topic Re: mx6 efuse in i.MX Processors

mx6 efuse

chuanyanyin — Mon, 24 Mar 2014 11:06:00 GMT

My device is OTT, and every thing is fine before I did " imxotp blow --force 6 1; :imxotp blow --force 6 2;" imxotp read 6, I got 3.

Then I power off the device, and power on again, The device can't boot again. I change Bootmode[1:0] to 01, the serial download via usb, The Device always stay in this mode:

Bus 002 Device 015: ID 15a2:0054 Freescale Semiconductor, Inc. i.MX6Q SystemOnChip in RecoveryMode

even I run "sudo ./imx_usb ./u-boot_ok.bin"

No "_" environment variable

argc == 2, argv == 0x7fffc06491b8

base == 0x608200:./imx_usb

trailing slash == 0x608201:/imx_usb

conf_path == ./

config file <./imx_usb.conf>

No "_" environment variable

argc == 2, argv == 0x7fffc06491b8

base == 0x608200:./imx_usb

trailing slash == 0x608201:/imx_usb

conf_path == ./

config file <./mx6_usb_work.conf>

parse mx6_usb_work.conf

15a2:0054(mx6_qsb) bConfigurationValue =1

Interface 0 claimed

report 1, wrote 16 bytes, err=0

report 3, read 4 bytes, err=0

read=12 34 34 12

1.jmp_mode 2

./u-boot_ok.bin 0 0 1 0 1 2

main dcd length 2d8

sub dcd length 2d4

dcd_ptr=0x2780042c

loading binary file(./u-boot_ok.bin) to 27800000, skip=0, fsize=2bd24 type=aa

<<<179492, 179492 bytes>>>

jumping to 0x27800400

and It goes to serial download via usb mode again, But I can't run imx_usb again.

anyone can tell me what's wrong with my fuse map?

Does anyone has the fusemap of mx6q?

How Can I turn this brick into normal mx6q device?

Re: mx6 efuse

raymondwang — Mon, 24 Mar 2014 11:57:59 GMT

Since they are fuses,you can't change on burned fuses. Please in imx community, I had burn fuses successfully on

my MX6Q board through MFG tool. Certainly you can review these fuses in kernel /sys/ fs.

Good luck!

Re: mx6 efuse

Rita_Wang — Tue, 25 Mar 2014 02:28:02 GMT

Hi chuanyan,

MfgTools is the most convenient way to burn eFuse. Or the customer can burn the fuse on their jig/socket board by the u-boot:

How to Fuse in U-Boot

U-Boot contains a tool, imxotp, which is used for fusing.

U-Boot > imxotp

imxotp - One-Time Programable sub-system

Usage:

imxotp imxotp read <index>

- read fuse at 'index'

imxotp blow [--force] <index> <value>

- blow fuse at 'index' with hex value 'value'

Tips: 'addr' to 'index':

convert 'index' from 'address'

index = (addr - otp_base) / 0x10

eg, addr is 0x021bc410, otp_base is 0x021bc400, the index = 1

'--force' must be present in order to blow the fuse. Command will abort if '--force' is missing.
index = (addr - otp_base) / 0x10, where the addr is the address of the fuse you want to operate, the otp_base is the base address of the fuse block.
'value' should correspond to fuse settings according to the fuse map and desired fuse configuration.

Hope this can help you~~
Have a great day
Best Regards

Dan

-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------

Re: mx6 efuse

chuanyanyin — Tue, 25 Mar 2014 02:39:10 GMT

Hi Dan Wang:

I know this. What I don't know is what does every bit of efsue represent. So I need a efuse map. How can I get it? Do I need to contact local FAE? My mx6q's version is V1.2, Does the efuse has various version for different cpu? BTW, what's the news mx6q? V1.2.2?

Re: mx6 efuse

Rita_Wang — Tue, 25 Mar 2014 03:07:25 GMT

Hi chuanyan,

Which board are you using?

Best Regards

Dan

Re: mx6 efuse

Rita_Wang — Tue, 25 Mar 2014 03:15:43 GMT

Hi chuanyan,

About the sfuse map, please look at Chapter 5 "Fusemap" i.MX6DQ Reference Manual (Rev.1 04/2013). The link is http://cache.freescale.com/files/32bit/doc/ref_manual/IMX6DQRM.pdf.

The address of efuse registers you can refer to Chapter 46 P4016.

Best Regards

Dan

Re: mx6 efuse

raymondwang — Tue, 25 Mar 2014 11:59:25 GMT

After kernel start up,check your /sys/fsl_otp directory, each file map to its fuse. You can read and write fuse as you want freely here.

In my memory, fuses relevant to boot mode are

HW_OCOTP_CFG0~HW_OCOTP+CFG6

Re: mx6 efuse

chuanyanyin — Wed, 26 Mar 2014 02:36:45 GMT

The problem is mx6 can't boot, the u-boot can't run since I run " imxotp blow --force 6 1; :imxotp blow --force 6 2" in the u-boot, If the u-boot could run correctly , I can find the problem by myself. If u-boot can't run, It is a brick for me.

Re: mx6 efuse

raymondwang — Wed, 26 Mar 2014 03:55:26 GMT

Can you run in mfg mode? If it does, please add following commands in your command list and let me know.

<CMD state="Updater" type="push" body="$ ls -la /sys/fsl_otp ">Showing HW_OCOTP fuse bank</CMD>

<CMD state="Updater" type="push" body="$ cat /sys/fsl_otp/HW_OCOTP_GP1">Read value from HW_OCOTP_GP1 fuse bank</CMD>

<CMD state="Updater" type="push" body="$ cat /sys/fsl_otp/HW_OCOTP_CFG4">Read value from HW_OCOTP_CFG4 fuse bank</CMD>

<CMD state="Updater" type="push" body="$ cat /sys/fsl_otp/HW_OCOTP_CFG5">Read value from HW_OCOTP_CFG5 fuse bank</CMD>

Re: mx6 efuse

chuanyanyin — Thu, 27 Mar 2014 09:58:22 GMT

Hi: Raymond Wang

ucl2.xml is here, When I run the device with usb download mode, it stopped at "Jumping to OS image",

how could add your commands in the ucl2.xml? Because the u-boot.bin never run,the console get nothing.

<CMD state="BootStrap" type="boot" body="BootStrap" file ="mx6q-ott/mx6qott.u-boot.bin" >Loading uboot.</CMD>
<CMD state="BootStrap" type="load" file="mx6q-ott/mx6qott.uImage" address="0x10800000"
loadSection="OTH" setSection="OTH" HasFlashHeader="FALSE" >Doing Kernel.</CMD>
<CMD state="BootStrap" type="load" file="mx6q-ott/mx6qott.initramfs.cpio.gz.uboot" address="0x10C00000"
loadSection="OTH" setSection="OTH" HasFlashHeader="FALSE" >Doing Initramfs.</CMD>
<CMD state="BootStrap" type="jump" > Jumping to OS image. </CMD>

<CMD state="Updater" type="push" body="$ ls -l /dev/mtd*">List MTD partition</CMD>
<CMD state="Updater" type="push" body="$ cat /proc/mtd ">Cat MTD partition</CMD>
<CMD state="Updater" type="push" body="send" file="mx6q-ott/mksdcard.sh.tar">Sending partition shell</CMD>
<CMD state="Updater" type="push" body="$ tar xf $FILE "> Partitioning...</CMD>
<CMD state="Updater" type="push" body="$ sh mksdcard.sh /dev/mmcblk0"> Partitioning...</CMD>
<CMD state="Updater" type="push" body="$ mkfs.vfat /dev/mmcblk0p1 ">format partition</CMD>
<CMD state="Updater" type="push" body="$ flash_eraseall /dev/mtd0">Erasing Boot partition</CMD>
<CMD state="Updater" type="push" body="send" file="mx6q-ott/u-boot.bin">Sending U-Boot</CMD>
<CMD state="Updater" type="push" body="$ kobs-ng init $FILE">write U-Boot to NAND</CMD>
<CMD state="Updater" type="push" body="frf">Finishing U-Boot write</CMD>
<CMD state="Updater" type="push" body="$ flash_eraseall /dev/mtd1">Erasing Bootimg partition</CMD>
<CMD state="Updater" type="push" body="send" file="mx6q-ott/boot.img">Sending Boot Image</CMD>
<CMD state="Updater" type="push" body="$ nandwrite -p /dev/mtd1 $FILE">Flashing Kernel</CMD>
<CMD state="Updater" type="push" body="frf">Finishing Kernel write</CMD>
<CMD state="Updater" type="push" body="$ flash_eraseall /dev/mtd2">Erasing Recovery partition</CMD>
<CMD state="Updater" type="push" body="frf">Finishing Recovery partition Erasing</CMD>
<CMD state="Updater" type="push" body="send" file="mx6q-ott/recovery.img">Sending recovery Image</CMD>
<CMD state="Updater" type="push" body="$ nandwrite -p /dev/mtd2 $FILE">Flashing recovery</CMD>
<CMD state="Updater" type="push" body="frf">Finishing recovery write</CMD>
<CMD state="Updater" type="push" body="pipe ubiformat -y /dev/mtd3 -f - -S @FILESIZE" file="mx6q-ott/android_root.img"> Programming Android Root partition </CMD>
<CMD state="Updater" type="push" body="frf">Finishing Android Root partition write</CMD>
<CMD state="Updater" type="push" body="$ ubiattach /dev/ubi_ctrl -m 3">Attaching UBI partition</CMD>
<CMD state="Updater" type="push" body="$ mkdir -p /mnt/ubi0" />
<CMD state="Updater" type="push" body="$ mount -t ubifs ubi0:system /mnt/ubi0 " />
<CMD state="Updater" type="push" body="$ ls -l /mnt/ubi0" />
<CMD state="Updater" type="push" body="$ mkdir -p /mnt/ubi2; mount -t ubifs ubi0_2 /mnt/ubi2" />
<CMD state="Updater" type="push" body="$ cd /mnt/ubi2; rm /mnt/ubi2/* -rf; cd /" />
<CMD state="Updater" type="push" body="$ ls -l /mnt/ubi2" />
<CMD state="Updater" type="push" body="$ umount /mnt/ubi2" />
<CMD state="Updater" type="push" body="$ echo Update Complete!">Done</CMD>
</LIST>

Then I realized you just need those register values, so I try other way:

i use imx_usb_loader, in mx6_usb_work.conf. I add

:read,021bc660

:read,021bc450

:read,021bc460

:read,021bc440

and I got the answers:

-----------------------------

*21bc660 is 0

*21bc450 is 0

*21bc460 is 3

*21bc440 is 0

so I think you would know what's going wrong. Can you tell me?

Re: mx6 efuse

raymondwang — Fri, 28 Mar 2014 09:29:41 GMT

There is a detailed about uboot fuse tutorial.

Q&A: How to program i.MX6 eFUSE?

My device is OTT, and every thing is fine before I did " imxotp blow --force 6 1; :imxotp blow --force 6 2;" imxotp read 6, I got 3.

Per your description,I noticed that you changed 0x460 fuse which can affect secure boot.

0x640[7:0]

bit0:reserved //And this bit you written as 1 which may cause unpredictable chip behavior ,Probably FSL can explain this bit more details.

bit1:SEC_CONFIG //You changed this bit and now your bootloader must be secure (HAB)

bit2:reserved

bit3:DIR_BT_DIS

I think you had better to replace a new CPU if HAB development not ready.