Unknown SECO event on IMX8.QM

[ddroe]

Hi,

we're encountering the SECO event 0x00DAF429 on all our IMX8.QM boards. This is the U-Boot output:

=> ahab_status
Lifecycle: 0x0020, NXP closed

SECO Event[0] = 0x00DAF429
sc_seco_get_event: idx: 1, res:3

I could not find any documentation of that event. It occurs independently of key fuses being burnt or not.

I also supsect it to prevent us from closing the device since:

=> ahab_close
Warning: Please ensure your sample is in NXP closed state, OEM SRK hash has been fused,
         and you are able to boot a signed image successfully without any SECO events reported.
         If not, your sample will be unrecoverable.

Really perform this operation? <y/N>
y
sc_seco_forward_lifecycle: change:16, res:11
Error in forward lifecycle to OEM closed
exit not allowed from main input shell.

If anyone knows what the event means and how it needs to be handled, that would be of great help. Thank you!

Cheers,

David

[seb_haezebrouck]

Hi David,

Which version of SCFW / SECO FW are you using ?

If you have a pending SECO event, the SECO will refuse to close your part.

Best regards,

Seb

[ddroe]

Hi Seb,

it's

SCFW bc122ee1, SECO-FW d63fdb21, IMX-MKIMAGE 8947fea3, ATF 2a26786

Regards,

David

[seb_haezebrouck · Accepted solution]

OK - this means: SECO FW QM B0 revision 3.7.4, SCFW revision 2020q4_p3.

You should move to SECO FW 3.8.1 / SCFW 2020q4_p4 at least, if you are using Linux 5.4.70_2.3.x release (e.g. switch to Linux 5.4.70_2.3.4).

This is available from nxp.com: SCFW porting kit version 1.7.4.

From the SCFW 2020q4_p4 release notes (included in SCFW 1.7.4 porting kit):

Regards,

Seb

[ddroe]

Successfully tested closing the device with a more recent FW. Thanks again!

[ddroe]

Maybe I should add that the problem was not caused by an outdated SECO-FW but either by an outdated SCFW or the combination of SECO-FW and SCFW. We have used the same SECO-FW in both attempts but only with a more recent SCFW, closing the device succeeded.

[ddroe]

Ok, thanks for the hint, I'll try a more recent FW.

[Yuri]

@ddroe 
Hello,

   have You followed recommendations of U-boot help, regarding secure image building
and deployment? 

https://source.codeaurora.org/external/imx/uboot-imx/tree/doc/imx/habv4/guides?h=imx_v2020.04_5.4.70...

Regards,
Yuri.

[ddroe]

Hello,

thank you for your reply. We followed

https://source.codeaurora.org/external/imx/uboot-imx/tree/doc/imx/ahab/guides/mx8_mx8x_secure_boot.t...

since the IMX8.QM uses AHAB (in contrast to HABv4).

Regards,
David