commit fea400417b6a9b874d629888bdd5f38e385f73b5
author Paul Geurts <paul.geurts@prodrive-technologies.com> Fri Nov 01 09:49:21 2024 +0100
committer Fabio Estevam <festevam@gmail.com> Sat Nov 09 08:53:36 2024 -0300
tree 41f1c9846a6f99e30d3d8dedb3f7616ff220e8f8
parent df0f95a9b87f23ff174a2a17c66659beba56f5d5

imx: hab: Make imx_hab_is_enabled dependent on FIELD_RETURN

The decision on whether HAB is enabled is solely based on the SEC_CONFIG
fuse. The HAB FIELD_RETURN feature is able to permanently disable HAB on
a CPU, after which it is able to boot unsigned firmware. U-Boot however
does not take into account the FIELD_RETURN mode, and refuses to boot
unsigned software when the feature is enabled.

Also take the FIELD_RETURN fuse into account when deciding whether HAB
is enabled. When The FIELD_RETURN fuse is blown, HAB is not enabled.

Tested on i.MX8M Mini, i.MX8M Plus, i.MX8M Nano and i.MX6ULL

Signed-off-by: Paul Geurts <paul.geurts@prodrive-technologies.com>

arch/arm/mach-imx/hab.c

diff --git a/arch/arm/mach-imx/hab.c b/arch/arm/mach-imx/hab.c
index 7e4eaa4..6000923 100644
--- a/arch/arm/mach-imx/hab.c
+++ b/arch/arm/mach-imx/hab.c
@@ -26,6 +26,14 @@
 #define IS_HAB_ENABLED_BIT \
 	(is_soc_type(MXC_SOC_MX7ULP) ? 0x80000000 :	\
 	 ((is_soc_type(MXC_SOC_MX7) || is_soc_type(MXC_SOC_IMX8M)) ? 0x2000000 : 0x2))
+#define FIELD_RETURN_FUSE_MASK \
+	(is_imx8mp() ? 0xFFFFFFFF : 0x00000001)
+/*
+ * The fuse pattern for i.MX8M Plus is 0x28001401, but bit 2 is already set from factory.
+ * This means when field return is set, the fuse word value reads 0x28001405
+ */
+#define FIELD_RETURN_PATTERN \
+	(is_imx8mp() ? 0x28001405 : 0x00000001)
 
 #ifdef CONFIG_MX7ULP
 #define HAB_M4_PERSISTENT_START	((soc_rev() >= CHIP_REV_2_0) ? 0x20008040 : \
@@ -870,18 +878,30 @@
 
 bool imx_hab_is_enabled(void)
 {
-	struct imx_fuse *fuse =
+	struct imx_fuse *sec_config =
 		(struct imx_fuse *)&imx_sec_config_fuse;
+	struct imx_fuse *field_return =
+		(struct imx_fuse *)&imx_field_return_fuse;
 	uint32_t reg;
+	bool is_enabled;
 	int ret;
 
-	ret = fuse_read(fuse->bank, fuse->word, &reg);
+	ret = fuse_read(sec_config->bank, sec_config->word, &reg);
 	if (ret) {
-		puts("\nSecure boot fuse read error\n");
+		puts("Secure boot fuse read error\n");
 		return ret;
 	}
+	is_enabled = reg & IS_HAB_ENABLED_BIT;
+	if (is_enabled) {
+		ret = fuse_read(field_return->bank, field_return->word, &reg);
+		if (ret) {
+			puts("Field return fuse read error\n");
+			return ret;
+		}
+		is_enabled = (reg & FIELD_RETURN_FUSE_MASK) != FIELD_RETURN_PATTERN;
+	}
 
-	return (reg & IS_HAB_ENABLED_BIT) == IS_HAB_ENABLED_BIT;
+	return is_enabled;
 }
 
 int imx_hab_authenticate_image(uint32_t ddr_start, uint32_t image_size,