imx93: SRK revocation

[mothacehe]

Hello,

I am trying to perform key revocation on my closed imx93 board.

My CSF file looks like:

[Header]
Target = AHAB
Version = 1.0

[Install SRK]
File = "../cst-3.4.0/crts/SRKtable.bin"
Source = "../cst-3.4.0/crts/SRK2_sha384_secp384r1_v3_usr_crt.pem"
Source index = 1
Source set = OEM
Revocations = 0x1

[Authenticate Data]
File = "spl.bin"
Offsets = 0x400 0x490

The idea is to sign with SRK2 and revoke SRK1 (0x1 bitmask). Booting from that image works fine, but I can still also boot from an image signed with SRK1.

Is there anything else that needs to be done in order to revoke SRK1?

Thanks,

Mathieu

[Harvey021 · Accepted solution]

check if missing the step ahab_commit 0x10

Regards

Harvey

[mothacehe]

That worked thanks. I had to add support for ahab_commit mainline though: https://lists.denx.de/pipermail/u-boot/2024-March/548873.html