Fuses for a really secure boot

andreasschuler — Wed, 13 Dec 2017 06:28:02 GMT

Hello,

I have a i.MX6 Quad Core device and I installed a complete chain of trust secure boot solution in the eMMC. The bootloader is in SPI flash.
The device is closed and the SRK is burned in.
Which fuses I need to set additionally that's not possible to access the system without permission ?

I think about JTAG and some other fuses that I don't know at the moment...

Thanks

Re: Fuses for a really secure boot

marius_grigoras — Wed, 13 Dec 2017 08:00:32 GMT

Hi,

Additionally, the following fuses must be programmed to completely secure your device. Note that this operation is irreversible and some features used for development may not be available after the following commands.

• SRK_LOCK: Lock SRK_HASH[255:0]

On i.MX6 Series 0x400[14]:

fuse prog 0 0 0x4000
On i.MX7S and i.MX7D 0x400[9]:

fuse prog 0 0 0x200

• DIR_BT_DIS: Disable Direct External Memory Boot

On i.MX6 Series 0x460[3]:

fuse prog 0 6 0x8

On i.MX7S and i.MX7D 0x470[27]:

fuse prog 1 3 0x8000000

• SJC_DISABLE: Disable the Secure JTAG Controller module

On i.MX6 Series 0x460[20]:

fuse prog 0 6 0x100000

Best regards,

Marius

i.MX Processors中的主题 Fuses for a really secure boot

Fuses for a really secure boot

Re: Fuses for a really secure boot