[PATCH master] i.MX: HAB: fix i.MX8MP field-return fuse

[PATCH master] i.MX: HAB: fix i.MX8MP field-return fuse

[Marco Felsch]

Current tests showed that fusing just the single field-return bit(0) on
i.MX8MP SoCs brick the device.

All i.MX8M SoCs have a single field-return bit except for the i.MX8MP
which requires a pattern. The pattern is not documented but was
discussed here [1] and the final u-boot commit [2] added the support
accordingly.

This commit is based on the outcome of [1, 2].

[1] https://lore.kernel.org/all/20240621130626.729666-1-paul.geurts@prodrive-technologies.com/
[2] https://github.com/u-boot/u-boot/blob/v2025.01/arch/arm/mach-imx/hab.c#L35

Tested-by: Johannes Schneider <johannes.schneider@leica-geosystems.com>
Signed-off-by: Marco Felsch <m.felsch@pengutronix.de>
---
 drivers/hab/hab.c                | 12 +++++++++++-
 include/mach/imx/ocotp-fusemap.h |  1 +
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/drivers/hab/hab.c b/drivers/hab/hab.c
index 73d470be131e..74ba4a48557c 100644
--- a/drivers/hab/hab.c
+++ b/drivers/hab/hab.c
@@ -252,6 +252,12 @@ static int imx8m_hab_revoke_key_ocotp(unsigned key_idx)
 	return ret;
 }
 
+/*
+ * The fuse pattern for i.MX8M Plus is 0x28001401, but bit 2 is already set from factory.
+ * This means when field return is set, the fuse word value reads 0x28001405
+ */
+#define MX8MP_FIELD_RETURN_PATTERN	0x28001401
+
 static int imx8m_hab_field_return_ocotp(void)
 {
 	int ret;
@@ -264,7 +270,11 @@ static int imx8m_hab_field_return_ocotp(void)
 	if (ret == 1)
 		return -EINVAL;
 
-	ret = imx_ocotp_write_field(MX8M_OCOTP_FIELD_RETURN, 1);
+	if (cpu_is_mx8mp())
+		ret = imx_ocotp_write_field(MX8MP_OCOTP_FIELD_RETURN,
+					    MX8MP_FIELD_RETURN_PATTERN);
+	else
+		ret = imx_ocotp_write_field(MX8M_OCOTP_FIELD_RETURN, 1);
 
 	return ret;
 }
diff --git a/include/mach/imx/ocotp-fusemap.h b/include/mach/imx/ocotp-fusemap.h
index 37f1ee8298c2..587fe8b15eab 100644
--- a/include/mach/imx/ocotp-fusemap.h
+++ b/include/mach/imx/ocotp-fusemap.h
@@ -68,6 +68,7 @@
 #define MX8MP_OCOTP_ROM_NO_LOG		(OCOTP_WORD(0x480) | OCOTP_BIT(22) | OCOTP_WIDTH(1))
 #define MX8M_OCOTP_RECOVERY_SDMMC_BOOT_DIS	(OCOTP_WORD(0x490) | OCOTP_BIT(23) | OCOTP_WIDTH(1))
 #define MX8M_OCOTP_FIELD_RETURN		(OCOTP_WORD(0x630) | OCOTP_BIT(0) | OCOTP_WIDTH(1))
+#define MX8MP_OCOTP_FIELD_RETURN	(OCOTP_WORD(0x630) | OCOTP_BIT(0) | OCOTP_WIDTH(32))
 #define MX8M_OCOTP_SRK_REVOKE		(OCOTP_WORD(0x670) | OCOTP_BIT(0) | OCOTP_WIDTH(4))
 
 #endif /* __MACH_IMX_OCOTP_FUSEMAP_H */
-- 
2.39.5

Re: [PATCH master] i.MX: HAB: fix i.MX8MP field-return fuse

[Ahmad Fatoum]

Hello Marco,

On 3/10/25 12:36, Marco Felsch wrote:
> Current tests showed that fusing just the single field-return bit(0) on
> i.MX8MP SoCs brick the device.

So such a device is bricked permanently with no way to upload
a bootloader again to fuse the remainder of the bits?

Interesting thing to not document :/

Cheers,
Ahmad

> 
> All i.MX8M SoCs have a single field-return bit except for the i.MX8MP
> which requires a pattern. The pattern is not documented but was
> discussed here [1] and the final u-boot commit [2] added the support
> accordingly.
> 
> This commit is based on the outcome of [1, 2].
> 
> [1] https://lore.kernel.org/all/20240621130626.729666-1-paul.geurts@prodrive-technologies.com/
> [2] https://github.com/u-boot/u-boot/blob/v2025.01/arch/arm/mach-imx/hab.c#L35
> 
> Tested-by: Johannes Schneider <johannes.schneider@leica-geosystems.com>
> Signed-off-by: Marco Felsch <m.felsch@pengutronix.de>
> ---
>  drivers/hab/hab.c                | 12 +++++++++++-
>  include/mach/imx/ocotp-fusemap.h |  1 +
>  2 files changed, 12 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/hab/hab.c b/drivers/hab/hab.c
> index 73d470be131e..74ba4a48557c 100644
> --- a/drivers/hab/hab.c
> +++ b/drivers/hab/hab.c
> @@ -252,6 +252,12 @@ static int imx8m_hab_revoke_key_ocotp(unsigned key_idx)
>  	return ret;
>  }
>  
> +/*
> + * The fuse pattern for i.MX8M Plus is 0x28001401, but bit 2 is already set from factory.
> + * This means when field return is set, the fuse word value reads 0x28001405
> + */
> +#define MX8MP_FIELD_RETURN_PATTERN	0x28001401
> +
>  static int imx8m_hab_field_return_ocotp(void)
>  {
>  	int ret;
> @@ -264,7 +270,11 @@ static int imx8m_hab_field_return_ocotp(void)
>  	if (ret == 1)
>  		return -EINVAL;
>  
> -	ret = imx_ocotp_write_field(MX8M_OCOTP_FIELD_RETURN, 1);
> +	if (cpu_is_mx8mp())
> +		ret = imx_ocotp_write_field(MX8MP_OCOTP_FIELD_RETURN,
> +					    MX8MP_FIELD_RETURN_PATTERN);
> +	else
> +		ret = imx_ocotp_write_field(MX8M_OCOTP_FIELD_RETURN, 1);
>  
>  	return ret;
>  }
> diff --git a/include/mach/imx/ocotp-fusemap.h b/include/mach/imx/ocotp-fusemap.h
> index 37f1ee8298c2..587fe8b15eab 100644
> --- a/include/mach/imx/ocotp-fusemap.h
> +++ b/include/mach/imx/ocotp-fusemap.h
> @@ -68,6 +68,7 @@
>  #define MX8MP_OCOTP_ROM_NO_LOG		(OCOTP_WORD(0x480) | OCOTP_BIT(22) | OCOTP_WIDTH(1))
>  #define MX8M_OCOTP_RECOVERY_SDMMC_BOOT_DIS	(OCOTP_WORD(0x490) | OCOTP_BIT(23) | OCOTP_WIDTH(1))
>  #define MX8M_OCOTP_FIELD_RETURN		(OCOTP_WORD(0x630) | OCOTP_BIT(0) | OCOTP_WIDTH(1))
> +#define MX8MP_OCOTP_FIELD_RETURN	(OCOTP_WORD(0x630) | OCOTP_BIT(0) | OCOTP_WIDTH(32))
>  #define MX8M_OCOTP_SRK_REVOKE		(OCOTP_WORD(0x670) | OCOTP_BIT(0) | OCOTP_WIDTH(4))
>  
>  #endif /* __MACH_IMX_OCOTP_FUSEMAP_H */

Re: [PATCH master] i.MX: HAB: fix i.MX8MP field-return fuse

[Marco Felsch]

On 25-03-10, Ahmad Fatoum wrote:
> Hello Marco,
> 
> On 3/10/25 12:36, Marco Felsch wrote:
> > Current tests showed that fusing just the single field-return bit(0) on
> > i.MX8MP SoCs brick the device.
> 
> So such a device is bricked permanently with no way to upload
> a bootloader again to fuse the remainder of the bits?

Yes, as written here [3], the device isnow in "device asserts security
violation" state, what ever this means but maybe: "I refuse to power
up".

[3] https://lore.kernel.org/all/a9ebece9-4ab6-4bca-bebe-985e0bf95278@oss.nxp.com/

> Interesting thing to not document :/

Took us 2 devices to figure it out :/ We also don't know why NXP doesn't
care and don't update the (S)TRM since the v1 of [3] is 9months old.

Regards,
  Marco

Re: [PATCH master] i.MX: HAB: fix i.MX8MP field-return fuse

[SCHNEIDER Johannes]

Hoi,

>
> On 25-03-10, Ahmad Fatoum wrote:
> > Hello Marco,
> >
> > On 3/10/25 12:36, Marco Felsch wrote:
> > > Current tests showed that fusing just the single field-return bit(0) on
> > > i.MX8MP SoCs brick the device.
> >
> > So such a device is bricked permanently with no way to upload
> > a bootloader again to fuse the remainder of the bits?
>
> Yes, as written here [3], the device isnow in "device asserts security
> violation" state, what ever this means but maybe: "I refuse to power
> up".

The imx does consume power, but does "nothing", e.g. does not boot from emmc,
say anything on the hardware serial or even enumerate the usb side.
And pulling the boot-mode pins to serial-download mode does also nothing,
even though the serial-dl is usually the one last and common fallback.

>
> [3] https://lore.kernel.org/all/a9ebece9-4ab6-4bca-bebe-985e0bf95278@oss.nxp.com/
>
> > Interesting thing to not document :/
>
> Took us 2 devices to figure it out :/ We also don't know why NXP doesn't
> care and don't update the (S)TRM since the v1 of [3] is 9months old.
>
> Regards,
>   Marco
>

gruß
Johannes

Re: [PATCH master] i.MX: HAB: fix i.MX8MP field-return fuse

[Sascha Hauer]

On Mon, 10 Mar 2025 12:36:26 +0100, Marco Felsch wrote:
> Current tests showed that fusing just the single field-return bit(0) on
> i.MX8MP SoCs brick the device.
> 
> All i.MX8M SoCs have a single field-return bit except for the i.MX8MP
> which requires a pattern. The pattern is not documented but was
> discussed here [1] and the final u-boot commit [2] added the support
> accordingly.
> 
> [...]

Applied, thanks!

[1/1] i.MX: HAB: fix i.MX8MP field-return fuse
      https://git.pengutronix.de/cgit/barebox/commit/?id=51a10d4fd531 (link may not be stable)

Best regards,
-- 
Sascha Hauer <s.hauer@pengutronix.de>