Secure Boot IMX8QXP OTP issue

[ShivM]

Hi We have a Board based on IMX8QXP. We have prepared images for secure boot, but we are not sure about the OTP row index to use. Examples for i.MX8QXP mentions Bank 0 row index 730 to 745 but as per the reference manual, it is reserved. The u-boot fuse prog command does not work for this index.

Requesting help in this regard.

[ShivM]

Hi @Harvey021 

We understood the same (that these are the right indexes for the SRK_HASH) from the manual.
However, u-boot fuse prog command does not work.
We tried to check if this area is write locked from SCU FW but it doesn’t look like.

Can you tell us what is the right way to fuse these indexes?
We want to write the SRK hash value (512 bits, 16 words) from index 730 to 745.
We are thinking of using the SCUFW API sc_misc_otp_fuse_write, Can this work for these indexes and if so, is there anything to be taken care before/after calling this?

Is there any examples to refer to?

[Harvey021]

Hi @ShivM 

Please share the error message about " u-boot fuse prog command does not work."

Can I assume that you follow up the way as below to fuse (mx8_mx8x_secure_boot.txt\guides\ahab\imx\doc - uboot-imx - i.MX U-Boot (codeaurora.org))? 

- Program SRK_HASH[511:0] fuses:

  * On i.MX 8 QXP:

  => fuse prog 0 730 0xd436cc46
  => fuse prog 0 731 0x8ecccda9
  => fuse prog 0 732 0xb89e1601
  => fuse prog 0 733 0x5fada3db
  => fuse prog 0 734 0xd454114a
  => fuse prog 0 735 0xb6cd51f4
  => fuse prog 0 736 0x77384870
  => fuse prog 0 737 0xc50ee4b2
  => fuse prog 0 738 0xa27e5132
  => fuse prog 0 739 0xeba887cf
  => fuse prog 0 740 0x592c1e2b
  => fuse prog 0 741 0xbb501799
  => fuse prog 0 742 0xee702e07
  => fuse prog 0 743 0xcf8ce73e
  => fuse prog 0 744 0xfb55e2d5
  => fuse prog 0 745 0xeba6bbd2

Best regards

Harvey

[ShivM]

The problem with OTP was that we were using SECO FW version 3.8.1 whereas a higher version was required. We used version 3.8.4 and fuse write was successful using u-boot fuse command.

[ShivM]

Hi @Harvey021 

We understood the same (that these are the right indexes for the SRK_HASH) from the manual.
However, u-boot fuse prog command does not work.
We tried to check if this area is write locked from SCU FW but it doesn’t look like.

Can you tell us what is the right way to fuse these indexes?
We want to write the SRK hash value (512 bits, 16 words) from index 730 to 745.
We are thinking of using the SCUFW API sc_misc_otp_fuse_write, Can this work for these indexes and if so, is there anything to be taken care before/after calling this?

Is there any examples to refer to?

[Harvey021]

Hi @ShivM 

I've checked the reference manual; these indexes are available for SRK_HASH from Rev. 0,11/2020. 

The u-boot fuse prog command does not work for this index.

Can you tell more details?

Best regards

Harvey

Can you please share