IMX93 OCOTP Permissions

[Jarbo]

Hello,

I am working with an IMX93 and I am trying to record the MAC fuses (0x4ec and 0x4f2), the problem I am encountering is that it is giving me a permissions error and I cannot find OCOTP_LOCK to be able to record these fuses, could you please help me?

Thank you so much!

PS: NVMEM_PATH = "/sys/devices/platform/soc@0/47510000.efuse/fsb_s400_fuse0/nvmem"

[phil331]

Hi,

I'm also looking how I can program the i.MX93 MAC addresses into eFUSE...

I notice the kernel "fsl,imx93-ocotp" (imx-ocotp-fsb-s400.c) driver only support reads and does so via the "fsl,imx93-ele" driver. It looks like only Edgelock Enclave can do the actual read/writes to eFUSE. Is there no way to do this from user space?

So, we can only program the MAC addresses using uboot, right?

Thanks

[phil331]

Some info I found out that may be useful...

The i.MX93 rev.0 silicon uses different byte layout for MAC2 in eFUSE than rev.1 and later. See https://github.com/nxp-imx/uboot-imx/blob/lf_v2023.04/arch/arm/mach-imx/imx9/native/soc.c#L537

With the lf-6.1 BSP, you can only program eFUSE from u-boot, but lf-6.6 BSP adds the ability to program them from Linux userspace.

[Jarbo]

Hello again,

I still have doubts, I'm trying to write the fuses directly through the boot and write the MACs (from the image, extracted from the security manual) and I don't know where the lock fuse is to enable them, I can only read them, but I can't write.

[vikki]

From which document you got this "fuse bank" mapping?

[JorgeCas]

Hello,

The way you burned the fuse is correct.

Could you please try with the next?

fuse sense <bank> <word> [<cnt>] - sense 1 or 'cnt' fuse words, starting at 'word'

Also, did you check it on user space?

Best regards.

[Jarbo]

this?

[JorgeCas]

Yes, that command.

There is a lock bit field for MAC address fuses that is:

COM_DEVICE_ID1_LOCK in bank 0 word1 bit [6~8] and the behavior is as mentioned on the next image.

Could you please confirm?

Best regards.

[Jarbo]

Thanks for the response again,

I have read the BANK 0 WORD 1 and I have 2493, I have been able to observe the bits that you indicate and I see that I have it protected, should I write 000 at this address? that is 2413?

[JorgeCas]

Hello,

That is correct, usually these lock bits are unprotected.

Best regards.

[Jarbo]

I can't write these fuses, any other solution please?

[JorgeCas]

Hello,

Have you blown those fuses before?

I read them from EVK boards (A0 and A1 silicon revision), and the default value is the next:

Unfortunately, I cannot burn eFuses on our EVK boards, since we use them to test.

Best regards.

[Jarbo]

Hello, the steps are as follows:

nvmem_path = "/sys/devices/platform/soc@0/47510000.efuse/fsb_s400_fuse0/nvmem"
with open(nvmem_path, 'br+') as f:
    f.seek(seek_offset)
    f.write(pack('<L', value_to_write))

and it tells me that I don't have permissions

The offsets used are (0x4ec)

How should I do so that I could write the fuses of the Mac without it returning a permissions error?

[JorgeCas]

Hello,

I think that error is related to the offset.

On i.MX 93 one bank is equals to 8 words, so a bank cannot be more than 8 words, in the fuse map attached to the i.MX93 RM, “Bank 3 word 24” in reality is Bank 3 word 0, here a part of the correct order:

Here a small table to understand the offsets:

In the “i.MX Linux User's Guide”, section “13.2 NVMEM provider OCOTP”, says that “The 2nd parameter is from the first data in property reg of a NVMEM consumer, and this offset represents the OCOTP shadow register, to which a eFuse address is mapped.”, so the offset of the first word of each Bank is the number of the Bank times 0x20, for example if you want to kwon the offset of Bank 3 Word 0, the offset is 3 * 0x20 = 0x60, if you want to know the offset of Bank 1 Word 1, the offset is (1 * 0x20) + 4 = 0x24, offset of Bank 2 Word 3 = (2 * 0x20) + (0x4 * 0x3) = 0x4C.

Best regards.

[Jarbo]

Hello,

Thank you for the quick reply JorgeCas!

I understand what you are saying, but I am struggling to find the right offset value for the MAC addres 1 and 2. In the IMX93 fusemap document there is some flags with specific bank addres and word offset and other like the MAC are "Packed_FuseIndex":

Should I just divide the "Packed_FuseIndex" by 32 to get the offset?

Still getting the permissions problem with all the test done. I can read without any problem the fuses but can't write yet.

[JorgeCas]

Do you have access to the security reference manual?

Best regards.

[Jarbo]

No, I don't. I have requested it but I haven't been granted access. 

The formula for get the offset (Bank number * 8 + word) 39*8 + 317 = 629 that is very far away from 10144 :`)

I have attached in the DTS the following declarations:

[JorgeCas]

Hello,

The security reference manual word number is different compared to the Excel document.

Best regards.

[Jarbo]

Ok, i will wait for the access

And for the DTS? Do you think it is alright?

[JorgeCas]

I would leave it as is on our EVK reference device tree:

ocotp: efuse@47510000 {
	compatible = "fsl,imx93-ocotp", "syscon", "simple-mfd";
	reg = <0x47510000 0x10000>;
	#address-cells = <1>;
	#size-cells = <1>;

	imx93_uid: soc-uid@c0 {
		reg = <0xc0 0x10>;
	};

	eth_mac1: mac-address@4ec {
		reg = <0x4ec 0x6>;
	};

	eth_mac2: mac-address@4f2 {
		reg = <0x4f2 0x6>;
	};

	imx93_soc: imx93-soc {
		compatible = "fsl,imx93-soc";
		nvmem-cells = <&imx93_uid>;
		nvmem-cell-names = "soc_unique_id";
	};
};

Best regards.

[JorgeCas]

Hello,

Could you please share the process you are following and the log error?

Best regards.