AHAB: validating signed OS container

OlegHahm — Wed, 01 Sep 2021 11:19:20 GMT

Hi there,

I've managed successfully to create signed container files that will boot (mostly following https://source.codeaurora.org/external/imx/uboot-imx/tree/doc/imx/ahab/guides/mx8_mx8x_secure_boot.txt and https://source.codeaurora.org/external/imx/uboot-imx/tree/doc/imx/ahab/guides/mx8_mx8x_spl_secure_boot.txt) without any SECO events after programming the fuses.

However, when I boot the signed Linux container, it will boot even if I have signed it with the wrong keys. I haven't yet closed the device, but I would have expected some sort of warning or the like anyway. Is there any way to check whether the authentication of the kernel container was successful or not without closing the device?

Re: AHAB: validating signed OS container

igorpadykov — Tue, 14 Sep 2021 07:47:30 GMT

Hi Oliver

answer from team:

---------------------

If your test chip is not closed, then even the os container authentication failed, it won't effect the kernal boot.

For os container, you can authenticate it by "auth_cntr addr" command in uboot.

Then after run the command, you can use ahab_status to see if there are increasing ahab events, which is caused by authenticating os container, then you can know if the os container is signed correctly or not.

---------------------

Best regards
igor

topic Re: AHAB: validating signed OS container in i.MX Processors

AHAB: validating signed OS container

Re: AHAB: validating signed OS container