Secure boot (Hive-M)

Full chain: eFUSE PPK hash → RSA-signed BOOT.bin (FSBL, PMUFW, ATF, u-boot, dtb via bootgen) → signed FIT (kernel + dtb) verified by u-boot → RAUC-signed rootfs → buildsign-signed update archives.

Detailed device-side documentation: sw/SECURE_BOOT.md in a hive-m project (template: src/templates/hive-m/sw/SECURE_BOOT.md).

Setup

buildhive secure-boot keygen        # generate keys/ (once)
# set "secure_boot": true in project.json (sw section)
buildhive build sw
buildhive secure-boot ppk-hash      # -> images/ppk0_hash.txt for eFUSE provisioning

Keys (keys/, gitignored)

FileTypeUse
psk.pemRSA-4096Primary secret key; PPK hash burned into eFUSEs.
ssk.pemRSA-4096Secondary secret key; signs BOOT.bin partitions.
fit.key / fit.crtRSA-2048, 30-year self-signed certFIT image signing; pubkey injected into u-boot control dtb.

keygen --force overwrites - devices fused to the old PSK become unbootable.

Effect of sw.secure_boot: true

  • Build fails if keys/psk.pem is missing.
  • require .../meta-ntl-hive/conf/secure-boot.conf added to local.conf. That conf sets SECURE_BOOT=1, the bootgen BIF (bh_auth_enable so signed images still boot unfused silicon; per-partition RSA authentication; bitstream deliberately unauthenticated), kernel-fitimage, UBOOT_SIGN_ENABLE=1, FIT_SIGN_ALG=rsa2048.
  • device-tree.bbappend injects the FIT public key into u-boot's control dtb with required="conf" - u-boot rejects unsigned FITs.
  • Update archive component set switches to raucb fitimage bootscr bootbin (signed FIT replaces raw Image/dtb).

sw.secure_boot: false strips the require line from local.conf on the next run.

eFUSE provisioning

secure-boot ppk-hash runs bootgen (-efuseppkbits) against the deployed FSBL and the PSK → images/ppk0_hash.txt. Burn PPK0 hash + RSA_EN per the device documentation. After RSA_EN is fused, the device only boots BOOT.bin images signed with the matching PSK/SSK.