4 posts tagged cst, newest first.
The same kernel-signing procedure as track A, on a different build — and it passed first time, because the two things that went wrong last time were checked rather than assumed. A 691,712-byte padding gap, and a signed range that goes through the IVT.
Extending the chain from the bootloader to the kernel. The first signed Image failed with HAB_INV_ASSERTION — because I read NXP's own diagram literally and stopped the signed range one IVT short. How I decoded the event by hand and found the off-by-32-bytes.
Enabling CONFIG_IMX_HAB overflowed the SPL's SRAM budget by 10,440 bytes. Fixing that, computing the real CSF insertion offsets from the build's own binman node rather than NXP's generic one, signing with cst, and getting 'No HAB Events Found!' on hardware.
Getting CST, generating the thirteen-key HAB PKI tree with hab4_pki_tree.sh, and building the SRK table and its fuse hash with srktool. Including the thing that script does silently if you do not read it first: it invents a passphrase for you, and the passphrase is 'test'.