Audit SPL as its own verifier binary. A main U-Boot build that supports FIT signatures does not establish that SPL authenticates the next image before executing it. The useful evidence is a chain from resolved SPL configuration through linked code and consumed key policy to an observed SPL rejection. This procedure pins U-Boot v2024.10 and…
Audit the final boot-policy inputs, not only the signature on the executable image. A correctly verified kernel can receive command-line arguments assembled from a separate mutable source. If those arguments choose storage, initial userspace or security-relevant behavior, their authority belongs in the boot trust review. This guide uses U-Boot v2024.10’s common Linux device-tree setup and…
Trace the actual loader caller before relying on a FIT image’s phase property. The property is selection metadata, not a universal rule that every SPL or VPL path applies automatically. A correctly labelled image can remain unused, and an unlabelled image can be selected first. This article pins U-Boot v2024.10. It compares the generic fit_image_load()…
Authenticate the selected FIT configuration and its required image hashes when the approved unit is a kernel/device-tree combination. Individually signed components can establish who signed each component while leaving the relationship between them unprotected. A release review must therefore ask both “are these bytes approved?” and “is this combination approved?” This guide pins U-Boot v2024.10…
Read Linux suspend statistics before and after one controlled attempt, then correlate changed phase counters with callback logs. Historical last-failure fields are clues, not a fresh, atomic failure record. A recent wake event does not explain a failure that actually occurred while freezing tasks, preparing a device, or restoring it during unwind. Applicability: this article…
Use /sys/power/pm_wakeup_irq as a bounded attribution clue, then correlate it with the same suspend attempt’s trace and device evidence. In Linux v6.12 it exposes the current first recorded wake IRQ, not the interrupt armed first, an exhaustive event list, or proof of the physical cause of every wake. Applicability: this article pins Linux v6.12 wakeup.c,…
Represent external-input validity, battery capability, charging state, and system-rail continuity as separate facts. When USB or a battery is removed, recompute the operating state from fresh observations. A charger status pin is not a complete description of which source is sustaining the load or whether the processor remained within its supply limits. Applicability: the concrete…
Validate a voltage/frequency change as an ordered transaction with observable intermediate states. A final frequency readback cannot show whether the supply was prepared first, whether a later step failed, or whether software still describes the previous operating point. Review the exact transition implementation before designing the capture or recovery test. Applicability: this article pins Linux…
A device can be runtime-suspended while its shared power domain remains on. Test the device state and domain state separately, then identify the peer, subdomain, policy, or provider decision that keeps the domain active. Treating every successful device suspension as a domain power-off guarantee produces false failures and unsafe workarounds. Applicability: this article pins Linux…
Choose retained state by physical RAM section, not just by object size. A small record can straddle two independently controlled sections and require much more retained capacity than its byte count suggests. Decide what is worth preserving, map every byte to the selected device’s retention controls, and separately verify what startup does after wake. Applicability:…