. /rootkey_3/key.kxa.pem /aml-key/root2.pem | |-14. /rootkey_4/key.kxa.pem /aml-key/root3.pem | |- | |-NOTE: for those keys which not exist in the former key set please just use one 16bytes random binary file is OK | |-IMPORTANT: After make out the new key set you must take following process before use the *.pem RSA key file | |- remove all extra info which after "-----END RSA PRIVATE KEY-----" because the script signing tool does support this format | |--Command to signing | |-1 ./sign.sh -s soc -p input -r rsakey -a aeskey -o output | | -s soc //soc type: gxl,txlx,axg,g12a,g12b,tl1,tm2,c1,t5,t5d,t5w,txhd2 | | -p input //input folder | | -r frsakey //rsa key folder | | -a faeskey //aes key folder | | -o output //output folder | |-2 ./sign.sh -s soc -z package -r rsakey -a aeskey -o output | | -s soc //soc type: gxl,txlx,axg,g12a,g12b,tl1,tm2,c1,t5,t5d,t5w,txhd2 | | -z zip package file //uboot package image, e.g. gxl_skt_v1-u-boot.aml.zip | | -r frsakey //rsa key folder | | -a faeskey //aes key folder | | -o output //output folder | |--NOTE: uboot building support auto sign with CONFIG_AML_SIGNED_UBOOT enabled. Please check build.sh of each SoC. (e.g fip/gxl/build.sh) USB password process | |--password prepare | |-1. password.bin //password for usb boot, min is 4bytes and max to 16bytes, binary format,random value | |-2. salt.bin //solution usage, must be 4byts, binary format, random value | |--password process | |-1. tool amlpwdefs dedicated to generate the corresponding pattern with password & salt | |- ./amlpwdefs --password password.bin --salt salt.bin //get output is password.bin_PMMMMMMMM_SNNNNNNNN.bin | |-2. tool efuse.sh is a tool wraper for efuse pattern process, it will call efuse-gen.sh from signing-tool-gxl-dev or | | | signing-tool-g12a-dev or signing-tool-tl1-dev or signing-tool-c1-dev, current version only support gxl/txlx/axg/g12a/g12b/tl1/tm2/c1/t5/t5d | | |- ./efuse.sh --generate-efuse-pattern --password-hash password.bin_PMMMMMMMM_SNNNNNNNN.bin -o pattern.usb.efuse --enable-usb-passwor | |--use tool step by step | |-1. password.bin prepare | | |- set password binary image file password.bin with 16bytes: 0x00,0x01,0x02,0x03,0x04,0x05,0x06,0x07,0x08,0x09,0x0a,0x0b,0x0c,0x0d,0x0e,0x0f | | | |-2. salt.bin prepare | | |- set salt binary image file salt.bin with four bytes: 0x05,0x06,0x07,0x08 | | | |-3. process with amlpwdefs to generate password pattern | | |- ./amlpwdefs --password password.bin --salt salt.bin | | | | get 32bytes file with name password.bin_P00010203_S05060708.bin | | | | P00010203 : 00 01 02 03 are the first 4bytes of password | | | | S05060708 : 05 06 07 08 are the salt content | | |- NOTE: rename the output to usb.password.hash.bin and place it to the script key folder for auto generate pattern.usb.efuse for usb password protect usage. | | | Yes, you can also process it with following step to generate pattern and burn it to SoC. | | | |-4. use efuse.sh to generate EFUSE pattern for USB password | | |- ./efuse.sh --generate-efuse-pattern --password-hash password.bin_P00010203_S05060708.bin -o pattern.usb.efuse --enable-usb-password true --soc gxl | | | | get output image with fixed size 1024bytes pattern.usb.efuse which can be used to program the pattern to SoC and enable the license bit | | | |-5. burn pattern to SoC with uboot command | | |-1. fatload mmc 0 1080000 pattern.efuse //load password pattern file to DDR 0x1080000 | | |-2. efuse amlogic_set 1080000 //burn EFUSE | | |-3. reset //reset to make the usb password protection work | | |-4. //from now on the SoC usb boot is protected with password | |--NOTE: uboot building support auto generate usb password pattern when usb.password.hash.bin does exis in each key folder of SoC. Then three EFUSE pattern file will generate | pattern.efuse //for secure boot & usb password use | pattern.secureboot.efuse //for secure boot key use only | pattern.usb.efuse //for usb password use only EFUSE pattern process | |--function usage | ./efuse.sh --generate-efuse-pattern \ // | --soc [gxl | txlx | axg | g12a | g12b | tl1 | tm2 | c1 | t5 | t5d | t5w | txhd2 ] \ //soc type, must afford | [--aml-key-path path-of-key] \ //key path, will get RSA & AES key from it | [--rsa-key-path path-of-rsa-key] \ //key path, will get RSA key from it | [--enable-sb false] \ //secure boot enable flag, default is false | [--aes-key aes-key] \ //aes key | [--enable-aes false] \ //AES scramble enable flag, default is false | [--password-hash password.hash] \ //password hash input, password hash generated with amlpwdefs,32 bytes binary file | [--enable-jtag-password false] \ //JTAG password enable flag, default is false | [--enable-usb-password false] \ //USB password enable flag, default is false | [--enable-anti-rollback false] \ //ANTI-ROLLBACK password enable flag, default is false | -o pattern.efuse //output pattern file name | |--key prepare | |-1. RSA key //root RSA key which will be stored in EFUSE and one of them will be used to sign the user RSA key | | //PEM format only | |-2. AES key //AES key which will be stored in EFUSE and it will be used for BL2 scramble | | //32 bytes binary file | |--password process | |-1. tool amlpwdefs dedicated to generate the corresponding pattern with password & salt | |- ./amlpwdefs --password password.bin --salt salt.bin //get output is password.bin_PMMMMMMMM_SNNNNNNNN.bin | |--NOTE: above EFUSE pattern generate process can be used separately, this is no dependence for all of them | FOLDER ARCHITECTURE: ------------Script Signing Tool Set folder------------ |-1. signing-tool-gxl //D: tool set for signing -- DO NOT MODIFY |-2. signing-tool-gxl-dev //D: tool set for signing -- DO NOT MODIFY |-3. amlogic-sign-gxl.sh //F: tool for signing GXL/TXLX/AXG -- DO NOT MODIFY |-4. signing-tool-g12a //D: tool set for signing -- DO NOT MODIFY |-5. signing-tool-g12a-dev //D: tool set for signing -- DO NOT MODIFY |-6. amlogic-sign-g12a.sh //F: tool for signing G12A/B -- DO NOT MODIFY |-7. sign.sh //F: tool for signing -- DO NOT MODIFY |-8. key.create.bash //F: tool for key generate -- DO NOT MODIFY |-9. amlpwdefs //F: tool for generate pattern with password binnary image(4byes -- 16bytes) & salt binary image(4bytes) -- DO NOT MODIFY |-10. efuse.sh //F: tool for EFUSE pattern process -- DO NOT MODIFY |-11. readme.txt //F: it is me |-12. signing-tool-tl1 //D: tool set for signing -- DO NOT MODIFY |-13. signing-tool-tl1-dev //D: tool set for signing -- DO NOT MODIFY |-14. amlogic-sign-tl1.sh //F: tool for signing TL1/TM2 -- DO NOT MODIFY |-15. signing-tool-c1 //D: tool set for signing -- DO NOT MODIFY |-16. signing-tool-c1-dev //D: tool set for signing -- DO NOT MODIFY |-17. amlogic-sign-c1.sh //F: tool for signing C1/T5/T5D/T5W/TXHD2 -- DO NOT MODIFY ------------User defined file folder------------ |-input //input for script signing tool, support set with -p inputfolder | | | |--bl2_new.bin //bl2 -- must for uboot | |--bl30_new.bin //bl30 -- must for uboot | |--bl31.img //bl31 -- must for uboot | |--bl33.bin //bl33 -- must for uboot | |--bl32.img //bl32 -- optional for uboot | |--boot.img //boot -- must for kernel | |--recovery.img //recovery -- must for recovery | |--dt.img //dt -- must for dtb | |-key //input for script signing tool, support set with -r rsakeyfolder and -a aeskeyfolder | | | |--root.pem //root RSA key -- must for uboot,must come from root0/1/2/3 | |--root0.pem //root RSA key0 -- must for uboot | |--root1.pem //root RSA key1 -- must for uboot | |--root2.pem //root RSA key2 -- must for uboot | |--root3.pem //root RSA key3 -- must for uboot | |--bl2.pem //bl2 RSA key -- must for uboot | |--bl2aesiv //bl2 aes key IV -- must for uboot | |--bl2aeskey //bl2 aes key -- must for uboot | |--bl3xkey.pem //bl3x RSA key -- must for uboot | |--bl3xaesiv //bl3x aes key IV -- must for uboot | |--bl3xaekey //bl3x aes key -- must for uboot | |--kernelkey.pem //RSA key -- must for kernel/recovery/dtb | |--kernelaesiv //aes key IV -- must for kernel/recovery/dtb | |--kernelaeskey //aes key -- must for kernel/recovery/dtb | | |-output //input for script signing tool, support set with -o outputfolder | | | |--pattern.efuse //EFUSE pattern for secure boot & usb boot (optional, include the usb password if file usb.password.hash.bin exit in the key folder) | |--pattern.secureboot.efuse //EFUSE pattern for secure boot only | |--pattern.usb.efuse //EFUSE pattern for usb boot only (auto generate if usb.password.hash.bin does exist in the key folder) | |--u-boot.bin.signed.encrypted //signed uboot for NAND/SPI/eMMC | |--u-boot.bin.usb.bl2.signed.encrypted //signed BL2 for usb boot only | |--u-boot.bin.usb.tpl.signed.encrypted //signed TPL for usb boot only | |--u-boot.bin.signed.encrypted.sd.bin //signed uboot for SD card boot only | |--boot.img.encrypt //signed kernel image | |--recovery.img.encrypt //signed recovery image | |--dtb.img.encrypt //signed dtb image