Access to OCOTP registers from SCU on IMX8QM leads to hang

[bulat_a]

Hi all,

I want to write some shadow register for testing purposes before real fuse burning.

When I'm reading any registers of OCOTP from SCU is ok, but if I try to write to any part of OCOTP it leads to SCU hang.

I would like to use SCFW API but the documentation has no details on how to call SCFW API to write only to shadow register via SECO (as below what should I add to word parameter to don't lock fuse and write only to shadow registers without real fuse blow?)

From SCFW API guide:

"The command is passed as is to SECO. SECO uses part of the word parameter to indicate if the fuse should be locked after programming. See the "Write common fuse" section of the Security Reference Manual (SRM) for more info. "

From SRM guide:

"Please refer to the SCFW API Reference Guide ..."

Looks like the OCOTP access is locked for SCU by SECO, but the lifecycle currently is NXP closed:

seco info
SECO FW Version = Version 3.7.4, Commit d63fdb21
ADM Lifecycle   = 32

As said in "iMX8QM Reference Manual" the SCU should lose access to fuse when it becomes:
"OEM Closed".

Could you please clarify this moment?

Regards,

Bulat

[Maurizio_M]

.

[Yuri]

Hello,

  The API does not support fuse shadow write.

https://imxdev.gitlab.io/tutorial/Burning_eFuses_on_i.MX8_and_i.MX8x_families/

Regards,
Yuri.

[bulat_a]

Thanks for the reply, @Yuri 

But why direct write access to OCOTP registers (not only to shadow but to control register also, starting from 0x20530000) leads to SCU hangs, in the same time I can perform a write operation to 0x20540000). Read operations work fine - thus, I don't think it has some problem with clocks.

The SCU has a grant to OTP when I checked it with "dump rm".

Also if I try to perform a write operation to some Reserved memory region it will return the error, not hangs (Guess it controls in some way using XRDC):

>$ mm 0x27000000 0
Unknown err (11)!

>$ md 0x27000000
27000000: ???????? ???????? ???????? ????????
27000010: ???????? ???????? ???????? ????????
27000020: ???????? ???????? ???????? ????????
27000030: ???????? ???????? ???????? ????????

>$ md 0x20530000
20530000: 00000011 00000011 00000011 00000011
20530010: 00000002 00000002 00000002 00000002
20530020: 00000000 00000000 00000000 00000000
20530030: 00000000 00000000 00000000 00000000

>$ mm 0x20530000 0

Here SCU just hangs

Regards,

Bulat

[Yuri]

@bulat_a 
Hello,

I think the problem concerns the fact, that "the sc_misc_otp_fuse_write()
API function can be only called by the owner of the SC_R_SYSTEM resource,
in the current BSP implementation this resource is owned by the ARM Trusted
Firmware running on EL3 Secure exception level."

https://imxdev.gitlab.io/tutorial/Burning_eFuses_on_i.MX8_and_i.MX8x_families

UUU or U-boot may be used for writing.

Regards,
Yuri.

[bulat_a]

Hello @Yuri ,

The owner of resources S_RC_OTP is SCU, the ATF is kind of a mediator between uboot and SCU,

the sc_misc_otp_fuse_write is handled by SCU to send command OTP_Write to SECO firmware and it works but burns fuses via SECO Firmware.

the commands where I wrote directly to memory was performed in SCU, (not in uboot)

the Uboot has no access to OCOTP control registers(and shouldn't have), it can only ask the SCU to perform the operation of burning fuses via SECO firmware.

But SCU shall have access to the OCOTP control registers itself also, not only via SECO firmware

I want to have an access to control registers, to test fuses with shadow registers without real burning the fuses.

Regards,

Bulat

[Yuri]

@bulat_a 
Hello,

    Users can build SCU FW porting kit with debug terminal enable.
In the debug terminal users can program eFuses with the fuse.w command,
similar to U-Boot, the user should provide the "Fuse row Index" as the word
parameter.

Regards,
Yuri.

[bulat_a]

Hi @Yuri 

thanks for the reply, I know that it can be used, it does the same as mentioned before:

     "the sc_misc_otp_fuse_write is handled by SCU to send command OTP_Write to SECO firmware and it works but burns fuses via SECO Firmware."

But it doesn't provide the access to the shadow memory of OTP.

[Yuri]

@bulat_a 
Hello,

    It is impossible for the customer to write the shadow registers without programming the fuses.

Regards,
Yuri,

[fmonte]

That's weird, your colleague here stated that shadow registers can be programmed:

https://community.nxp.com/t5/i-MX-Processors/iMX8QM-Fuses-programming/m-p/1365095#M182491

Moreover, the RM states that once the fuses are burnt, it is not possible to program the shadows anymore. To sum it up, there are no shadow registers.