IMX6UL OTP Memory Addressing Anomaly

logman · ‎07-03-2023

Hello,

I have an anomaly in the addressing of OTP memory access.

I am using uboot to write to the OTP shadow registers, then I am reading OTP in my application using the nvmem file access in /sys/bus/nvmem/devices/imx-ocotp0/nvmem.
(Eventually, I will use the prog command to permanently write fuse OTP memory, but I'm just using override while in development.)

For experimentation, I am overriding bank 12 word 7, with value 0x12000007, and then read this value back to verify it.
I do the same kind of thing with banks 13, 14, 15, so I can track bank word values to memory addressed values in the nvmem dump.

When I subsequently boot the device (not reboot, which would reset the overrides!) the nvmem file access addressing does not make sense.
I expected the bank/word byte address to start at 4*(8*b + w), where b is bank and w is word. e.g. for bank 15, word 7, the byte address is 4*(8*15 + 7) = 508 = 0x1fc, so the word occupies bytes at 0x1fc to 0x1ff.
and bank 12, word 0 should start at byte address 4*(8*12 + 0) = 0x180.

However, my value (0x12000000) for bank 12, word 0 actually appears at byte address 0x1c0, which is where bank 14, word 0 should be.
And my value (0x12000007) for bank 12, word 7 actually appears at byte address 0x1dc, which is where bank 14, word 7 should be.
Furthermore, the values for banks 14 and 15 do not appear anywhere in the nvmem dump.

Please see below for uboot command log and subsequent nvmem dump.

Can anyone suggest a reason for this anomaly? Is my address arithmetic correct? Why can't I see banks 14 & 15 in the nvmem dump?

Thanks,
Tom.

NAME="NXP i.MX Release Distro"
VERSION="5.10-hardknott (hardknott)"
VERSION_ID=5.10-hardknott

Note, in the fuse command, bank address 12 is DECIMAL not hex, however the value IS in hex. For hex bank address, you would use "fuse override 0xc 0 12000000"
=> fuse override 12 0 12000000
Overriding bank 12 word 0x00000000 with 0x12000000...
=> fuse override 13 0 13000000
Overriding bank 13 word 0x00000000 with 0x13000000...
=> fuse override 14 0 14000000
Overriding bank 14 word 0x00000000 with 0x14000000...
=> fuse override 15 0 15000000
Overriding bank 15 word 0x00000000 with 0x15000000...
=> fuse override 12 7 12000007
Overriding bank 12 word 0x00000007 with 0x12000007...
=> fuse override 13 7 13000007
Overriding bank 13 word 0x00000007 with 0x13000007...
=> fuse override 14 7 14000007
Overriding bank 14 word 0x00000007 with 0x14000007...
=> fuse override 15 7 15000007
Overriding bank 15 word 0x00000007 with 0x15000007...
=> fuse read 12 0
Reading bank 12:

Word 0x00000000: 12000000
=> fuse read 13 0
Reading bank 13:

Word 0x00000000: 13000000
=> fuse read 14 0
Reading bank 14:

Word 0x00000000: 14000000
=> fuse read 15 0
Reading bank 15:

Word 0x00000000: 15000000
=> fuse read 12 7
Reading bank 12:

Word 0x00000007: 12000007
=> fuse read 13 7
Reading bank 13:

Word 0x00000007: 13000007
=> fuse read 14 7
Reading bank 14:

Word 0x00000007: 14000007
=> fuse read 15 7
Reading bank 15:

Word 0x00000007: 15000007

root@smartcom:~# hexdump /sys/bus/nvmem/devices/imx-ocotp0/nvmem
0000000 8003 00b2 6b3c d965 79d4 3d28 0050 78f2
0000010 2502 0241 0000 0000 0040 0008 0000 0000
0000020 0080 0000 0000 0000 0093 0000 0000 0000
0000030 0000 0000 0000 0000 0569 5955 0000 0000
0000040 bada bada bada bada bada bada bada bada
*
0000060 0000 0000 0000 0000 0000 0000 0000 0000
*
0000080 0000 0000 0000 0000 8221 287e 8034 0000
0000090 0000 0000 bada bada 0000 0000 0000 0000
00000a0 0000 0000 0000 0000 0000 0000 0000 0000
00000b0 0000 0000 0040 0000 0000 0000 0000 0000
00000c0 0000 0000 0000 0000 0000 0000 0000 0000
*
0000100 0801 5500 29d8 0000 2d20 da01 0801 5500
0000110 2a04 0000 f11a 9afc 2003 5500 d000 0091
0000120 6860 b110 68a6 42ae d300 462e 68e0 4540
0000130 d001 f6e5 9cfe f6e5 9d00 0000 0000 0000
0000140 0000 0000 0000 0000 0000 0000 0000 0000
*
00001c0 0000 1200 0000 0000 0000 0000 0000 0000
00001d0 0000 0000 0000 0000 0000 0000 0007 1200
00001e0 0000 1300 0000 0000 0000 0000 0000 0000
00001f0 0000 0000 0000 0000 0000 0000 0007 1300
0000200

logman · ‎07-05-2023

Thanks for taking the time to read and respond Dhruvit. Your answer makes sense.

However, it leads me to another question/problem...

Bank 8 starts at address 0x140
Bank 9 starts at address 0x160
etc...
Bank 13 starts at address 0x1e0
Bank 14 starts at address 0x200
Bank 15 starts at address 0x220

This addressing makes sense.

I've experimented by writing to OTP shadow registers using boot fuse override, then reading via the linux 'nvmem' file using:
hexdump -C -v /sys/bus/nvmem/devices/imx-ocotp0/nvmem

I can see banks 8 to 13 appear at addresses 0x140 to 0x1ff.
However, the nvmem hexdump only gives me read access up to 0x1ff,
so I cannot read banks 14 and 15 at addresses 0x200 and 0x220.

Can you suggest how I can access banks 14 and 15 from the linux application please?
I can access them from uboot fuse commands, but I can't see them in nvmem:

# hexdump -C -v /sys/bus/nvmem/devices/imx-ocotp0/nvmem
00000000 03 80 b2 00 3c 6b 65 d9 d4 79 28 3d 50 00 f2 78 |....<ke..y(=P..x|
00000010 02 25 41 02 00 00 00 00 40 00 08 00 00 00 00 00 |.%A.....@.......|
00000020 80 00 00 00 00 00 00 00 93 00 00 00 00 00 00 00 |................|
00000030 00 00 00 00 00 00 00 00 69 05 55 59 00 00 00 00 |........i.UY....|
00000040 da ba da ba da ba da ba da ba da ba da ba da ba |................|
00000050 da ba da ba da ba da ba da ba da ba da ba da ba |................|
00000060 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000070 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000080 00 00 00 00 00 00 00 00 21 82 7e 28 34 80 00 00 |........!.~(4...|
00000090 00 00 00 00 da ba da ba 00 00 00 00 00 00 00 00 |................|
000000a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
000000b0 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 |....@...........|
000000c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
000000d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
000000e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
000000f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000100 01 08 00 55 d8 29 00 00 20 2d 01 da 01 08 00 55 |...U.).. -.....U|
00000110 04 2a 00 00 1a f1 fc 9a 03 20 00 55 00 d0 91 00 |.*....... .U....|
00000120 60 68 10 b1 a6 68 ae 42 00 d3 2e 46 e0 68 40 45 |`h...h.B...F.h@E|
00000130 01 d0 e5 f6 fe 9c e5 f6 00 9d 00 00 00 00 00 00 |................|
00000140 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000150 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000160 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000170 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000180 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000190 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
000001a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
000001b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
000001c0 12 12 12 12 00 00 00 00 00 00 00 00 00 00 00 00 |................|
000001d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
000001e0 13 13 13 13 00 00 00 00 00 00 00 00 00 00 00 00 |................|
000001f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000200

Dhruvit · ‎07-06-2023

Hi @logman,

I hope you are doing well.

Thanks for pointing out this issue.

This issue seems to be due to nregs value in imx6ul_params in /drivers/nvmem/imx-ocotp.c driver.
(which is limited to 128)

Could you please try after making the below change in /drivers/nvmem/imx-ocotp.c driver.

static const struct ocotp_params imx6ul_params = {
- .nregs = 128,
+ .nregs = 144
.bank_address_words = 0,
.set_timing = imx_ocotp_set_imx6_timing,
.ctrl = IMX_OCOTP_BM_CTRL_DEFAULT,
};

I hope it helps!

Thanks & Regards,
Dhruvit Vasavada

logman · ‎07-10-2023

Hi @Dhruvit

I can confirm that the patch worked and I can now read all 0x240 bytes in the nvmem file.

Please advise whether NXP will provide the fix in future releases of the driver, otherwise there will be a conflict for my patch.

Regards,

Tom.

Dhruvit · ‎07-12-2023

Hi @logman,

I hope you are doing well.

We have forwarded this issue to BSP maintainers.

It will be fixed in the next release.

Can I mark this case as close if there are no further queries?

Thanks & Regards,
Dhruvit Vasavadad

Dhruvit · ‎07-05-2023

Hi @logman,

I hope you are doing well.

One should not use the above-mentioned equation.

To get the correct offset, One should see 35.5 OCOTP Memory Map/Register Definition in RM.

For Example,

fuse => bank 12 & word 0.
Then find out offset from 35.5 OCOTP Memory Map/Register Definition for bank12 & word 0;

Here, offset = 0xB00 & offset of the first word in 0th bank is 0x400.

Now, (0xB00 - 0x400)/0x4 = (0x700)/0x4 = 0x1C0.

I hope it helps!

Thanks & Regards,
Dhruvit Vasavada

IMX6UL OTP Memory Addressing Anomaly

IMX6UL OTP Memory Addressing Anomaly

i.MX6UL