Using fuse_version in the container set header with mkimage and seco commit

[RomanV-GGL]

We are wanting to make use of the -fuse_version flag that can be supplied to mkimage_imx to set the 8bit Fuse Version header field in a container set. 

Running mkimage_imx8 -soc QX -rev B0 -parse flash.bin, I can see the fuse version has been set for our container set

*********************************
* *
* CONTAINER 1 *
* *
*********************************

Length: 0X2C0 (704)
Tag: 0X87
Version: 0
Flags: 0X1
Num images: 1
Fuse version: 0X3
SW version: 0XF000
Sig blk offset: 0X90

IMAGE 1 (SECO FW)
Offset: 0X2000
Size: 0X11248 (70216)
Load Addr: 0X20C00000
Entry Addr: 0X20000000
Flags: 0X166 (IMG TYPE: SECO | CORE ID: CORE_SECO | HASH TYPE: SHA384 | ENCRYPTED: NO)
Metadata: 0
Hash: 77d1fb9ef46916c4f18481e830d3b415f087a450ebd60ee393306664f2a196c1e260b717a1bbca51ef094718e03801c2 (SHA384)


*********************************
* *
* CONTAINER 2 *
* *
*********************************

Length: 0X1A0 (416)
Tag: 0X87
Version: 0
Flags: 0X10
Num images: 3
Fuse version: 0X1
SW version: 0
Sig blk offset: 0X190

We have a i.MX8Dx configured to boot from a eMMC's boot partitions, so setting sw_version has no affect. After successfully booting into the newer container set. we are still able to flash an older image that has fuse_version set to 0.

I suspect we may also need to call seco commit or sc_seco_commit() but the *info parameter is undocumented and we're unsure what to pass here.

An earlier thread does demonstrate calling seco commit for blowing a fuse for SRK. but the values are left unexplained. https://community.nxp.com/t5/i-MX-Processors/i-MX8X-permanently-revoke-a-SRK-key/m-p/1209802

[mgarcia2313]

Hello, 

I am trying to implement the sc_seco_commit function in a imx8qxp machine.

I have set the Revocations parameter in the CST [Install SRK] command to revoke key SRK0, and I am signing images with SRK2. But this change is not persistent. I want to make the revocation persistent in the device.

[Install SRK]
...
# bitmask of the revoked SRKs
Revocations = 0x1

For that purpose, I have the following call to sc_seco_commit, but the execution of the command in u-boot does not burn any fuse.

do_ahab_commit(struct cmd_tbl *cmdtp, int flag, int argc,

    char *const argv[])

{

    int err; uint32_t info = {0};

    err = sc_seco_commit(-1, &info);

    if (err) {

        printf("Error in commit\n");

        return -EIO;

    }

    return CMD_RET_SUCCESS;;

}

Do someone know the correct value of the *info parameter or how to procede?

Thank you.

[Dhruvit]

Hi @RomanV-GGL,

I have shared the additional details over email.

Best Regards,
Dhruvit.

[mgarcia2313]

Hi,
Can I have also additional details?
BR.