Burning eFuses on i.MX8M Mini

[akoch]

I'm trying to implement Secure Boot on an i.MX8M Mini board using HABv4. An important step for this is burning the SRK hashes to eFuses.

I have tried programming the fuses via U-Boot and the operation seems successful at first, but a read shows that the fuse value has actually not changed:

u-boot=> fuse prog 7 3 0xD5DC4A43
Programming bank 7 word 0x00000003 to 0xd5dc4a43...
Warning: Programming fuses is an irreversible operation!
         This may brick your system.
         Use this command only if you are sure of what you are doing!

Really perform this fuse programming? <y/N> y

u-boot=> fuse read 7 3
Reading bank 7:

Word 0x00000003: 00000000

This is using U-Boot 2024.01 (mainline, not u-boot-imx). I have read a lot of contradicting articles, some of them claiming that mainline U-Boot does not support eFuses on i.MX8 and some that it should be implemented.

Can someone give me a definitive statement on that?

If U-Boot is not an option, can I burn the fuses from Linux? I've got Kernel 6.18.19 LTS (mainline, not linux-imx) running on the board with a userland generated using PTXdist.

I have also tried using `uuu` to run a U-Boot-imx build but it seems the board does not offer the USB port required for this.

Thanks in advance!

[JosephAtNXP]

Hi,

Thank you for your interest in NXP Semiconductor products,

Fist recommendation is use NXP BSP (U-boot and Kernel are the key components that are continuously improved based on our devices).

There is a guide for enabling secure boot, therefore how to fuse SRK values in the fuses with u-boot-imx and fuse tool, you can refer to it and use u-boot-imx.

https://github.com/nxp-imx/uboot-imx/blob/lf_v2025.04/doc/imx/habv4/guides/mx8m_secure_boot.txt

Otherwise, there is a way to burn them in Linux, you can check full u-boot/linux fuse reference in this application note.

https://www.nxp.com/docs/en/application-note/AN14954.pdf

Finally, I have tried pwrite and pread functions in i.MX 93 with LF-6.12.49, there is a reference with i.MX 8M Plus that is worth trying,

https://community.nxp.com/t5/i-MX-Processors-Knowledge-Base/how-to-fuse-mac-address-via-uboot-or-ker... 

Regards

[akoch]

I have tried switching to Uboot-imx as you have suggested.

However I cannot seem to get the i.MX8MM EVK build to work:

In doc/board/nxp/imx8mm_evk.rst it is stated to follow just the usual steps to build U-Boot:

$ export CROSS_COMPILE=aarch64-poky-linux-
$ make imx8mm_evk_fspi_defconfig
$ make

The build is successful but there is no 'flash.bin' created.

Calling that make target manually fails with an unmet dependency to the FIT image:

$ make flash.bin
  UPD     include/generated/timestamp_autogenerated.h
  CC      spl/common/spl/spl.o
  AR      spl/common/spl/built-in.o
  KSL     spl/keep-syms-lto.c
  KSLCC   spl/keep-syms-lto.o
  LTO     spl/u-boot-spl
  OBJCOPY spl/u-boot-spl-nodtb.bin
  COPY    spl/u-boot-spl.bin
  SYM     spl/u-boot-spl.sym
make: *** No rule to make target 'u-boot.itb', needed by 'flash.bin'.  Stop.

How am I supposed to build U-boot-imx for the i.MX8MM EVK? This is uboot-imx lf_v2025.04 (99518e6) by the way.

[akoch]

Thank you for your answer!

Fist recommendation is use NXP BSP (U-boot and Kernel are the key components that are continuously improved based on our devices).

I understand your recommendation but switching to linux-imx is just not an option for us as we need up-to-date Kernel versions and the one from the NXP BSP is just too old.

There is a guide for enabling secure boot, therefore how to fuse SRK values in the fuses with u-boot-imx and fuse tool, you can refer to it and use u-boot-imx.

https://github.com/nxp-imx/uboot-imx/blob/lf_v2025.04/doc/imx/habv4/guides/mx8m_secure_boot.tx

I have seen this document but it contains the exact same instructions that I have already tried (fuse prog ...).

Does this mean that there is code in u-boot-imx that is not upstreamed in mainline u-boot and that is required for fuse prog to work?

Otherwise, there is a way to burn them in Linux, you can check full u-boot/linux fuse reference in this application note.

https://www.nxp.com/docs/en/application-note/AN14954.pdf

Thank you, this looks promising, I will look into this next.

Finally, I have tried pwrite and pread functions in i.MX 93 with LF-6.12.49, there is a reference with i.MX 8M Plus that is worth trying,

https://community.nxp.com/t5/i-MX-Processors-Knowledge-Base/how-to-fuse-mac-address-via-uboot-or-ker... 

This looks to me like the same mechanism as above but implemented in C instead of using dd to write the payload. Thanks anyway, I will check it out as well.

Best regards,

Alex