HABv4 Secure Boot - HAB_EVENT on Apalis iMX6

Technical Support
1

Hi Toradex Team,

I am working on enabling HABv4 Secure Boot on an Apalis iMX6 using the Toradex BSP (Yocto 7.7, U-Boot 2024.07).

Steps performed

  1. Built the standard tdx-reference-multimedia-image successfully.

  2. Generated CST keys and certificates.

  3. Enabled Secure Boot in local.conf using:

    • tdx-signed

    • imx-hab

    • TDX_SECURE_BOOT = "1"

    • TDX_IMX_HAB_ENABLE = "1"

    • FIT image signing (UBOOT_SIGN_ENABLE, FIT_SIGN_ENABLE, UBOOT_HAB_ENABLE)

    • Kernel FIT image generation.

  4. Rebuilt the image successfully.

  5. Verified the following BitBake variables:

    • TDX_SECURE_BOOT=1

    • TDX_IMX_HAB_ENABLE=1

    • UBOOT_SIGN_ENABLE=1

    • UBOOT_HAB_ENABLE=1

    • FIT_SIGN_ENABLE=1

  6. Verified the generated U-Boot .config contains:

    • CONFIG_FIT=y

    • CONFIG_FIT_SIGNATURE=y

    • CONFIG_RSA=y

    • CONFIG_RSA_VERIFY=y

    • CONFIG_SHA256=y

  7. Verified that the build generated:

    • u-boot-ivt.img

    • u-boot.dtb-signed

    • csf_uboot.bin

    • csf_uboot.csf

    • csf_SPL.bin

    • csf_SPL.csf

  8. Verified log.do_uboot_assemble_fitimage, which shows:

    • FIT signature generated successfully

    • Signature check OK

    • HAB Blocks generated

    • CSF generated successfully

    • CSF appended to both U-Boot and SPL

The image was then flashed using the Toradex Easy Installer image (Apalis-iMX6_Reference-Multimedia-Image-upstream-Tezi_*.tar).

Current issue

Running hab_status in U-Boot gives:

Secure boot disabled

HAB Configuration: 0xf0
HAB State: 0x66

STS = HAB_WARNING (0x69)
RSN = HAB_ENG_FAIL (0x30)
CTX = HAB_CTX_ENTRY (0xE1)
ENG = HAB_ENG_CAAM (0x1D)

how can i solve this hab_event

2

Hi, I’m the Toradex AI Assistant.

I might make mistakes or occasionally get you wrong. Our support team will step in if needed.

The HAB event you’re seeing (HAB_ENG_FAIL with HAB_ENG_CAAM) typically indicates a CAAM (Cryptographic Acceleration and Assurance Module) initialization issue during the secure boot process(1). This is a common issue when Secure Boot is not yet fully enabled (fuses not blown) but signed images are being used.

Key Points to Address

1. Verify Your Setup

Before proceeding, could you confirm:

  • Which exact version of Yocto/BSP 7.x are you running? (e.g., BSP 7.3.0, 7.2.0)
  • Have you blown the SRK fuses yet? The HAB status shows “Secure boot disabled” which suggests the SoC is still in open configuration.

2. Understanding the HAB Event

The error you’re seeing:

  • STS = HAB_WARNING (0x69) - Warning status
  • RSN = HAB_ENG_FAIL (0x30) - Engine failure
  • CTX = HAB_CTX_ENTRY (0xE1) - Entry context
  • ENG = HAB_ENG_CAAM (0x1D) - CAAM engine

This typically occurs when:

  1. The device is in open configuration (SRK fuses not blown) but trying to verify signed images
  2. CAAM initialization fails during the secure boot authentication process

3. Next Steps

Verify SRK Fuse Programming

You need to program the SRK fuses to fully enable Secure Boot. The build process should have generated SRK_1_2_3_4_fuse.bin(2).

To program the fuses, you’ll need to use U-Boot commands. However, this is an irreversible operation - once fuses are blown, the device will only boot signed images(1).

Check CSF Generation

From your build logs, verify that:

  • CSF files were generated correctly for both U-Boot and SPL
  • The signing process completed without errors
  • The correct certificates were used (SRK, CSF, IMG certificates)(2)

Verify Image Signing

Ensure your local.conf includes the correct paths to your CST keys:

  • TDX_IMX_HAB_CST_SRK - Path to SRK table
  • TDX_IMX_HAB_CST_CSF_CERT - Path to CSF certificate
  • TDX_IMX_HAB_CST_IMG_CERT - Path to IMG certificate(2)

4. Testing Before Fuse Programming

Before blowing fuses, you can test the signed images in open mode. The HAB warning you’re seeing may be expected behavior when Secure Boot is not yet fully closed.

5. Additional Resources

For detailed guidance on the complete Secure Boot setup process, including fuse programming procedures, refer to the meta-toradex-security layer documentation and NXP’s HAB documentation.

Could you confirm whether you’ve already programmed the SRK fuses, and share any additional error messages from the U-Boot console during boot?

Best regards,
Toradex AI Assistant.

Did you like my answer? :+1: :-1:

If I answered your question, please tick the “Solution” checkbox.

For follow-up questions to me, please use @ToradexAI in your post.

3

Greetings @sowmika26,

This is a known HAB event on i.MX6 based modules, as documented here: Integrate Secure Boot on Torizon OS | Toradex Developer Center

In short, it should still be safe to close the device when seeing this specific HAB event. Unfortunately there’s no way to remove this, so you’ll just have to know that this specific event is alright.

If you have any concerns, or in-depth questions about this event I’d recommend asking NXP. As the cause is really on the chip level.

Best Regards,
Jeremias