Flashing fuses on custom imx6 board

[kylekenj]

We are trying to bring up our custom board (based upon i.MX6 and the SABRE Lite schematic). We have made substantial progress, and have been able to flash to RAM and to the SD card using the mfgtool, but are having trouble now booting off of the SD card (specifically trying to boot off of the SD3 slot). We need to be able to change the boot mode to boot from the sd card.

Our board has pins BOOT_MODE0 and BOOT_MODE1, but no additional pins for setting up boot modes (as are available in the SABRE SD design) without flashing fuses. So our way forward is to flash fuses, but we want to make sure we are doing it correctly.

We have found two ways of flashing fuses:

Option 1

From "Manufacturing Tool V2 Quick Start Guide" associated with the mfgtool documents, we found the following three suggested lines of code (to be added to the configuration file ucl2.xml):

<CMD state="Updater" type="push" body="$ ls /sys/fsl_otp ">Showing HW_OCOTP fuse bank</CMD>

<CMD state="Updater" type="push" body="$ echo 0x11204154 > /sys/fsl_otp/HW_OCOTP_CFG1">write 0x11204154 to HW_OCOTP_CFG1 fuse bank</CMD>

<CMD state="Updater" type="push" body="$ cat /sys/fsl_otp/HW_OCOTP_CFG1">Read value from HW_OCOTP_CFG1 fuse bank</CMD>

NOTE: we believe (and added to the above lines of code) that “HW_OCOTP_CFG1” is the fuse bank we need to change (IMX6DQRM chapter 8 table 8-8.) We also believe that the fuse value is 0x11204154 (according to the same table, based upon the returned cat value on CFG1 fuse bank of 0x112041d4.)

Question: can you confirm this fuse bank and value (HW_OCOTP_CFG1,  0x11204154)?

Option 2

The other option is to use the uboot to flash the fuses. This is done as show on this link https://community.freescale.com/docs/DOC-95458. This link indicates that we should run imxotp from uboot as follows:

imxotp blow [--force] <index> <value>

NOTE: the “<index>” is the hex representation for the fuse name. We think that the “<value>” is the fuse value 0x11204154 (also according to Reference Manual, chapter 8 table 8-8).

We do not know the hex value for the “<index>”.

Questions:

(1) Are we correct in trying thus to change “<index>” and “<value>” in order to boot from the SD card?

(2) Is the fuse value 0x11204154 correct?

(3) Is CFG1 the correct fuse bank for us to use, and if so what is the correct “<index>” hex value?

[kylekenj]

Got it to work flashing:

imxotp blow --force 5 0x3040

imxotp blow --force 6 0x10

in the u-boot using tables 5-7 and 8-15 in the reference manual.

Thanks

[kylekenj]

From the fuse map we flashed 0x104 to index 5. We believe this sets the board to boot off the sd card and port sd3. Are we missing anything and does this sound correct. Thanks.

[AnsonHuang · Accepted solution]

Hi, Kyle

    I think the fuse you said is incorrect, please double check carefully.

OPTION1:

     I saw from our i.MX6Q SabreSD board, if want to boot from SD3, then below setting is needed:

BT_CFG1_7:  0

BT_CFG1_6:  1

BT_CFG1_5:  0

BT_CFG1_4:  X

BT_CFG2_4:  1

BT_CFG2_3:  0

     This BT_CFG means BOOT_CFG, in the fuse map, so it should be BOOT_CFG1 and BOOT_CFG2, it should be mapped to address 0x21bc450, but you said HW_OCOTP_CFG1, its address is 0x21bc420, it is for SJC_CHALL/UNIQUE_ID, it is incorrect. Please read 0x21bc450, it should be matching the current boot mode of your board, then try to modify it to SD3.

OPTION2:

Questions:

(1) Are we correct in trying thus to change “<index>” and “<value>” in order to boot from the SD card?

[Anson] Yes, you can just program the fuse using imxotp command in uboot, just make sure the index and value is correct.

(2) Is the fuse value 0x11204154 correct?

[Anson] I don't think so, as the fuse address you read is incorrect, you read OCOTP_CFG1, it is not BOOT_CFG1, you should read 0x21bc450, please double check. You can also get description of OCOTP_CFG1 in RM, 46.4.11, it is not for configuring boot mode!

(3) Is CFG1 the correct fuse bank for us to use, and if so what is the correct “<index>” hex value?

[Anson] index means the address minus 0x21bc400, and then divided by 0x10, for example, if the fuse address is 0x21bc450, the offset is '50', so the index is 5, if the address is 0x21bc420, then the index is 2. You can use imxotp read 2 to get the value of 0x21bc420, it should be equal to the value you got from OCOTP_CFG1.

[monicaruiz]

Hi,

We're trying to program OTP bits using MFgtool with kernel 4.1.15-1.1.0 in order to boot from fuses.

We have followed the steps found in Manufacturing Tool V2 (MFGTool2) Quick Start Guide so we added the next lines to our ucl2.xml file:

<CMD state="Updater" type="push" body="$ ls /sys/fsl_otp ">Showing HW_OCOTP fuse bank</CMD>
<CMD state="Updater" type="push" body="$ cat /sys/fsl_otp/HW_OCOTP_CFG4">Read the BOOT_CFG fuses</CMD>

<CMD state="Updater" type="push" body="$ cat /sys/fsl_otp/HW_OCOTP_CFG5">Read the BT_FUSE_SEL fuse</CMD>

<CMD state="Updater" type="push" body="$ echo 0x00002840 > /sys/fsl_otp/HW_OCOTP_CFG4">Burn BOOT_CFG fuses</CMD>

<CMD state="Updater" type="push" body="$ echo 0x00000010 > /sys/fsl_otp/HW_OCOTP_CFG5">Burn BT_FUSE_SEL fuse</CMD>

It didn´t work and the next errors were showed in the MfgTool.log:

ModuleID[2] LevelID[10]: ExecuteCommand--Push[WndIndex:0], Body is $ ls /sys/fsl_otp

ModuleID[2] LevelID[1]: PortMgrDlg(0)--MSCDevice--Command Push(no file) excute failed

ModuleID[2] LevelID[10]: CmdOperation[0], current command executed failed, so SetEvent(hDevCanDeleteEvent)

We also used TeraTerm and it showed the next:

UTP: received command '$ ls /sys/fsl_otp '

UTP: executing "ls /sys/fsl_otp "

ls: cannot access /sys/fsl_otp: No such file or directory

UTP: sending Non-success to kernel for command $ ls /sys/fsl_otp .

utp_poll: exit with status 512

We checked and the folder /sys exists but not /sys/fsl_otp at least in ramfs_mfg because we are able to access this directory when we boot from Flash.

Could you help us with this issue?

Thanks in advance.

[han_xu]

I think the reason might be CONFIG_FSL_OTP was not added in imx_v7_mfg_defconfig, please change the config and rebuild the kernel for mfg purpose, then copy the zImage to mfgtools/Profiles/Linux/OS Firmware/firmware folder and try again.

[mukelarvin]

kylekenj Similar to your board, our board (IMX6DL) only has BOOT_MODE0 and BOOT_MODE1 and needs to boot off SD3. Blowing the fuses in u-boot as you describe works for me.

From my understanding, the command "imxotp blow --force 5 0x3040" does the following.

The command "imxotp blow --force 6 0x10" does the following:

But now I would like to add this to my MFGtool process. AnsonHuang says that /sys/fsl_otp/HW_OCOTP_CFG1 is not BOOT_CFG1. How do I write to the correct addresses if I don't have BOOT_CFG1/2 in my filesystem?

[ShawnBai]

Thank you,. what you said is really helpful..

And

From platform-imx-ocotp.c, we have code as follows, but how do we know the relationship between BANK in code and the bank in RM?

Anyway, seems my questioin is answered in this post.

Thank you again.

=============================================================================

#ifdef CONFIG_SOC_IMX6Q

#define BANK(a, b, c, d, e, f, g, h)   \

  {\

  ("HW_OCOTP_"#a), ("HW_OCOTP_"#b), ("HW_OCOTP_"#c), ("HW_OCOTP_"#d), \

  ("HW_OCOTP_"#e), ("HW_OCOTP_"#f), ("HW_OCOTP_"#g), ("HW_OCOTP_"#h) \

  }

#define BANKS          (16)

#define BANK_ITEMS     (8)

static const char *bank_reg_desc[BANKS][BANK_ITEMS] = {

  BANK(LOCK, CFG0, CFG1, CFG2, CFG3, CFG4, CFG5, CFG6),

  BANK(MEM0, MEM1, MEM2, MEM3, MEM4, ANA0, ANA1, ANA2),

  BANK(OTPMK0, OTPMK1, OTPMK2, OTPMK3, OTPMK4, OTPMK5, OTPMK6, OTPMK7),

  BANK(SRK0, SRK1, SRK2, SRK3, SRK4, SRK5, SRK6, SRK7),

  BANK(RESP0, HSJC_RESP1, MAC0, MAC1, HDCP_KSV0, HDCP_KSV1, GP1, GP2),

  BANK(DTCP_KEY0,  DTCP_KEY1,  DTCP_KEY2,  DTCP_KEY3,  DTCP_KEY4,  MISC_CONF,  FIELD_RETURN, SRK_REVOKE),

  BANK(HDCP_KEY0,  HDCP_KEY1,  HDCP_KEY2,  HDCP_KEY3,  HDCP_KEY4,  HDCP_KEY5,  HDCP_KEY6,  HDCP_KEY7),

  BANK(HDCP_KEY8,  HDCP_KEY9,  HDCP_KEY10, HDCP_KEY11, HDCP_KEY12, HDCP_KEY13, HDCP_KEY14, HDCP_KEY15),

  BANK(HDCP_KEY16, HDCP_KEY17, HDCP_KEY18, HDCP_KEY19, HDCP_KEY20, HDCP_KEY21, HDCP_KEY22, HDCP_KEY23),

  BANK(HDCP_KEY24, HDCP_KEY25, HDCP_KEY26, HDCP_KEY27, HDCP_KEY28, HDCP_KEY29, HDCP_KEY30, HDCP_KEY31),

  BANK(HDCP_KEY32, HDCP_KEY33, HDCP_KEY34, HDCP_KEY35, HDCP_KEY36, HDCP_KEY37, HDCP_KEY38, HDCP_KEY39),

  BANK(HDCP_KEY40, HDCP_KEY41, HDCP_KEY42, HDCP_KEY43, HDCP_KEY44, HDCP_KEY45, HDCP_KEY46, HDCP_KEY47),

  BANK(HDCP_KEY48, HDCP_KEY49, HDCP_KEY50, HDCP_KEY51, HDCP_KEY52, HDCP_KEY53, HDCP_KEY54, HDCP_KEY55),

  BANK(HDCP_KEY56, HDCP_KEY57, HDCP_KEY58, HDCP_KEY59, HDCP_KEY60, HDCP_KEY61, HDCP_KEY62, HDCP_KEY63),

  BANK(HDCP_KEY64, HDCP_KEY65, HDCP_KEY66, HDCP_KEY67, HDCP_KEY68, HDCP_KEY69, HDCP_KEY70, HDCP_KEY71),

  BANK(CRC0, CRC1, CRC2, CRC3, CRC4, CRC5, CRC6, CRC7),

};

static const struct mxc_otp_platform_data imx6q_otp_platform_data = {

  .fuse_name = (char **)bank_reg_desc,

  .clock_name = "iim_clk",

  .fuse_num = BANKS * BANK_ITEMS,

};

const struct imx_otp_data imx6q_otp_data = {

  .iobase = OCOTP_BASE_ADDR,

  .pdata = (struct mxc_otp_platform_data *)&imx6q_otp_platform_data,

};

#undef BANK

#undef BANKS

#undef BANK_ITEMS

#endif /* ifdef CONFIG_SOC_IMX6Q */

=============================================================================

[kylekenj]

Thanks for your help. Just trying to make sure before I do anything. When I read in index 2 I get the same value as HW_OCOTP_CFG1. Index 5 is the value I should be looking at and there I get a value of 0x0. What should I change the value to? When I look at the RM, 46.4.11 is not there is says to ask a freescale rep for fuse map. Thanks again.

Kyle

[Yuri]

Please use Chapter 5 (Fusemap) of the Reference Manual.