mail archive of the barebox mailing list
 help / color / mirror / Atom feed
* [PATCH] i.MX: hab: always lock SRK hash after fusing
@ 2026-03-06 10:38 Ulrich Ölmann
  2026-03-06 10:50 ` Marco Felsch
  2026-03-09  7:50 ` Sascha Hauer
  0 siblings, 2 replies; 4+ messages in thread
From: Ulrich Ölmann @ 2026-03-06 10:38 UTC (permalink / raw)
  To: Barebox List

The flag IMX_SRK_HASH_WRITE_LOCK has been present since the introduction of
barebox' hab command in [1], but only got its first user recently. Keeping SRK
hash locking optional is dangerous though: after programming the SRK hash,
leaving it writable allows later manipulations which can render a device
unbootable.

Make SRK hash programming always burn the corresponding lock fuses on all
supported i.MX variants (IIM/OCOTP), and remove IMX_SRK_HASH_WRITE_LOCK.

[1] 9dc622d5622c ("i.MX: hab: Add HAB fusebox related convenience functions / command")

Signed-off-by: Ulrich Ölmann <u.oelmann@pengutronix.de>
---
 common/boards/hgs/common.c |  3 +--
 drivers/hab/hab.c          | 30 ++++++++++++------------------
 include/hab.h              |  4 ----
 3 files changed, 13 insertions(+), 24 deletions(-)

diff --git a/common/boards/hgs/common.c b/common/boards/hgs/common.c
index 05edbd7e1df6..c4a31a27978f 100644
--- a/common/boards/hgs/common.c
+++ b/common/boards/hgs/common.c
@@ -479,8 +479,7 @@ struct hgs_fusemap {
  */
 static int hgs_run_first_boot_setup(void)
 {
-	unsigned int flags = IMX_SRK_HASH_WRITE_PERMANENT |
-			     IMX_SRK_HASH_WRITE_LOCK;
+	unsigned int flags = IMX_SRK_HASH_WRITE_PERMANENT;
 	const struct hgs_fusemap common_fusemap[] = {
 		/* Security */
 		/* MX8M_OCOTP_SEC_CONFIG[1] is done during imx_hab_lockdown_device() */
diff --git a/drivers/hab/hab.c b/drivers/hab/hab.c
index de0a6c73d692..5a4be712d596 100644
--- a/drivers/hab/hab.c
+++ b/drivers/hab/hab.c
@@ -80,14 +80,12 @@ static int imx_hab_write_srk_hash_iim(const u8 *srk, unsigned flags)
 			return -EIO;
 	}
 
-	if (flags & IMX_SRK_HASH_WRITE_LOCK) {
-		ret = imx_iim_write_field(IMX25_IIM_SRK0_LOCK96, 1);
-		if (ret < 0)
-			return ret;
-		ret = imx_iim_write_field(IMX25_IIM_SRK0_LOCK160, 1);
-		if (ret < 0)
-			return ret;
-	}
+	ret = imx_iim_write_field(IMX25_IIM_SRK0_LOCK96, 1);
+	if (ret < 0)
+		return ret;
+	ret = imx_iim_write_field(IMX25_IIM_SRK0_LOCK160, 1);
+	if (ret < 0)
+		return ret;
 
 	return 0;
 }
@@ -150,11 +148,9 @@ static int imx6_hab_write_srk_hash_ocotp(const u8 *newsrk, unsigned flags)
 	if (ret)
 		return ret;
 
-	if (flags & IMX_SRK_HASH_WRITE_LOCK) {
-		ret = imx_ocotp_write_field(OCOTP_SRK_LOCK, 1);
-		if (ret < 0)
-			return ret;
-	}
+	ret = imx_ocotp_write_field(OCOTP_SRK_LOCK, 1);
+	if (ret < 0)
+		return ret;
 
 	return 0;
 }
@@ -167,11 +163,9 @@ static int imx8m_hab_write_srk_hash_ocotp(const u8 *newsrk, unsigned flags)
 	if (ret)
 		return ret;
 
-	if (flags & IMX_SRK_HASH_WRITE_LOCK) {
-		ret = imx_ocotp_write_field(MX8M_OCOTP_SRK_LOCK, 1);
-		if (ret < 0)
-			return ret;
-	}
+	ret = imx_ocotp_write_field(MX8M_OCOTP_SRK_LOCK, 1);
+	if (ret < 0)
+		return ret;
 
 	return 0;
 }
diff --git a/include/hab.h b/include/hab.h
index 393cf0513e0c..212789dbfa59 100644
--- a/include/hab.h
+++ b/include/hab.h
@@ -38,10 +38,6 @@ static inline int habv4_get_state(void)
  * are written.
  */
 #define IMX_SRK_HASH_WRITE_PERMANENT	BIT(1)
-/* When writing the super root key hash, also burn the write protection
- * fuses so that the key hash can not be modified.
- */
-#define IMX_SRK_HASH_WRITE_LOCK		BIT(2)
 
 bool imx_hab_srk_hash_valid(const void *buf);
 int imx_hab_write_srk_hash(const void *buf, unsigned flags);
-- 
2.47.3




^ permalink raw reply	[flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-03-09  8:08 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-03-06 10:38 [PATCH] i.MX: hab: always lock SRK hash after fusing Ulrich Ölmann
2026-03-06 10:50 ` Marco Felsch
2026-03-09  7:50 ` Sascha Hauer
2026-03-09  8:07   ` Sascha Hauer

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox