4、证书链概念:证书链的组成、信任根、中间证书、叶子证书,以及证书链验证过程

在Secure Boot的密钥管理体系中,证书链(Certificate Chain)是建立从硬件信任根到最终签名实体之间信任关系的核心机制。理解证书链的组成与验证逻辑,是配置安全启动策略、排查签名验证失败问题的基础。本章将深入剖析证书链的四个关键层次——信任根、中间证书、叶子证书,以及它们之间的验证路径,并结合实际场景说明验证过程的每一步骤。

信任根 (Root) 自签名证书 硬件烧录 / 固件内置 信任锚点 中间证书 (Intermediate) 由根证书签发 可多层嵌套 用于隔离与轮换 叶子证书 (Leaf) 签名Bootloader/内核 或用于代码签名 私钥受硬件保护 签发 签发 验证方向:从叶子到根 证书链验证四步 ① 叶子证书签名验证 ② 中间证书签名验证 ③ 根证书自签名验证 ④ 有效期/用途/吊销状态检查

上图展示了证书链的基本结构:信任根位于最顶层,中间证书位于中间层,叶子证书位于最底层。验证方向与签发方向相反,从叶子证书开始逐级向上回溯至信任根。下面我们将详细拆解每一层的职责与验证细节。

4.1 证书链的组成:三层模型与职责划分

4.1.1 信任根(Root of Trust)

信任根是证书链的锚点,通常以自签名证书(Self-Signed Certificate)形式存在。在Secure Boot场景中,信任根的公钥被硬件烧录(如一次性可编程存储器OTP)或固件内置,作为系统启动时第一个被信任的实体。信任根没有上级签发者,其签名由自身私钥完成,因此验证信任根时只需检查其自签名是否有效,并确认该证书是否在系统预设的信任库中。

信任根的核心属性包括:

  • 不可变性:信任根一旦烧录,通常无法通过软件更新修改,除非硬件支持安全升级机制。
  • 密钥长度:推荐使用RSA-4096或ECC P-384及以上强度,确保抗量子计算攻击的长期安全性。
  • 存储位置:位于SoC内部的OTP、eFuse或安全元件(Secure Element)中,防止被读取或篡改。
经验提醒:在量产阶段,信任根密钥对的生成必须在离线、物理隔离的环境中进行,并由多人分权保管私钥分片。私钥一旦泄露,整个产品线的安全启动体系将形同虚设。

4.1.2 中间证书(Intermediate Certificate)

中间证书由信任根签发,用于在信任根与叶子证书之间建立缓冲层。引入中间证书的主要目的包括:

  • 密钥隔离:信任根私钥可以保持离线状态,日常签名操作使用中间证书私钥,降低根私钥暴露风险。
  • 灵活轮换:当中间证书私钥疑似泄露时,只需吊销该中间证书并签发新的中间证书,无需更换硬件信任根。
  • 多级扩展:中间证书可以继续签发下一级中间证书,形成多级链,适用于复杂组织架构(如OEM→ODM→供应商)。

中间证书的签发需要包含正确的基本约束(Basic Constraints)扩展项,其中CA=true表示该证书可以签发下级证书,CA=false则只能作为叶子证书使用。同时,密钥用法(Key Usage)应设置为KeyCertSign和CRLSign,以明确其签发权限。

4.1.3 叶子证书(Leaf Certificate)

叶子证书是证书链的末端实体,用于实际签名Bootloader、内核镜像、设备固件或应用代码。叶子证书的私钥通常存储在HSM(硬件安全模块)或TEE(可信执行环境)中,签名操作在硬件内部完成,私钥不可导出。叶子证书的CA标志必须为false,且扩展密钥用法(Extended Key Usage)应明确为CodeSigning或SecureBoot,防止证书被滥用。

证书类型 签发者 CA标志 典型用途 私钥存储
信任根 自身(自签名) true 信任锚点,签发中间证书 离线HSM / 硬件OTP
中间证书 信任根 true 签发叶子证书,隔离根密钥 在线HSM / 安全服务器
叶子证书 中间证书 false 签名Bootloader/内核/固件 设备内TEE / 本地HSM

4.2 证书链验证过程:从叶子到根的回溯

4.2.1 验证的核心原理

证书链验证的本质是签名逐级验证:验证者使用上一级证书的公钥,验证下一级证书的签名是否有效。具体流程如下:

  1. 构造证书链:从叶子证书开始,根据签发者名称(Issuer)查找上一级证书,直到找到信任根。
  2. 逐级验签:使用信任根公钥验证中间证书签名,再使用中间证书公钥验证叶子证书签名。
  3. 完整性检查:检查每张证书的有效期、吊销状态(CRL/OCSP)、密钥用法和基本约束。
  4. 信任锚确认:确认链顶端的证书确实存在于系统信任库中,且未被篡改。

在Secure Boot中,验证过程通常由BootROM或早期启动代码完成。BootROM中固化了信任根公钥的哈希值,验证时先计算待验证证书的哈希并与存储值比对,再执行签名验证。

4.2.2 验证过程中的关键检查项

  • 签名算法匹配:证书签名算法必须与签发者公钥算法一致(如SHA256WithRSA)。
  • 有效期检查:当前时间必须在每张证书的notBefore和notAfter之间。
  • 吊销状态:通过CRL(证书吊销列表)或OCSP(在线证书状态协议)检查证书是否被吊销。
  • 路径长度约束:中间证书的pathLenConstraint限制了其下可嵌套的中间证书数量。
  • 名称链一致性:每张证书的Issuer字段必须与上一级证书的Subject字段完全匹配。
风险提示:如果信任根证书的哈希值在BootROM中存储错误,或者中间证书的CA标志被错误设置为false,会导致整条链验证失败。此类问题在开发阶段极难排查,建议在生成证书时使用自动化脚本强制校验这些字段。

4.3 案例拆解:U-Boot Secure Boot证书链配置实战

以某基于ARM64架构的嵌入式设备为例,该设备使用U-Boot作为Bootloader,并启用了Secure Boot功能。初始现象是:设备在启动时反复进入恢复模式,串口日志显示Authentication failed。以下是完整的排查与解决过程。

4.3.1 背景与约束

  • 硬件平台:NXP i.MX8M Plus,支持HAB(High Assurance Boot)安全启动。
  • 信任根:烧录在eFuse中的RSA-4096公钥哈希。
  • 证书链结构:根证书 → 中间证书(OEM专用) → 叶子证书(用于签名U-Boot镜像)。
  • 目标:确保仅运行由OEM签名的U-Boot镜像。

4.3.2 初始现象与日志分析

串口输出关键日志:

HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: HAB_CMD_BLOCK_DATA
HAB: Event 0xdb: