Part 3: The Root Filesystem (dm-verity) extended the chain of trust from the hardware root of trust to the root filesystem. The EdgeLock Enclave (ELE) authenticates the bootloader chain under AHAB,...
In Part 2: The Kernel (Signed FIT), we extended the chain of trust from U-Boot to the Linux kernel. U-Boot verifies the FIT configuration signature, then verifies the kernel and device tree against...
In Part 1: The Bootloader Chain (AHAB), we built the first part of the chain of trust. The Boot ROM loaded the ELE firmware, the ELE ROM authenticated the ELE firmware against NXP’s fused SRK hash ...
A device is only as trustworthy as the software it boots. If an attacker can replace the earliest boot software stored on the boot media, every later stage of the system can no longer be trusted be...
Falcon Mode is often described as a way to cut boot time. But how much does it actually save? I enabled it on an FRDM-IMX93 (Yocto BSP lf-6.18.2, image imx-image-core, eMMC) and compared it against...
Over the last weeks, I dedicated myself to adding support for the RISC-V based OrangePi RV2 SBC (Single Board Computer) to the meta-riscv layer in the Yocto Project. Curious about the implement...
What is OTA (Over-The-Air) update? Over-the-air (OTA) means of remotely updating the firmware, software, operating system of a device over the internet connection. OTA is particularly common in se...
Exciting news to share! Today, I reached my 100th contribution which is a significant milestone in my journey with the Yocto Project and OpenEmbedded. While my contribution may not be groundbreakin...