SECO and bootable image

[rkohli2000]

Hi,

I'm using the i.MX8QM MEK and need to confirm whether the SECO (security controller) binary from NXP is mandatory for any bootable image. Reading the i.MX8QM reference manual (section 5.9.4.5 Image Restrictions) and using the "bootable image" whitepaper,  it appears so.

Is the SECO FW mandatory for container 1 and it possible to construct an image for "non-secure" images only (without including SECO) ? If it is mandatory, how do users certify their code without access to SECO source code ?

Is it possible to use TF-A BL31.bin without SECO FW for Cortex-A images ?

Thanks

[igorpadykov]

Hi rkohli2000

>Is the SECO FW mandatory for container 1 and it possible to construct
>an image for "non-secure" images only (without including SECO) ?

yes it is mandatory, not possible to make image without including SECO,
as described in sect.5.1 Overview

  i.MX 8DualXPlus/8QuadXPlus Applications Processor Reference Manual

"At least two containers are needed for the boot process:
• The first container will only contain the SECO FW Image.
This container is NXP signed, and NXP provided."

>If it is mandatory, how do users certify their code without access to SECO source code ?

one can look at Table 7-1. Fusemap for description of certified part fuses.

Best regards
igor