linux

13 posts tagged linux, newest first.

Tagged linux

13 posts
23 Sep 2026
9 min

dm-verity on a signed rootfs, and two console messages that were simply untrue

You cannot put a filesystem's hash inside that filesystem. Two U-Boot messages that were lies — “press any key to stop autoboot” when no key worked, and quotes vanishing from the kernel command line. Four attempts, three instructive failures, and a hardware SHA engine I did not know I was using.

dm-verityembeddedlinuxsecure-bootstm32mp1u-boot
23 Sep 2026
5 min

Breaking dm-verity on purpose: one bit in 52 MB, and the board refuses

The negative test that proves the chain is real: flip a single bit in a 52 MB root filesystem, get `data block 0 is corrupted`, and watch the board refuse. Why you cannot sabotage your own firmware the two obvious ways.

dm-verityembeddedlinuxsecure-bootstm32mp1testing
23 Sep 2026
6 min

Moving the kernel out of the rootfs, and feeding the bootloader garbage

The hash of a filesystem cannot live inside it, so the kernel had to move somewhere signed. Then the two-command test: hand the bootloader rubbish and watch the kernel ignore it entirely. What that cost, and where the chain now ends.

dm-verityembeddedlinuxsecure-bootstm32mp1u-boot
21 Sep 2026
11 min

Signing the kernel with a FIT image, and the escape hatch that makes it theatre

You cannot sign a zImage. Why the signature goes on the FIT configuration rather than the kernel, the escape hatch that turns the whole thing into theatre, why the negative test needed two tampered images and not one, and the three ways the test lied to me.

embeddedfitlinuxsecure-bootstm32mp1u-boot
18 Sep 2026
7 min

Signing BL2 and the FIP tamper test: one bit flipped, EAUTH, clean halt

TF-A verifying the next stage against a certificate chain inside the FIP — software, on blank fuses, refusing for real. Flipping one bit produced EAUTH on BL33 and a clean halt. Plus the honest limits of what that proves.

embeddedlinuxsecure-bootstm32mp1tf-a
16 Sep 2026
8 min

Why I am not burning the fuses on an STM32MP157F-DK2

Secure boot on this chip comes down to 32 bytes in one-time-programmable memory, and a bit you can never un-blow. I started the project with a rule forbidding its own last step — and three of the four links in the chain turn out to enforce for real on completely blank silicon.

embeddedlinuxsecure-bootstm32mp1tf-a
24 Aug 2026
6 min

Provisioning the next board

The repeatable runbook, and the reason flashing a pre-made image left me with a 512 MB data partition instead of 28 gigabytes.

embeddedfwupimx8linuxnerves
17 Aug 2026
5 min

Ran out all six config attempts

The board flashed perfectly and never reached Linux. A Kconfig choice split upstream had silently retargeted my bootloader at the wrong DRAM.

embeddedimx8linuxnervesu-boot
10 Aug 2026
6 min

Flashing without the vendor's flashing tool

NXP's uuu dies at 8% on an Apple Silicon Mac. The board's own U-Boot has ums and fastboot, and those use bulk USB, which works fine.

embeddedimx8linuxnervesu-boot
27 Apr 2026
6 min

Signing the kernel, and a HAB failure the chip caught

Extending the chain from the bootloader to the kernel. The first signed Image failed with HAB_INV_ASSERTION — because I read NXP's own diagram literally and stopped the signed range one IVT short. How I decoded the event by hand and found the off-by-32-bytes.

cstembeddedhabimx8kernellinuxsecure-boot
13 Apr 2026
14 min

The board stopped booting: LPDDR4 training, and recovering an IOT-DIN-IMX8PLUS over USB

My imx-boot build failed LPDDR4 training and the gateway stopped booting before U-Boot. The cause was one Kconfig symbol. Recovering it took days, because uuu's SDP mode does not work on Apple Silicon and the board has two identical-looking micro-USB ports.

embeddedfastbootimx8linuxsecure-bootu-bootuuu
23 Mar 2026
7 min

Backing up the eMMC: boot partitions, rootfs, and the force_ro trap

Before touching a bootloader, take a backup you can actually restore from. On an i.MX8M Plus that means four separate things, two of which a dd of the main device silently misses — and one that is not block data at all.

backupddembeddedemmcimx8linuxsecure-boot
02 Mar 2026
7 min

The hardware: a CompuLab IOT-DIN-IMX8PLUS, and how to confirm what you actually have

What you need to follow this series: a CompuLab IOT-DIN-IMX8PLUS industrial gateway on an NXP i.MX8M Plus, a serial cable, and a spare unit you are willing to break. Plus the commands to confirm which variant you have, because it decides what you build.

compulabembeddedhardwareimx8linuxsecure-boot