2400284_en-US

[#1]

CONFIG_FIT_CIPHER=y alone causes hab_status

Hello Support,

CONFIG_FIT_CIPHER=y alone causes hab_status to report HAB_INV_SIGNATURE/HAB_INV_ASSERTION on i.MX8M Plus EVK (OPEN mode)

Board: i.MX8MP LPDDR4 EVK, OPEN/unfused (HAB Configuration: 0xf0, HAB State: 0x66)
U-Boot: 2024.04 (lf_v2024.04_6.6.52_2.2.x), NXP fork
HAB signing: working correctly otherwise — CST-signed imx-boot (SPL CSF + FIT CSF), custom build-time task that verifies the CSF tag byte at both embed offsets and fails the build on any mismatch (always passes)

I have a clean baseline where hab_status reports "No HAB Events Found!" on this board with my normal HAB-signed imx-boot. I recently added kernel FIT image signing + AES-256 encryption (a separate mechanism from HAB — U-Boot's own bootm verifying/decrypting a signed kernel FIT, keys embedded in u-boot.dtb, unrelated to SRK fuses). After enabling this, hab_status started reporting 4 events every boot:

HAB Configuration: 0xf0, HAB State: 0x66

HAB Event 1: STS=HAB_FAILURE RSN=HAB_INV_ASSERTION(0x0C) CTX=HAB_CTX_ASSERT(0xA0) ENG=HAB_ENG_ANY
HAB Event 2: STS=HAB_FAILURE RSN=HAB_INV_ASSERTION(0x0C) CTX=HAB_CTX_ASSERT(0xA0) ENG=HAB_ENG_ANY
HAB Event 3: STS=HAB_FAILURE RSN=HAB_INV_SIGNATURE(0x18) CTX=HAB_CTX_COMMAND(0xC0) ENG=HAB_ENG_ANY
HAB Event 4: STS=HAB_FAILURE RSN=HAB_INV_SIGNATURE(0x18) CTX=HAB_CTX_COMMAND(0xC0) ENG=HAB_ENG_ANY

I methodically bisected this with isolated rebuild+reflash tests, one variable at a time, confirmed on real hardware:

1. Baseline (existing HAB-signed imx-boot, no kernel-FIT work): 0 events
2. Full kernel-FIT feature enabled (FIT pubkey/AES-key DTB embedding + my own cmd/bootm.c patch + CONFIG_FIT_CIPHER=y + CONFIG_SYS_BOOTM_LEN=0x8000000): 4 events
3. Disabled FIT pubkey/AES-key DTB embedding alone: events still present, identical
4. Also removed my cmd/bootm.c patch: events still present, identical
5. Removed CONFIG_FIT_CIPHER=y + CONFIG_SYS_BOOTM_LEN=0x8000000 entirely (true pre-kernel-FIT baseline): 0 events, clean
6. Added back only CONFIG_SYS_BOOTM_LEN=0x8000000 (no CONFIG_FIT_CIPHER): 0 events, clean

The issue is isolated precisely to CONFIG_FIT_CIPHER=y — nothing else (my bootm.c patch, FIT pubkey/AES-key DTB embedding, CONFIG_SYS_BOOTM_LEN) matters alone or combined; only CONFIG_FIT_CIPHER=y flips hab_status from 0 events to these 4.

I double-checked that my own CSF computation is not the problem: my build-time signing task verifies the CSF tag byte at both embed offsets immediately after signing and fails the build on any mismatch — every build, with or without CONFIG_FIT_CIPHER, passes cleanly, and the computed SLD hab block address/FIT CSF offset are byte-identical across all test builds regardless of this config.

My best guess is CAAM Job Ring contention — CONFIG_FIT_CIPHER pulls in CONFIG_AES (no separate backend symbol needed on this U-Boot version), and this SoC's runtime dmesg confirms CAAM is genuinely used for AES/SHA elsewhere. The closest relevant documentation I found is doc/imx/habv4/guides/mx8m_secure_boot.txt's note about HAB pre-v4.4.0 locking Job Ring/DECO master ID registers in closed config, but that doesn't directly describe this OPEN-mode, CONFIG_FIT_CIPHER-specific case.

Questions:
1. Is this a known interaction between CONFIG_FIT_CIPHER and HABv4 CSF authentication on i.MX8M Plus? Is it CAAM-resource-related, or something else (e.g., compiled binary size/layout shifting a FIT CSF component boundary in a way my own self-check doesn't catch, since it verifies against the offset I computed, not what the ROM independently derives)?
2. Is CONFIG_FIT_CIPHER known-safe to combine with HABv4 CSF signing on this SoC at all, or is this a real limitation?
3. Are there any pointers to the correct CAAM Job Ring allocation/unlock sequence if that turns out to be the root cause?

Yocto ProjectRe: CONFIG_FIT_CIPHER=y alone causes hab_status

Posting this as solved in case it saves someone else the bisection — credit to [https://community.nxp.com/t5/i-MX-Processors/i-MX8MP-EVK-HABv4-hab-status-shows-HAB-FAILURE-before-f...] for the actual fix, which applied directly once I found it.

Symptom: clean baseline (hab_status reports "No HAB Events Found!") with our normal HAB-signed imx-boot. After enabling CONFIG_FIT_CIPHER=y (to support U-Boot decrypting an AES-256-encrypted kernel FIT image — a separate mechanism from HAB, unrelated to SRK fuses), hab_status started reporting 4 events every boot: 2× HAB_INV_ASSERTION, 2× HAB_INV_SIGNATURE.

Bisection: isolated every variable we'd changed, one at a time, rebuild+reflash+hab_status on real hardware each time — down to CONFIG_FIT_CIPHER=y alone (disabling FIT pubkey/AES-key DTB embedding, removing an unrelated cmd/bootm.c patch, keeping/dropping CONFIG_SYS_BOOTM_LEN — none of those mattered; only CONFIG_FIT_CIPHER did).

Root cause + fix: we build imx-boot via a custom Yocto task porting the manual HAB-signing workflow (parse SPL IVT, compute FIT component blocks via print_fit_hab.sh, sign with CST) into an automatic build step. That task assumed the DTB copy left in the build staging dir by mkimage_imx8's own build was already correctly 16-byte-aligned — not guaranteed for every config. CONFIG_FIT_CIPHER changes U-Boot proper's compiled DTB size, landing it on a non-aligned size in our case. A misaligned DTB silently shifts every subsequent FIT component boundary print_fit_hab.sh computes,so CST signs the wrong byte range. Our own build-time self-check (CSF tag byte present at the offset we computed) still passed cleanly every time — it wasn't checking against the ROM's independently correct notion of the boundary. Only real hardware caught it.

Fix, mirroring what worked in the other thread: explicitly run pad_image.sh (imx-mkimage's own script) on the DTB immediately before computing FIT component blocks, rather than trusting the staging directory's existing state. Confirmed genuinely padded (not a no-op), and hab_status is clean again with the full feature enabled.