We are wanting to make use of the -fuse_version flag that can be supplied to mkimage_imx to set the 8bit Fuse Version header field in a container set.
Running mkimage_imx8 -soc QX -rev B0 -parse flash.bin, I can see the fuse version has been set for our container set
*********************************
* *
* CONTAINER 1 *
* *
*********************************
Length: 0X2C0 (704)
Tag: 0X87
Version: 0
Flags: 0X1
Num images: 1
Fuse version: 0X3
SW version: 0XF000
Sig blk offset: 0X90
IMAGE 1 (SECO FW)
Offset: 0X2000
Size: 0X11248 (70216)
Load Addr: 0X20C00000
Entry Addr: 0X20000000
Flags: 0X166 (IMG TYPE: SECO | CORE ID: CORE_SECO | HASH TYPE: SHA384 | ENCRYPTED: NO)
Metadata: 0
Hash: 77d1fb9ef46916c4f18481e830d3b415f087a450ebd60ee393306664f2a196c1e260b717a1bbca51ef094718e03801c2 (SHA384)
*********************************
* *
* CONTAINER 2 *
* *
*********************************
Length: 0X1A0 (416)
Tag: 0X87
Version: 0
Flags: 0X10
Num images: 3
Fuse version: 0X1
SW version: 0
Sig blk offset: 0X190
We have a i.MX8Dx configured to boot from a eMMC's boot partitions, so setting sw_version has no affect. After successfully booting into the newer container set. we are still able to flash an older image that has fuse_version set to 0.
I suspect we may also need to call seco commit or sc_seco_commit() but the *info parameter is undocumented and we're unsure what to pass here.
An earlier thread does demonstrate calling seco commit for blowing a fuse for SRK. but the values are left unexplained. https://community.nxp.com/t5/i-MX-Processors/i-MX8X-permanently-revoke-a-SRK-key/m-p/1209802
