Secure boot on an i.MX8M gateway

Adding proper secure boot to an industrial IoT gateway, on a disposable lab unit, making every mistake where it costs nothing.

Ten parts, written while doing it. A deliberately disposable lab unit, kept wide open, so every mistake could happen somewhere safe. Each part builds on the one before.

Part 1
4 min

The hardware: an i.MX8M gateway with a TPM

I want to start a small series about a project I've been doing on the side: adding proper secure boot to an industrial IoT gateway I work with.

Part 2
4 min

Understanding HAB keys: SRK, CSF and the fuses

In the last post I talked about the hardware. Before touching any actual tool, I wanted to properly understand the cryptography underneath it, because I've…

Part 3
4 min

Generating HAB keys with NXP's CST

Last time I wrote about the theory — the CA, the four SRK keys, the CSF/IMG pairs underneath each one.

Part 4
4 min

Backing up the eMMC before touching anything

I promised myself one rule at the start of this project: before doing anything to the actual device that isn't trivially undoable, I would have complete,…

Part 5
4 min

Getting the U-Boot build environment exactly right

With backups done and the keys generated, the next real milestone is building an actual bootloader from source — first completely unsigned, just to prove the…

Part 6
6 min

Building the first unsigned bootloader

Last time I wrote about pinning the exact versions of everything a bootloader build for this board actually needs.

Part 7
14 min

A real mistake, and rescuing myself from it

Last post ended with a successful flash and a promise to report back honestly on whether the board actually booted. Here's the honest report: it didn't.

Part 8
7 min

Turning on secure boot, for real this time

A quick note before this post, an update on the note that used to open it: when I first wrote this, it was a roadmap — a plan for what I was about to try,…

Part 9
5 min

Signing the kernel, and a bug the chip caught

Last post ended with the bootloader itself signed, flashed, and proven — a built-in status check on the chip confirmed it accepts the signed version and…

Part 10
5 min

From here to the end: what is left to lock down

Everything so far has been reversible in every way that matters. Files, builds, signatures, even flashing a new bootloader or kernel onto the board — all of it…