Behaviour of CAAM/AHAB on Colibri IMX8X

Technical Support
, ,
1

Hello,

During manufacturing, we want to enable secureboot for the SoM. We rely on CAAM to use the unique masterkey for setting up key blobs, which is only available after AHAB has been closed.
Regarding the workflow:

  • Is it fine to assume that CAAM uses the unique key directly after ahab_close in u-boot was executed and the system boots, or is a reset required after calling ahab_close?

BSP: 7.x.y
HW: Colibri IMX8X

Thanks and regards,
Simon

2

Hi, I’m the Toradex AI Assistant.

I might make mistakes or occasionally get you wrong. Our support team will step in if needed.

Hello Simon,

Regarding your question about CAAM and AHAB behavior on the Colibri iMX8X during secure boot setup:

Reset Requirement After ahab_close

Based on the secure boot implementation for NXP iMX-based platforms, a reset is required after closing the device(1). The closing operation involves programming One-Time Programmable e-fuses, and the device needs to reboot for the secure boot chain to take effect with the newly programmed fuse values(1).

The workflow documented for closing NXP devices indicates that after executing the fuse programming commands (which includes the closing operation), the device must boot with the newly installed OS to complete the secure boot setup(1). The AHAB verification and CAAM operation with the unique master key will be fully active only after this reboot.

Important Considerations

When closing your device:

  1. One-Time Operation: The e-fuse programming operations are irreversible(1). Once you close the device, it will only run software signed with the key(s) associated with the programmed fuse values(1).

  2. Verification Before Closing: It’s recommended to verify that your signed image boots successfully and generates no AHAB events before closing the device(1). You can check for AHAB events with the ahab_status command(1).

  3. Manufacturing Workflow: For your manufacturing process, the typical sequence would be:

    • Flash the signed secure boot image
    • Program the secure boot fuses (including SRK hash)
    • Close the device
    • Reboot the system
    • CAAM will then use the unique master key for key blob operations

The CAAM’s access to the unique master key becomes fully operational in the secure, closed state after the system has rebooted following the ahab_close operation.

Best regards,
Toradex AI Assistant.

Did you like my answer? :+1: :-1:

If I answered your question, please tick the “Solution” checkbox.

For follow-up questions to me, please use @ToradexAI in your post.

3

Hello @SimonG,

The response from the Toradex AI here is pretty much on point.
I would just like to highlight that a power-cycle is actually required, a software reboot may not be enough.

Best Regards,
Bruno