burn fuses on imx8mp for secure boot

[greeran]

hi. i am working on imx8mp and would like to test the fuses and then burn the fuses and close them

as for not i burn the fuses without testing with "fuse prog" and then after the boot is successful i close the fuse with "fuse prog 1 3 0x2000000"

my question is if i want to test the fuses should i use the "fuse override" command or is there another option

and the second question is if the closing command correct for the imx8mp (The user manual does not explain very well the fuse part)

thanks

[greeran]

hi

thanks for the response. i am a little confused about your check. the SRK_1_2_3_4_table.bin cannot be the same as the SRK..fuse.bin. also if i am not mistaken the check you advice is done on the host where i would like to do the test on the target.

i am creating an automatic image burn for our production team. I am trying to make it as automatic as possible to not complicate the production team as they are not strong in software. i would like to burn the image and then before blowing the fuses check if they are valid (as all is automatic including the fuse closing). i was wondering if i can test it with overrriding the fuses and then run the hab_status or the hab_status does not use the shadow and it will not work

thanks

Ran

[Harvey021]

Hi 

Get what question you've had. Will rely back to you in private message.

Regards

Harvey

[greeran]

hi

after looking into it my conclusion is that there is no dry test for the fuses .

i need to burn the fuses, verify the hab is successful and then i can close. this means that if by any chance i burn a wrong fuse there is no going back even if i did not close the fuses. 

thanks for the help

[Harvey021]

Hi,

Assuming that I understand your first question correctly. You can check if the sha512sum/sha256sum of SRK_1_2_3_4_table matches with the SRK_1_2_3_4_fuse.bin

od -t x4 --endian=big SRK_1_2_3_4_fuse.bin 

sha256sum SRK_1_2_3_4_table.bin 

The closing command is correct.

Regards

Harvey