Shadow Registers Read/Write

fmajeric — Fri, 20 May 2016 16:37:28 GMT

Hi everybody,

I'm trying to deal with the fuses (OTP) and Shadows Registers of the i.MX6S processor.

I've already read a lot of documentation, but I'm not still an expert and it's the reason of this post :smileysad:...

But if this discussion can help other one it a good thing and I'm happy :smileylaugh: .

So I ever read:

The i.MX 6Solo/6DualLite Applications Processor Reference Manual: http://cache.nxp.com/files/32bit/doc/ref_manual/IMX6SDLRM.pdf?fpsp=1&WT_TYPE=Reference%20Manuals&WT_VENDOR=FREESCALE&WT_…
Configuring Secure JTAG for the i.MX 6 Series Family of Applications Processors: http://cache.nxp.com/files/32bit/doc/app_note/AN4686.pdf?fsrch=1&sr=1&pageNum=1

I'm working on two development boards that embed the i.MX6 SoC:

The RIoTboard which has an i.MX6 Solo core processor (RIoTBoard - Revolutionizing the Internet of Things)
The SabreLite which has an i.MX6 Quad core processor(SABRE Lite i.MX6 Platform element14’s i.MX 6Quad Processor Evaluation Board | element14 Community)

The first manipulation I want to do is :

Read a shadow register.
override its value.
Read its value again.
Reload all Shadows registers.
Check the value is reloaded (by reading it).

So I consider the following registers :

Address	Register Name
0x21B_C000	OTP Controller Control Register (OCOTP_CTRL)
0x21B_C580	Shadow Register for OTP Bank3 Word0 (SRK Hash) (OCOTP_SRK0)

Address

Register Name

0x21B_C000

OTP Controller Control Register (OCOTP_CTRL)

0x21B_C580

Shadow Register for OTP Bank3 Word0 (SRK Hash)

(OCOTP_SRK0)

I want to to this manipulation by two ways :

A JTAG debugger
The u-boot user interface with the command "fuse"

On the SabreLite I've no problem:

I read the value of OCOTP_SRK0 register : 0x0000_0000
I write a value on it : 0x0011_2233
I read its value again : 0x0011_2233
Write '1' in OCOTP_OCTRL[10] in order to reload register
And then when I read OCOTP_SRK0 I've the reinitialized value : 0x0000_0000

Everything are well, by the JTAG or by the u-boot. Even, I can mix the JTAG and u-boot manipulation, when I modify on one, the other stay coherent with the modification.

On the RIoTboard, and here is the problem, when I want to proceed the same manipulation I can't.

I can read the value of OCOTP_SRK0 register : 0x0000_0000.
But I can't write on it and so overwrite with the value 0x0011_2233
It seems can't also write on the OCOTP_OCTRL[10]. (I'm not sure because I can't change any value so I can't check if I can't reload it).

Because I'm like Mulder and wan't to believe :smileyhappy:, I compare all the shadows register of the 2 boards.

I think a security configuration lock me and the difference will highlight it :

Address	SabreLite (hex)	RIoTboard (hex)	Register Name
0x21B_C000	0000_0200	0000_0000	OCOTP_CTRL
0x21B_C004	0000_0000	0000_0000	OCOTP_CTRL_SET
0x21B_C008	0000_0000	0000_0000	OCOTP_CTRL_CLR
0x21B_C00C	0000_0000	0000_0000	OCOTP_CTRL_TOG
0x21B_C010	0146_1299	0146_1299	OCOTP_TIMING
0x21B_C020	0000_0000	0000_0000	OCOTP_DATA
0x21B_C030	0000_0000	0000_0000	OCOTP_READ_CTRL
0x21B_C040	BADA_BADA	0000_0000	OCOTP_READ_FUSE_DATA
0x21B_C050	0000_001C	0000_0018	OCOTP_SW_STICKY
0x21B_C060	8000_0000	0000_0000	OCOTP_SCS
0x21B_C064	0000_0000	0000_0000	OCOTP_SCS_SET
0x21B_C068	0000_0000	0000_0000	OCOTP_SCS_CLR
0x21B_C06C	0000_0000	0000_0000	OCOTP_SCS_TOG
0x21B_C090	0200_0000	0000_0000	OCOTP_VERSION
...
0x21B_C400	2022_0002	2022_0002	OCOTP_LOCK
0x21B_C410	D819_1856	D72D_78A9	OCOTP_CFG0
0x21B_C420	0613_71D4	0D29_41D4	OCOTP_CFG1
0x21B_C430	2000_0098	A650_007B	OCOTP_CFG2
0x21B_C440	002A_0302	0042_0702	OCOTP_CFG3
0x21B_C450	1800_0030	0000_0000	OCOTP_CFG4
0x21B_C460	0000_0010	0000_0000	OCOTP_CFG5
0x21B_C470	0000_0000	0000_0000	OCOTP_CFG6
0x21B_C480	0000_00C0	0000_0000	OCOTP_MEM0
0x21B_C490	0000_0040	0000_0040	OCOTP_MEM1
0x21B_C4A0	0000_00A2	0000_0033	OCOTP_MEM2
0x21B_C4B0	0000_0000	0000_0000	OCOTP_MEM3
0x21B_C4C0	0000_0000	0000_0000	OCOTP_MEM4
0x21B_C4D0	0000_0000	0000_0000	OCOTP_ANA0
0x21B_C4E0	5884_C77D	58E5_0C5F	OCOTP_ANA1
0x21B_C4F0	0000_0000	0000_0000	OCOTP_ANA2
...
0x21B_C580	0000_0000	0000_0000	OCOTP_SRK0
0x21B_C590	0000_0000	0000_0000	OCOTP_SRK1
0x21B_C5A0	0000_0000	0000_0000	OCOTP_SRK2
0x21B_C5B0	0000_0000	0000_0000	OCOTP_SRK3
0x21B_C5C0	0000_0000	0000_0000	OCOTP_SRK4
0x21B_C5D0	0000_0000	0000_0000	OCOTP_SRK5
0x21B_C5E0	0000_0000	0000_0000	OCOTP_SRK6
0x21B_C5F0	0000_0000	0000_0000	OCOTP_SRK7
0x21B_C600	0000_0000	0000_0000	OCOTP_RESP0
0x21B_C610	0000_0000	0000_0000	OCOTP_HSJC_RESP1
0x21B_C620	0000_0000	0000_0000	OCOTP_MAC0
0x21B_C630	0000_0000	0000_0000	OCOTP_MAC1
0x21B_C660	0000_0000	0000_0000	OCOTP_GP1
0x21B_C670	0000_0000	0000_0000	OCOTP_GP2
0x21B_C6D0	0000_0000	0000_0000	OCOTP_MISC_CONF
0x21B_C6E0	0000_0000	0000_0000	OCOTP_FIELD_RETURN
0x21B_C6F0	0000_0000	0000_0000	OCOTP_SRK_REVOKE

Firstly I thought I can't write the shadow fuses because the OCOTP_LOCK is not configured as on the SabreLite.

BUT, on the both board this register has the same value ... So I start to read in detail the features of each fuse in order to understand what stops me to write some shadow registers.

Because it's a long, complicated work and I'm not sure to succeed, I ask the question here.

Q: Does someone have an idea about why I can't proceed the the manipulation as the SabreLite on the RIoTboard ?? Does the problem come from the fuses ?

Don't hesitate to ask me more information,

Thank you for your help.

Fabien.

Re: Shadow Registers Read/Write

Yuri — Tue, 31 May 2016 06:58:05 GMT

Hello,

Perhaps the problem relates to different U-boot versions for

the SabreLite and the RIoTboard. Please try using recent NXP

U-boot version.

Have a great day,
Yuri

-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------

Re: Shadow Registers Read/Write

fmajeric — Tue, 31 May 2016 07:19:54 GMT

Hello,

Thank you for your answer.

I will try it as soon as possible.

I think you are right because the last time I want to use the CAAM through its registers but I can with JTAG.

Then I change the U-boot and the CAAM registers were mapped in the RAM memory.

I come back to give the result.

Have a nice day,

Fabien.

i.MX ProcessorsのトピックRe: Shadow Registers Read/Write

Shadow Registers Read/Write

Re: Shadow Registers Read/Write

Re: Shadow Registers Read/Write