Hello,
I am working with an IMX93 and I am trying to record the MAC fuses (0x4ec and 0x4f2), the problem I am encountering is that it is giving me a permissions error and I cannot find OCOTP_LOCK to be able to record these fuses, could you please help me?
Thank you so much!
PS: NVMEM_PATH = "/sys/devices/platform/soc@0/47510000.efuse/fsb_s400_fuse0/nvmem"
Hi Sir,
How to get MAC address information from uboot and kernel user mode.
Those information is base on i.MX93 EVK , A1 version CPU test.
Linux BSP is 6.6.36_210 BSP
Uboot mode try to use fuse read command to get ether mac address.
U-Boot SPL 2024.04+gde16f4f1722+p0 (Sep 02 2024 - 10:44:35 +0000)
SOC: 0xa1009300
LC: 0x2040010
PMIC: PCA9451A
PMIC: Over Drive Voltage Mode
DDR: 3733MTS
M33 prepare ok
Normal Boot
Trying to boot from BOOTROM
Boot Stage: Primary boot
image offset 0x8000, pagesize 0x200, ivt offset 0x0
Load image from 0x57400 by ROM_API
NOTICE: TRDC init done
NOTICE: BL31: v2.10.0 (release):lf-6.6.36-2.1.0
NOTICE: BL31: Built : 10:35:32, Aug 29 2024
U-Boot 2024.04+gde16f4f1722+p0 (Sep 02 2024 - 10:44:35 +0000)
Reset Status: POR
CPU: NXP i.MX93(52) Rev1.1 A55 at 1700 MHz
CPU: Industrial temperature grade (-40C to 105C) at 43C
Model: NXP i.MX93 11X11 EVK board
DRAM: 2 GiB
TCPC: Vendor ID [0x1fc9], Product ID [0x5110], Addr [I2C2 0x52]
SNK.Power3.0 on CC2
PDO 0: type 0, 5000 mV, 3000 mA [E]
PDO 1: type 0, 9000 mV, 3000 mA []
PDO 2: type 0, 15000 mV, 3000 mA []
PDO 3: type 0, 20000 mV, 3250 mA []
PDO 4: type 3, undefined
Requesting PDO 3: 20000 mV, 750 mA
Source accept request
PD source ready!
tcpc_pd_receive_message: Polling ALERT register, TCPC_ALERT_RX_STATUS bit failed, ret = -62
TCPC: Vendor ID [0x1fc9], Product ID [0x5110], Addr [I2C2 0x51]
TCPC: Vendor ID [0x1fc9], Product ID [0x5110], Addr [I2C2 0x50]
Core: 235 devices, 37 uclasses, devicetree: separate
MMC: FSL_SDHC: 0, FSL_SDHC: 1
Loading Environment from MMC... *** Warning - bad CRC, using default environment
[*]-Video Link 0adv7535_mipi2hdmi hdmi@3d: Can't find cec device id=0x3c
fail to probe panel device hdmi@3d
fail to get display timings
probe video device failed, ret -19
[0] lcd-controller@4ae30000, video
[1] dsi@4ae10000, video_bridge
[2] hdmi@3d, panel
adv7535_mipi2hdmi hdmi@3d: Can't find cec device id=0x3c
fail to probe panel device hdmi@3d
fail to get display timings
probe video device failed, ret -19
In: serial
Out: serial
Err: serial
BuildInfo:
- ELE firmware version 1.2.0-38f309fe
switch to partitions #0, OK
mmc1 is current device
UID: dc0f9a9a9ef24c7c85d3dc710b2772a7
flash target is MMC:1
Net:
Warning: ethernet@428a0000 (eth1) using random MAC address - 76:cf:21:69:dc:06
Warning: ethernet@42890000 (eth0) using random MAC address - 06:35:98:de:c3:db
eth0: ethernet@42890000, eth1: ethernet@428a0000 [PRIME]
Fastboot: Normal
Normal Boot
Hit any key to stop autoboot: 0
u-boot=>
u-boot=> fuse read 39 3 1
Reading bank 39:
Word 0x00000003: 00000000
u-boot=> fuse read 39 4 1
Reading bank 39:
Word 0x00000004: 00000000
u-boot=> fuse read 39 5 1
Reading bank 39:
Word 0x00000005: 00000000
u-boot=>
In linux user mode
root@imx93evk:~# ifconfig
eth0: flags=4099<UP,BROADCAST,MULTICAST> mtu 1500
ether 06:35:98:de:c3:db txqueuelen 1000 (Ethernet)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
eth1: flags=4099<UP,BROADCAST,MULTICAST> mtu 1500
ether 76:cf:21:69:dc:06 txqueuelen 1000 (Ethernet)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
device interrupt 104
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10<host>
loop txqueuelen 1000 (Local Loopback)
RX packets 90 bytes 7662 (7.4 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 90 bytes 7662 (7.4 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
root@imx93evk:~# hexdump /sys/devices/platform/soc@0/47510000.efuse/fsb_s400_fuse0/nvmem
0000000 26d8 0000 2493 0000 0490 0000 75c6 0000
0000010 009b 0000 7e00 0000 2692 0000 0002 0000
0000020 3600 0000 3493 0000 36db 0000 0000 0000
0000030 04b8 6e5f 0004 0000 83e8 7d62 0000 0000
0000040 0000 0000 0000 0000 0001 0000 01a0 0000
0000050 0000 0000 0000 0000 0000 0000 0000 0000
*
00000c0 0fdc 9a9a f29e 7c4c d385 71dc 270b a772
00000d0 0000 0000 0000 0000 0000 0000 0000 0000
*
00000f0 0000 0000 0000 0000 0000 0000 4000 0000
0000100 0000 0000 0000 0000 0000 0000 0000 0000
*
0000520 0001 0000 3f45 0799 6802 5500 ea3d 0000
0000530 f041 3001 2040 9001 b500 f000 f801 bd00
0000540 b500 f240 0084 f2c5 4021 6801 f011 0f01
0000550 d01f f240 0090 f2c5 4046 6801 f011 0f01
0000560 d117 f04f 0000 f2c5 7054 f44f 7183 f2c1
0000570 7104 f8c0 1200 f8d0 112c f011 0f03 d0fa
0000580 f8d0 1280 f8d0 1284 f640 30b8 f24f 73db
0000590 4798 bd00 0802 5500 5325 0000 f04d 3001
00005a0 0000 0000 0000 0000 0000 0000 0000 0000
*
0000640 0001 0000 6b7c edd6 1c02 5500 7ac8 0000
0000650 0040 2049 2d1b 3940 237f 7100 0049 5400
0000660 001b 5280 03c0 d65f 0000 0000 0000 0000
0000670 0000 0000 0000 0000 0000 0000 0000 0000
*
0000800
root@imx93evk:~#
We can't find any MAC address information in /sys/devices/platform/soc@0/47510000.efuse/fsb_s400_fuse0/nvmem
Does any kernel config setting to enable burn in / hexdump about ethernet mac address information ?
Hi,
I'm also looking how I can program the i.MX93 MAC addresses into eFUSE...
I notice the kernel "fsl,imx93-ocotp" (imx-ocotp-fsb-s400.c) driver only support reads and does so via the "fsl,imx93-ele" driver. It looks like only Edgelock Enclave can do the actual read/writes to eFUSE. Is there no way to do this from user space?
So, we can only program the MAC addresses using uboot, right?
Thanks
Some info I found out that may be useful...
The i.MX93 rev.0 silicon uses different byte layout for MAC2 in eFUSE than rev.1 and later. See https://github.com/nxp-imx/uboot-imx/blob/lf_v2023.04/arch/arm/mach-imx/imx9/native/soc.c#L537
With the lf-6.1 BSP, you can only program eFUSE from u-boot, but lf-6.6 BSP adds the ability to program them from Linux userspace.
Hello again,
I still have doubts, I'm trying to write the fuses directly through the boot and write the MACs (from the image, extracted from the security manual) and I don't know where the lock fuse is to enable them, I can only read them, but I can't write.
Hello,
The way you burned the fuse is correct.
Could you please try with the next?
fuse sense <bank> <word> [<cnt>] - sense 1 or 'cnt' fuse words, starting at 'word'
Also, did you check it on user space?
Best regards.
this?
Yes, that command.
There is a lock bit field for MAC address fuses that is:
COM_DEVICE_ID1_LOCK in bank 0 word1 bit [6~8] and the behavior is as mentioned on the next image.
Could you please confirm?
Best regards.
Thanks for the response again,
I have read the BANK 0 WORD 1 and I have 2493, I have been able to observe the bits that you indicate and I see that I have it protected, should I write 000 at this address? that is 2413?
Hello,
That is correct, usually these lock bits are unprotected.
Best regards.
I can't write these fuses, any other solution please?
I have same issue. fuse 0 1 report 2493 and I cannot write MAC2 fuse (addr 5). I just flashed MAC1 which works fine but cannot set MAC2. I didn't do any other use changes. Ideas please? Thanks.
Hello,
Have you blown those fuses before?
I read them from EVK boards (A0 and A1 silicon revision), and the default value is the next:
Unfortunately, I cannot burn eFuses on our EVK boards, since we use them to test.
Best regards.
Hello, the steps are as follows:
nvmem_path = "/sys/devices/platform/soc@0/47510000.efuse/fsb_s400_fuse0/nvmem"
with open(nvmem_path, 'br+') as f:
f.seek(seek_offset)
f.write(pack('<L', value_to_write))
and it tells me that I don't have permissions
The offsets used are (0x4ec)
How should I do so that I could write the fuses of the Mac without it returning a permissions error?
Hello,
I think that error is related to the offset.
On i.MX 93 one bank is equals to 8 words, so a bank cannot be more than 8 words, in the fuse map attached to the i.MX93 RM, “Bank 3 word 24” in reality is Bank 3 word 0, here a part of the correct order:
Here a small table to understand the offsets:
In the “i.MX Linux User's Guide”, section “13.2 NVMEM provider OCOTP”, says that “The 2nd parameter is from the first data in property reg of a NVMEM consumer, and this offset represents the OCOTP shadow register, to which a eFuse address is mapped.”, so the offset of the first word of each Bank is the number of the Bank times 0x20, for example if you want to kwon the offset of Bank 3 Word 0, the offset is 3 * 0x20 = 0x60, if you want to know the offset of Bank 1 Word 1, the offset is (1 * 0x20) + 4 = 0x24, offset of Bank 2 Word 3 = (2 * 0x20) + (0x4 * 0x3) = 0x4C.
Best regards.
Hello,
Thank you for the quick reply JorgeCas!
I understand what you are saying, but I am struggling to find the right offset value for the MAC addres 1 and 2. In the IMX93 fusemap document there is some flags with specific bank addres and word offset and other like the MAC are "Packed_FuseIndex":
Should I just divide the "Packed_FuseIndex" by 32 to get the offset?
Still getting the permissions problem with all the test done. I can read without any problem the fuses but can't write yet.
Do you have access to the security reference manual?
Best regards.
No, I don't. I have requested it but I haven't been granted access.
The formula for get the offset (Bank number * 8 + word) 39*8 + 317 = 629 that is very far away from 10144 :`)
I have attached in the DTS the following declarations:
Hello,
The security reference manual word number is different compared to the Excel document.
Best regards.
Ok, i will wait for the access
And for the DTS? Do you think it is alright?