Your observations are as expected and are not an indication of an
encryption failure. Secure Boot image encapsulation
script does not perform encryption-in-place of the root filesystem
and/or Linux kernel, it is not an encrypted filesystem implementation.
It only exercises the hardware encryption engine
to create special binary structures called blobs. You can find details
about this feature in LS1043SECRM, Section 12.6. This blob binary
can be stored in Flash or on SD card or in any other memory. Conversely, the
decapsulation script reads a blob and unencrypts it to memory, so
the confidentiality boot scenario is a flavour of ramboot. The
original unencrypted images are not erased, although they are not
used after the encapsulation script have created and
saved the blobs necessary for booting. If your decapsulation
script does not return any errors and lets your system boot out of the
decapsulated images, it is a sufficient indication that everything
works properly.
Have a great day,
Platon
-------------------------------------------------------------------------------
Note:
- If this post answers your question, please click the "Mark Correct" button. Thank you!
- We are following threads for 7 weeks after the last post, later replies are ignored
Please open a new thread and refer to the closed one, if you have a related question at a later point in time.
-------------------------------------------------------------------------------
