LM
/
u-boot
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

MLK-20916-2: doc: imx: ahab: Update AHAB document to include ahab_status command 

Since commit cf2acc5b7c ("MLK-18942-2 imx8: ahab: Add ahab_status
 command") the U-Boot is able to display and parse the SECO events.

Update AHAB guides to use U-Boot ahab_status command instead of
SCFW CLI.

Starting in SECO FW v0.2.0 engineering release an invalid image
integrity is logged as an event in open mode. As ahab_status
is able to return this event the note can be removed.

Signed-off-by: Breno Lima <breno.lima@nxp.com>
Reviewed-by: Ye Li <ye.li@nxp.com>
(cherry picked from commit 385ed19051a47f5858e8d326e5ee97f8a08a679d)
This commit is contained in:
Breno Lima 2019-02-12 14:51:12 -02:00 committed by Ye Li
parent 6279960ae5
commit a52ac63177
2 changed files with 37 additions and 27 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
doc/imx/ahab/guides/mx8_mx8x_secure_boot.txt
View File

@ -268,24 +268,29 @@ The U-Boot fuse tool can be used for programming eFuses on i.MX SoCs.
------------------------- -------------------------
If the fuses have been written properly, there should be no SECO events after If the fuses have been written properly, there should be no SECO events after
boot. To validate this, power on the board, and run the following command on boot. To validate this, power on the board, and run ahab_status command on
the SCFW terminal: U-Boot terminal.
>$ seco events No events should be returned after this command:
Nothing should be returned after this command. If you get an error, please => ahab_status
refer to examples below: Lifecycle: 0x0020, NXP closed
0x0087EE00 = The container image is not signed. No SECO Events Found!
0x0087FA00 = The container image was signed with wrong key which are not
matching the OTP SRK hashes.
In case your SRK fuses are not programmed yet the event 0x0087FA00 may also U-Boot will decode the SECO events and provide more details on the failure,
be displayed. for example in case container image was signed with wrong keys and are not
matching the OTP SRK hashes:
Note: The SECO FW v1.1.0 is not logging an invalid image integrity as an event => ahab_status
in open mode, in case your image does not boot after moving the lifecycle Lifecycle: 0x0020, NXP closed
please review your image setup.
SECO Event[0] = 0x0087EE00
CMD = AHAB_AUTH_CONTAINER_REQ (0x87)
IND = AHAB_NO_AUTHENTICATION_IND (0xEE)
Note: In case your SRK fuses are not programmed yet the event 0x0087FA00 may
also be displayed.
1.5.6 Close the device 1.5.6 Close the device
----------------------- -----------------------

33
doc/imx/ahab/guides/mx8_mx8x_spl_secure_boot.txt
View File

@ -309,25 +309,30 @@ The U-Boot fuse tool can be used for programming eFuses on i.MX SoCs.
1.7 Verify SECO events 1.7 Verify SECO events
----------------------- -----------------------
If the fuses have been written properly, there should be no SECO events If the fuses have been written properly, there should be no SECO events after
after boot. To validate this, power on the board, and run the following boot. To validate this, power on the board, and run ahab_status command on
command on the SCFW terminal: U-Boot terminal.
>$ seco events No events should be returned after this command:
Nothing should be returned after this command. If you get an error, please => ahab_status
refer to examples below: Lifecycle: 0x0020, NXP closed
0x0087EE00 = The container image is not signed. No SECO Events Found!
0x0087FA00 = The container image was signed with wrong key which are not
matching the OTP SRK hashes.
In case your SRK fuses are not programmed yet the event 0x0087FA00 may also U-Boot will decode the SECO events and provide more details on the failure,
be displayed. for example in case container image was signed with wrong keys and are not
matching the OTP SRK hashes:
Note: The SECO FW v1.1.0 is not logging an invalid image integrity as an event => ahab_status
in open mode, in case your image does not boot after moving the lifecycle Lifecycle: 0x0020, NXP closed
please review your image setup.
SECO Event[0] = 0x0087EE00
CMD = AHAB_AUTH_CONTAINER_REQ (0x87)
IND = AHAB_NO_AUTHENTICATION_IND (0xEE)
Note: In case your SRK fuses are not programmed yet the event 0x0087FA00 may
also be displayed.
1.8 Close the device 1.8 Close the device
--------------------- ---------------------