7 posts tagged hab, newest first.
The signed Nerves firmware boots. And a finding that deleted an open task: enabling CONFIG_IMX_HAB wires an automatic fail-closed authentication gate into booti itself, for every kernel boot, with no bootcmd changes at all. Plus a fleet gotcha about who can SSH in.
The same kernel-signing procedure as track A, on a different build — and it passed first time, because the two things that went wrong last time were checked rather than assumed. A 691,712-byte padding gap, and a signed range that goes through the IVT.
Two fuse writes stand between a signed board and a locked one: the SRK hash, and the bit that makes the chip refuse unsigned code. Both are permanent. Here is exactly what they are, how to read their current state, and why I have not burned either.
Extending the chain from the bootloader to the kernel. The first signed Image failed with HAB_INV_ASSERTION — because I read NXP's own diagram literally and stopped the signed range one IVT short. How I decoded the event by hand and found the off-by-32-bytes.
Enabling CONFIG_IMX_HAB overflowed the SPL's SRAM budget by 10,440 bytes. Fixing that, computing the real CSF insertion offsets from the build's own binman node rather than NXP's generic one, signing with cst, and getting 'No HAB Events Found!' on hardware.
Getting CST, generating the thirteen-key HAB PKI tree with hab4_pki_tree.sh, and building the SRK table and its fuse hash with srktool. Including the thing that script does silently if you do not read it first: it invents a passphrase for you, and the passphrase is 'test'.
Why i.MX8M secure boot needs thirteen key pairs rather than one, what 'open' and 'closed' actually mean, and which single 256-bit value ends up permanently burned into the chip. The concepts, before any tool touches anything.