mx6 efuse

[chuanyanyin]

My device is OTT, and every thing is fine before I did " imxotp blow --force 6 1; :imxotp blow --force 6 2;"  imxotp read 6, I got 3.

Then I power off the device, and power on again, The device can't boot again.  I change Bootmode[1:0]   to 01, the serial download via usb, The Device always stay in this mode:

Bus 002 Device 015: ID 15a2:0054 Freescale Semiconductor, Inc. i.MX6Q SystemOnChip in RecoveryMode

even  I run "sudo ./imx_usb ./u-boot_ok.bin"

No "_" environment variable

argc == 2, argv == 0x7fffc06491b8

base == 0x608200:./imx_usb

trailing slash == 0x608201:/imx_usb

conf_path == ./

config file <./imx_usb.conf>

No "_" environment variable

argc == 2, argv == 0x7fffc06491b8

base == 0x608200:./imx_usb

trailing slash == 0x608201:/imx_usb

conf_path == ./

config file <./mx6_usb_work.conf>

parse mx6_usb_work.conf

15a2:0054(mx6_qsb) bConfigurationValue =1

Interface 0 claimed

report 1, wrote 16 bytes, err=0

report 3, read 4 bytes, err=0

read=12 34 34 12

1.jmp_mode 2

./u-boot_ok.bin 0 0 1 0 1 2

main dcd length 2d8

sub dcd length 2d4

dcd_ptr=0x2780042c

loading binary file(./u-boot_ok.bin) to 27800000, skip=0, fsize=2bd24 type=aa

<<<179492, 179492 bytes>>>

jumping to 0x27800400

and It goes to serial download via usb mode again, But I can't run imx_usb again.

anyone can tell me what's wrong with my fuse map?

Does anyone has the fusemap of mx6q?

How Can I turn this brick into normal mx6q device?

[raymondwang]

After kernel start up,check your /sys/fsl_otp directory, each file map to its fuse. You can read and write fuse as you want freely here.

In my memory, fuses relevant to boot mode are

HW_OCOTP_CFG0~HW_OCOTP+CFG6

[chuanyanyin]

The problem is mx6 can't  boot, the u-boot can't run since I run " imxotp blow --force 6 1; :imxotp blow --force 6 2" in the u-boot, If the u-boot could run correctly , I can find the problem by myself. If u-boot can't run, It is a brick for me.

[raymondwang]

Can you run in mfg mode? If it does, please add following commands in your command list and let me know.

    <CMD state="Updater" type="push" body="$ ls -la /sys/fsl_otp ">Showing HW_OCOTP fuse bank</CMD>

    <CMD state="Updater" type="push" body="$ cat /sys/fsl_otp/HW_OCOTP_GP1">Read value from HW_OCOTP_GP1 fuse bank</CMD>

    <CMD state="Updater" type="push" body="$ cat /sys/fsl_otp/HW_OCOTP_CFG4">Read value from HW_OCOTP_CFG4 fuse bank</CMD>

    <CMD state="Updater" type="push" body="$ cat /sys/fsl_otp/HW_OCOTP_CFG5">Read value from HW_OCOTP_CFG5 fuse bank</CMD>

[chuanyanyin]

Hi: Raymond Wang

ucl2.xml is here, When I run the device with usb download mode, it stopped at "Jumping to OS image",

how could add your commands in the ucl2.xml? Because the u-boot.bin never run,the console get nothing.

<CMD state="BootStrap" type="boot" body="BootStrap" file ="mx6q-ott/mx6qott.u-boot.bin" >Loading uboot.</CMD>
<CMD state="BootStrap" type="load" file="mx6q-ott/mx6qott.uImage" address="0x10800000"
loadSection="OTH" setSection="OTH" HasFlashHeader="FALSE" >Doing Kernel.</CMD>
<CMD state="BootStrap" type="load" file="mx6q-ott/mx6qott.initramfs.cpio.gz.uboot" address="0x10C00000"
loadSection="OTH" setSection="OTH" HasFlashHeader="FALSE" >Doing Initramfs.</CMD>
<CMD state="BootStrap" type="jump" > Jumping to OS image. </CMD>

<CMD state="Updater" type="push" body="$ ls -l /dev/mtd*">List MTD partition</CMD>
<CMD state="Updater" type="push" body="$ cat /proc/mtd ">Cat MTD partition</CMD>
<CMD state="Updater" type="push" body="send" file="mx6q-ott/mksdcard.sh.tar">Sending partition shell</CMD>
<CMD state="Updater" type="push" body="$ tar xf $FILE "> Partitioning...</CMD>
<CMD state="Updater" type="push" body="$ sh mksdcard.sh /dev/mmcblk0"> Partitioning...</CMD>
<CMD state="Updater" type="push" body="$ mkfs.vfat /dev/mmcblk0p1 ">format partition</CMD>
<CMD state="Updater" type="push" body="$ flash_eraseall /dev/mtd0">Erasing Boot partition</CMD>
<CMD state="Updater" type="push" body="send" file="mx6q-ott/u-boot.bin">Sending U-Boot</CMD>
<CMD state="Updater" type="push" body="$ kobs-ng init $FILE">write U-Boot to NAND</CMD>
<CMD state="Updater" type="push" body="frf">Finishing U-Boot write</CMD>
<CMD state="Updater" type="push" body="$ flash_eraseall /dev/mtd1">Erasing Bootimg partition</CMD>
<CMD state="Updater" type="push" body="send" file="mx6q-ott/boot.img">Sending Boot Image</CMD>
<CMD state="Updater" type="push" body="$ nandwrite -p /dev/mtd1 $FILE">Flashing Kernel</CMD>
<CMD state="Updater" type="push" body="frf">Finishing Kernel write</CMD>
<CMD state="Updater" type="push" body="$ flash_eraseall /dev/mtd2">Erasing Recovery partition</CMD>
<CMD state="Updater" type="push" body="frf">Finishing Recovery partition Erasing</CMD>
<CMD state="Updater" type="push" body="send" file="mx6q-ott/recovery.img">Sending recovery Image</CMD>
<CMD state="Updater" type="push" body="$ nandwrite -p /dev/mtd2 $FILE">Flashing recovery</CMD>
<CMD state="Updater" type="push" body="frf">Finishing recovery write</CMD>
<CMD state="Updater" type="push" body="pipe ubiformat -y /dev/mtd3 -f - -S @FILESIZE" file="mx6q-ott/android_root.img"> Programming Android Root partition </CMD>
<CMD state="Updater" type="push" body="frf">Finishing Android Root partition write</CMD>
<CMD state="Updater" type="push" body="$ ubiattach /dev/ubi_ctrl -m 3">Attaching UBI partition</CMD>
<CMD state="Updater" type="push" body="$ mkdir -p /mnt/ubi0" />
<CMD state="Updater" type="push" body="$ mount -t ubifs ubi0:system /mnt/ubi0 " />
<CMD state="Updater" type="push" body="$ ls -l /mnt/ubi0" />
<CMD state="Updater" type="push" body="$ mkdir -p /mnt/ubi2; mount -t ubifs ubi0_2 /mnt/ubi2" />
<CMD state="Updater" type="push" body="$ cd /mnt/ubi2; rm /mnt/ubi2/* -rf; cd /" />
<CMD state="Updater" type="push" body="$ ls -l /mnt/ubi2" />
<CMD state="Updater" type="push" body="$ umount /mnt/ubi2" />
<CMD state="Updater" type="push" body="$ echo Update Complete!">Done</CMD>
</LIST>

Then I realized you just need those register values, so I try other way:

i use imx_usb_loader, in mx6_usb_work.conf. I add

:read,021bc660

:read,021bc450

:read,021bc460

:read,021bc440

and I got the answers:

-----------------------------

*21bc660 is 0

*21bc450 is 0

*21bc460 is 3

*21bc440 is 0

so I think you would know what's going wrong. Can you tell me?

[raymondwang · Accepted solution]

There is a detailed about uboot fuse tutorial.

Q&amp;A: How to program i.MX6 eFUSE?

My device is OTT, and every thing is fine before I did " imxotp blow --force 6 1; :imxotp blow --force 6 2;"  imxotp read 6, I got 3.

  Per your description,I noticed that you changed 0x460 fuse which can affect secure boot.

0x640[7:0]

bit0:reserved                     //And this bit you written as 1 which may cause unpredictable chip behavior ,Probably FSL can explain this bit more details.

bit1:SEC_CONFIG            //You changed this bit and now your bootloader must be secure (HAB)

bit2:reserved

bit3:DIR_BT_DIS

  I think you had better to replace a new CPU if HAB development not ready.

[Rita_Wang]

Hi chuanyan,

MfgTools is the most convenient way to burn eFuse. Or the customer can burn the fuse on their jig/socket board by the u-boot:

How to Fuse in U-Boot

U-Boot contains a tool, imxotp, which is used for fusing.

U-Boot > imxotp

imxotp - One-Time Programable sub-system

Usage:

imxotp imxotp read <index>

- read fuse at 'index'

imxotp blow [--force] <index> <value>

- blow fuse at 'index' with hex value 'value'

Tips: 'addr' to 'index':

convert 'index' from 'address'

index = (addr - otp_base) / 0x10

eg, addr is 0x021bc410, otp_base is 0x021bc400, the index = 1

• '--force' must be present in order to blow the fuse. Command will abort if '--force' is missing.
• index = (addr - otp_base) / 0x10, where the addr is the address of the fuse you want to operate, the otp_base is the base address of the fuse block.
• 'value' should correspond to fuse settings according to the fuse map and desired fuse configuration.

Hope this can help you~~
Have a great day
Best Regards

Dan

-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------

[chuanyanyin]

Hi  Dan Wang:

  I know this. What I don't know is what does every bit  of efsue represent. So I need a efuse map. How can I get it? Do I need to contact local FAE?  My mx6q's version is V1.2,  Does the efuse has various version for different cpu?  BTW, what's the news mx6q? V1.2.2?

[Rita_Wang]

Hi chuanyan,

About the sfuse map, please look at Chapter 5 "Fusemap" i.MX6DQ Reference Manual (Rev.1 04/2013). The link is http://cache.freescale.com/files/32bit/doc/ref_manual/IMX6DQRM.pdf.

The address of efuse registers you can refer to Chapter 46 P4016.

Best Regards

Dan

[Rita_Wang]

Hi chuanyan,

Which board are you using?

Best Regards

Dan

[raymondwang]

  Since they are fuses,you can't change on burned fuses. Please in imx community, I had burn fuses successfully on

my MX6Q board through MFG tool. Certainly you can review these fuses in kernel /sys/ fs.

Good luck!