Blowing fuses through AHB in the iMX53

[alexandrenin]

Hello everybody in the i.MX community :smileyhappy:,

we have a problem when trying to access the IIM module (to blow the fuses) of an iMX53 via AHB, which simply seems not possible so far (we already developed the same for an iMX6 and we didn't have this problem).

We have already found a way to do it through APB and the core registers (using ARM assembly instructions), but we would still like to know why it is not possible to do it through AHB.

So, according to the iMX53 reference manual, the IIM is a peripheral component defined in the AIPSTZ-2- Off Platform address space. Therefore:

1. Is some special configuration of the AHB to IP Bridge (AIPSTZ) required? 
The reference manual defines the AIPSTZ_OPACRs registers set, as the set of registers controlling the access levels for each block/module. Therefore and to reach the IIM, the AIPSTZ-2-OPACR6 is the register which should be set in this case. The problem here is that the address where to find this register (PACR0_Offset for AIPSTZ-2) is not properly defined in the manual, or we cannot find it (see iMX53_support_pic1.jpg attached).

2. Once point 1. is clear, under which address should we find the IIM module (through the AHB)? Should it be found under the address defined in the System Memory Map (see iMX53_support_pic2.jpg attached)?

Clearing this two points should be enough for us to clear the topic as well.

Also, we have an additional question:

- We have seen that other debug tools use the address 0xC0008000 to access the core (ARM Debug Unit) via APB, while the reference manual defines the address as 0x40008000. We have tested it and it seems the core is reachable under both addresses so, why is that so?

PS: the hardware we are using is the NXP's i.MX53 Quick Start Board.

Thank your very much in advance for the support received.

[igorpadykov]

one can look at example in obds ../drivers/fuse 
Lab and Test Software (2)
On-Board Diagnostic Suit for the i.MX53 Quick Start Board (REV 2011.39)
http://www.nxp.com/products/power-management/pmics/pmics-for-i.mx-processors/i.mx53-quick-start-boar...

Best regards
igor

[alexandrenin]

Hi again Igor,

it is already working. The problem was that I was not setting correctly the value for the fuse row address field. I've found in another entry in this same forum how to do it:

So for fuse at absolut address 0x63F98878 we would have 

IIM_base address = 0x63F98000
Fuse row addres inside IIM = 0x878 = 0x800 + 0x78 -> 0x78 / 4 = 30 = 0x1E

I unterstand it now: the fuse row address within the bank is based on 8 bit addressing, while the absolut addresses used within the IP bus use 32 bit accesses.

Thank you very much Igor for your time and support. :smileyhappy:

[alexandrenin]

Hi Igor,

the script at obds ../drivers/fuse seems to do exactly what we are doing, setting the same bits; the order is also the same.

Therefore I don't know why it is not working. To try to figure this out, I would have yet a couple of questions:

1. How is a  fuse row address defined? From my understanding, the row address is the lower byte of the IIM address .E.g., for fuse  row at IIM address 0x0860 (absolut address 0x63F98860, user fuse row), the fuse bank will be 0 and the row address will be 0x60. Is that right?

2. Should it bring the same result doing a explicit fuse sense cycle than making a bus (AHB) read access to the fuse address (e.g. 0x63F98860, user fuse), after a power cycle?

3. Is there some pre-requisite (power enable, clock enable..) which we might be forgetting about? I have already asserted the EFUSE_PROG_SUPPLY_GATE bit of the CCM_CGPR register and checked that the "iim clocks" field in the CCM_CCGR0 reg is set to 1 as well. Also, VDD_FUSE has a level of 3,3V.

[alexandrenin]

Hi Igor,

I didn't know there is some source code available in there. I'm going to have a look.

Thank your very much.

[igorpadykov]

Hi Alexandre

1. PACR0_Offset =0x40, that is AIPSTZ-2 0xBASE_0040
you can enter service request to obtain more full chapter  
2.correct.
3. 0x40008000 is for ARM Debug Unit
0xC0008000 belongs to CSD1 DDR (B000_0000-EFFF_FFFF)
according to Table 2-1. System Memory Map i.MX53 Reference Manual
http://www.freescale.com/files/32bit/doc/ref_manual/iMX53RM.pdf

Best regards
igor
-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------

[alexandrenin]

Hi Igor,

first, thanks for your answer.

Regardind question 1, what I need to know is exactly this BASE value of the 0xBASE_4000 address. 

[igorpadykov · Accepted solution]

63F0_0000 as described in Table 2-1. System Memory Map i.MX53 RM

Best regards
igor

[alexandrenin]

Hello again,

we have one last issue:

When already trying to blow a couple of user fuses to test our routines (e.g. at address 0x63F98860, so IIM address is 0860 and fuse bank is #0), we write the word 0xAA into the IIM_PREG_P reg and then set to 1 the bit PRG (though the core, APB) of the IIM_FCTL_reg. After doing this  and waiting a short time we can see the PRGD bit of the IIM_STAT reg is asserted to 1, indicating operation completed. Also no bit is asserted in the IIM_ERR reg.

The content of the IIM_UA  and the IIM_LA (which are set before writting 0xAA to IIM_PREG_P), to blow the fuse [0] at address 0x63F98860 are:

IIM_LA = 0b0000_0000

IIM_UA = 0b0000_0011

The problem comes when we'd like to verify that the fuse is actually blown. Can be a fuse row read by just reading from its IIM address (normal AHB bus access), or an explicit sense cycle is required?? Of course we understand that to do a bus read access for a fuse row, a power cycle must be done so that the row can be sensed and the data stored into the cache.

In both ways (by AHB access to fuse absolut address after power supply and by triggering and explicit sense cycle), we can only read 0b0000_0000 after having "in theory" blown the selected fuse, so we cannot be sure whether what is not working is the reading (or sensing) or the blowing.

Thank you very much in advance.

[alexandrenin]

Hello Igor,

now it works. After setting the AIPSTZ-2-OPACR6 register to 0b0000, we can reach the IIM via AHB. The problem was simply that we couldn't identify the address 0x63F00000 as the AIPSTZ-2-OPACRn registers set base address.

Thank you very much for your support.