revoke SRK in the closed device

[jongho]

Hi

I'm using imx8mq.

By writing the appropriate values to SRK_HASH and SEC_CONFIG,

I successfully closed the device.

I confirmed that HAB and secureboot are working correctly.

To do revoke SRK, I added the following to spl csf:

[Unlock]
Engine = OCOTP
Features = SRK REVOKE

But, the command 'fuse prog -y 9 3 1' fails.
SRK_REVOKE could not be performed.
At this time, if I read 0x30350050
The value is 0x000007be which means SRK_REVOKE_LOCK is set.

On open devices, I confirmed that the 'fuse prog -y 9 3 1' command operates normally.

Is there something I haven't done to do SRK_REVOKE?

I would like to inform you that I have already signed the NDA.

[Harvey021]

Hi @jongho 

Try not to include HDMI FW when compiling. Then sign the SPL as it currently is.

Best regards

Harvey

[jongho]

Hi.

Even though I set the build target to flash_evk_no_hdmi, srk revoke still doesn't work.

I tried unlock srk revoke for only spl.csf

and also tried unlock srk revoke for both spl.csf and fit.csf.

In both cases, the command 'fuse prog -y 9 3 1' does not work.

[Harvey021]

Hi, 

Please check the link (i.MX 8MQ SRK Revocation limitations in HAB Closed ... - NXP Community) if it is help for the problem that you've encountered. 

Best regards

Harvey

[jongho]

Thank you. My question was resolved after seeing that link.

BTW, I have a few more questions.

1. While reviewing the workaround code in the u-boot source, I tried disabling HDMI (fuse 0x450 bit 25), but this bit is also fuse write protected. Where is the HDMI LOCK bit information?

2. The SRK_REVOKE_LOCK bit (in OCOTP_HW_OCOTP_SW_STICKY) is not mentioned in my security reference manual. Through Googling, I learned about the existence of the SRK_REVOKE_LOCK bit. Is there any documentation mentioning this?

3. My reference manual also doesn't have any information about disabling SJC and secure JTAG. Is there any documentation mentioning this?

Thanks.

Best Regards,

Jongho.

[Harvey021]

These follow up questions will be answered in a new case, please wait.

Best regards

Harvey