[PATCH] i.MX: hab: always lock SRK hash after fusing

[PATCH] i.MX: hab: always lock SRK hash after fusing

[Ulrich Ölmann]

The flag IMX_SRK_HASH_WRITE_LOCK has been present since the introduction of
barebox' hab command in [1], but only got its first user recently. Keeping SRK
hash locking optional is dangerous though: after programming the SRK hash,
leaving it writable allows later manipulations which can render a device
unbootable.

Make SRK hash programming always burn the corresponding lock fuses on all
supported i.MX variants (IIM/OCOTP), and remove IMX_SRK_HASH_WRITE_LOCK.

[1] 9dc622d5622c ("i.MX: hab: Add HAB fusebox related convenience functions / command")

Signed-off-by: Ulrich Ölmann <u.oelmann@pengutronix.de>
---
 common/boards/hgs/common.c |  3 +--
 drivers/hab/hab.c          | 30 ++++++++++++------------------
 include/hab.h              |  4 ----
 3 files changed, 13 insertions(+), 24 deletions(-)

diff --git a/common/boards/hgs/common.c b/common/boards/hgs/common.c
index 05edbd7e1df6..c4a31a27978f 100644
--- a/common/boards/hgs/common.c
+++ b/common/boards/hgs/common.c
@@ -479,8 +479,7 @@ struct hgs_fusemap {
  */
 static int hgs_run_first_boot_setup(void)
 {
-	unsigned int flags = IMX_SRK_HASH_WRITE_PERMANENT |
-			     IMX_SRK_HASH_WRITE_LOCK;
+	unsigned int flags = IMX_SRK_HASH_WRITE_PERMANENT;
 	const struct hgs_fusemap common_fusemap[] = {
 		/* Security */
 		/* MX8M_OCOTP_SEC_CONFIG[1] is done during imx_hab_lockdown_device() */
diff --git a/drivers/hab/hab.c b/drivers/hab/hab.c
index de0a6c73d692..5a4be712d596 100644
--- a/drivers/hab/hab.c
+++ b/drivers/hab/hab.c
@@ -80,14 +80,12 @@ static int imx_hab_write_srk_hash_iim(const u8 *srk, unsigned flags)
 			return -EIO;
 	}
 
-	if (flags & IMX_SRK_HASH_WRITE_LOCK) {
-		ret = imx_iim_write_field(IMX25_IIM_SRK0_LOCK96, 1);
-		if (ret < 0)
-			return ret;
-		ret = imx_iim_write_field(IMX25_IIM_SRK0_LOCK160, 1);
-		if (ret < 0)
-			return ret;
-	}
+	ret = imx_iim_write_field(IMX25_IIM_SRK0_LOCK96, 1);
+	if (ret < 0)
+		return ret;
+	ret = imx_iim_write_field(IMX25_IIM_SRK0_LOCK160, 1);
+	if (ret < 0)
+		return ret;
 
 	return 0;
 }
@@ -150,11 +148,9 @@ static int imx6_hab_write_srk_hash_ocotp(const u8 *newsrk, unsigned flags)
 	if (ret)
 		return ret;
 
-	if (flags & IMX_SRK_HASH_WRITE_LOCK) {
-		ret = imx_ocotp_write_field(OCOTP_SRK_LOCK, 1);
-		if (ret < 0)
-			return ret;
-	}
+	ret = imx_ocotp_write_field(OCOTP_SRK_LOCK, 1);
+	if (ret < 0)
+		return ret;
 
 	return 0;
 }
@@ -167,11 +163,9 @@ static int imx8m_hab_write_srk_hash_ocotp(const u8 *newsrk, unsigned flags)
 	if (ret)
 		return ret;
 
-	if (flags & IMX_SRK_HASH_WRITE_LOCK) {
-		ret = imx_ocotp_write_field(MX8M_OCOTP_SRK_LOCK, 1);
-		if (ret < 0)
-			return ret;
-	}
+	ret = imx_ocotp_write_field(MX8M_OCOTP_SRK_LOCK, 1);
+	if (ret < 0)
+		return ret;
 
 	return 0;
 }
diff --git a/include/hab.h b/include/hab.h
index 393cf0513e0c..212789dbfa59 100644
--- a/include/hab.h
+++ b/include/hab.h
@@ -38,10 +38,6 @@ static inline int habv4_get_state(void)
  * are written.
  */
 #define IMX_SRK_HASH_WRITE_PERMANENT	BIT(1)
-/* When writing the super root key hash, also burn the write protection
- * fuses so that the key hash can not be modified.
- */
-#define IMX_SRK_HASH_WRITE_LOCK		BIT(2)
 
 bool imx_hab_srk_hash_valid(const void *buf);
 int imx_hab_write_srk_hash(const void *buf, unsigned flags);
-- 
2.47.3

Re: [PATCH] i.MX: hab: always lock SRK hash after fusing

[Marco Felsch]

On 26-03-06, Ulrich Ölmann wrote:
> The flag IMX_SRK_HASH_WRITE_LOCK has been present since the introduction of
> barebox' hab command in [1], but only got its first user recently. Keeping SRK
> hash locking optional is dangerous though: after programming the SRK hash,
> leaving it writable allows later manipulations which can render a device
> unbootable.
> 
> Make SRK hash programming always burn the corresponding lock fuses on all
> supported i.MX variants (IIM/OCOTP), and remove IMX_SRK_HASH_WRITE_LOCK.
> 
> [1] 9dc622d5622c ("i.MX: hab: Add HAB fusebox related convenience functions / command")
> 
> Signed-off-by: Ulrich Ölmann <u.oelmann@pengutronix.de>

Reviewed-by: Marco Felsch <m.felsch@pengutronix.de>

Re: [PATCH] i.MX: hab: always lock SRK hash after fusing

[Sascha Hauer]

On Fri, 06 Mar 2026 11:38:12 +0100, Ulrich Ölmann wrote:
> The flag IMX_SRK_HASH_WRITE_LOCK has been present since the introduction of
> barebox' hab command in [1], but only got its first user recently. Keeping SRK
> hash locking optional is dangerous though: after programming the SRK hash,
> leaving it writable allows later manipulations which can render a device
> unbootable.
> 
> Make SRK hash programming always burn the corresponding lock fuses on all
> supported i.MX variants (IIM/OCOTP), and remove IMX_SRK_HASH_WRITE_LOCK.
> 
> [...]

Applied, thanks!

[1/1] i.MX: hab: always lock SRK hash after fusing
      https://git.pengutronix.de/cgit/barebox/commit/?id=1f4d4a2b75b7 (link may not be stable)

Best regards,
-- 
Sascha Hauer <s.hauer@pengutronix.de>

Re: [PATCH] i.MX: hab: always lock SRK hash after fusing

[Sascha Hauer]

On Mon, Mar 09, 2026 at 08:50:38AM +0100, Sascha Hauer wrote:
> 
> On Fri, 06 Mar 2026 11:38:12 +0100, Ulrich Ölmann wrote:
> > The flag IMX_SRK_HASH_WRITE_LOCK has been present since the introduction of
> > barebox' hab command in [1], but only got its first user recently. Keeping SRK
> > hash locking optional is dangerous though: after programming the SRK hash,
> > leaving it writable allows later manipulations which can render a device
> > unbootable.
> > 
> > Make SRK hash programming always burn the corresponding lock fuses on all
> > supported i.MX variants (IIM/OCOTP), and remove IMX_SRK_HASH_WRITE_LOCK.
> > 
> > [...]
> 
> Applied, thanks!
> 
> [1/1] i.MX: hab: always lock SRK hash after fusing
>       https://git.pengutronix.de/cgit/barebox/commit/?id=1f4d4a2b75b7 (link may not be stable)

Also added a note to the migration guide.

Sascha

-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |