Hardware-Enforced Secure Boot: Signature Verification before Reset Release

Secure Boot guarantees that an ECU executes only authentic, OEM-signed firmware. The sequence begins in immutable Mask ROM (the Root-of-Trust for Verification):

1. On hardware reset, the primary CPU is held in reset while the HSM core boots from internal ROM. 2. The HSM reads the Secondary Bootloader (SBL) from flash memory and verifies its digital signature (Ed25519 or RSA-3072) against public keys burned into one-time programmable (OTP) fuses. 3. If the signature is valid, the HSM releases the primary CPU to execute the SBL. 4. The SBL in turn requests the HSM to verify the main operating system image and application partitions before execution. 5. If verification fails, the ECU enters a secure fallback recovery mode, refusing to execute untrusted code.