Re: [PATCH master] i.MX: HAB: fix i.MX8MP field-return fuse

[Ahmad Fatoum <a.fatoum@pengutronix.de>]

Hello Marco,

On 3/10/25 12:36, Marco Felsch wrote:
> Current tests showed that fusing just the single field-return bit(0) on
> i.MX8MP SoCs brick the device.

So such a device is bricked permanently with no way to upload
a bootloader again to fuse the remainder of the bits?

Interesting thing to not document :/

Cheers,
Ahmad

> 
> All i.MX8M SoCs have a single field-return bit except for the i.MX8MP
> which requires a pattern. The pattern is not documented but was
> discussed here [1] and the final u-boot commit [2] added the support
> accordingly.
> 
> This commit is based on the outcome of [1, 2].
> 
> [1] https://lore.kernel.org/all/20240621130626.729666-1-paul.geurts@prodrive-technologies.com/
> [2] https://github.com/u-boot/u-boot/blob/v2025.01/arch/arm/mach-imx/hab.c#L35
> 
> Tested-by: Johannes Schneider <johannes.schneider@leica-geosystems.com>
> Signed-off-by: Marco Felsch <m.felsch@pengutronix.de>
> ---
>  drivers/hab/hab.c                | 12 +++++++++++-
>  include/mach/imx/ocotp-fusemap.h |  1 +
>  2 files changed, 12 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/hab/hab.c b/drivers/hab/hab.c
> index 73d470be131e..74ba4a48557c 100644
> --- a/drivers/hab/hab.c
> +++ b/drivers/hab/hab.c
> @@ -252,6 +252,12 @@ static int imx8m_hab_revoke_key_ocotp(unsigned key_idx)
>  	return ret;
>  }
>  
> +/*
> + * The fuse pattern for i.MX8M Plus is 0x28001401, but bit 2 is already set from factory.
> + * This means when field return is set, the fuse word value reads 0x28001405
> + */
> +#define MX8MP_FIELD_RETURN_PATTERN	0x28001401
> +
>  static int imx8m_hab_field_return_ocotp(void)
>  {
>  	int ret;
> @@ -264,7 +270,11 @@ static int imx8m_hab_field_return_ocotp(void)
>  	if (ret == 1)
>  		return -EINVAL;
>  
> -	ret = imx_ocotp_write_field(MX8M_OCOTP_FIELD_RETURN, 1);
> +	if (cpu_is_mx8mp())
> +		ret = imx_ocotp_write_field(MX8MP_OCOTP_FIELD_RETURN,
> +					    MX8MP_FIELD_RETURN_PATTERN);
> +	else
> +		ret = imx_ocotp_write_field(MX8M_OCOTP_FIELD_RETURN, 1);
>  
>  	return ret;
>  }
> diff --git a/include/mach/imx/ocotp-fusemap.h b/include/mach/imx/ocotp-fusemap.h
> index 37f1ee8298c2..587fe8b15eab 100644
> --- a/include/mach/imx/ocotp-fusemap.h
> +++ b/include/mach/imx/ocotp-fusemap.h
> @@ -68,6 +68,7 @@
>  #define MX8MP_OCOTP_ROM_NO_LOG		(OCOTP_WORD(0x480) | OCOTP_BIT(22) | OCOTP_WIDTH(1))
>  #define MX8M_OCOTP_RECOVERY_SDMMC_BOOT_DIS	(OCOTP_WORD(0x490) | OCOTP_BIT(23) | OCOTP_WIDTH(1))
>  #define MX8M_OCOTP_FIELD_RETURN		(OCOTP_WORD(0x630) | OCOTP_BIT(0) | OCOTP_WIDTH(1))
> +#define MX8MP_OCOTP_FIELD_RETURN	(OCOTP_WORD(0x630) | OCOTP_BIT(0) | OCOTP_WIDTH(32))
>  #define MX8M_OCOTP_SRK_REVOKE		(OCOTP_WORD(0x670) | OCOTP_BIT(0) | OCOTP_WIDTH(4))
>  
>  #endif /* __MACH_IMX_OCOTP_FUSEMAP_H */