IMX93 OCOTP Permissions

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

IMX93 OCOTP Permissions

2,306 Views
Jarbo
Contributor II

Hello,

I am working with an IMX93 and I am trying to record the MAC fuses (0x4ec and 0x4f2), the problem I am encountering is that it is giving me a permissions error and I cannot find OCOTP_LOCK to be able to record these fuses, could you please help me?

Thank you so much!

PS: NVMEM_PATH = "/sys/devices/platform/soc@0/47510000.efuse/fsb_s400_fuse0/nvmem"

0 Kudos
Reply
23 Replies

231 Views
Danube
Contributor IV

Hi Sir,

How to get MAC address information from uboot and kernel user mode.

Those information is base on i.MX93 EVK , A1 version CPU test.

Linux BSP is 6.6.36_210 BSP

Uboot mode try to use fuse read command to get ether mac address.

 

U-Boot SPL 2024.04+gde16f4f1722+p0 (Sep 02 2024 - 10:44:35 +0000)
SOC: 0xa1009300
LC: 0x2040010
PMIC: PCA9451A
PMIC: Over Drive Voltage Mode
DDR: 3733MTS
M33 prepare ok
Normal Boot
Trying to boot from BOOTROM
Boot Stage: Primary boot
image offset 0x8000, pagesize 0x200, ivt offset 0x0
Load image from 0x57400 by ROM_API
NOTICE: TRDC init done
NOTICE: BL31: v2.10.0 (release):lf-6.6.36-2.1.0
NOTICE: BL31: Built : 10:35:32, Aug 29 2024


U-Boot 2024.04+gde16f4f1722+p0 (Sep 02 2024 - 10:44:35 +0000)

Reset Status: POR

CPU: NXP i.MX93(52) Rev1.1 A55 at 1700 MHz
CPU: Industrial temperature grade (-40C to 105C) at 43C

Model: NXP i.MX93 11X11 EVK board
DRAM: 2 GiB
TCPC: Vendor ID [0x1fc9], Product ID [0x5110], Addr [I2C2 0x52]
SNK.Power3.0 on CC2
PDO 0: type 0, 5000 mV, 3000 mA [E]
PDO 1: type 0, 9000 mV, 3000 mA []
PDO 2: type 0, 15000 mV, 3000 mA []
PDO 3: type 0, 20000 mV, 3250 mA []
PDO 4: type 3, undefined
Requesting PDO 3: 20000 mV, 750 mA
Source accept request
PD source ready!
tcpc_pd_receive_message: Polling ALERT register, TCPC_ALERT_RX_STATUS bit failed, ret = -62
TCPC: Vendor ID [0x1fc9], Product ID [0x5110], Addr [I2C2 0x51]
TCPC: Vendor ID [0x1fc9], Product ID [0x5110], Addr [I2C2 0x50]
Core: 235 devices, 37 uclasses, devicetree: separate
MMC: FSL_SDHC: 0, FSL_SDHC: 1
Loading Environment from MMC... *** Warning - bad CRC, using default environment

[*]-Video Link 0adv7535_mipi2hdmi hdmi@3d: Can't find cec device id=0x3c
fail to probe panel device hdmi@3d
fail to get display timings
probe video device failed, ret -19

[0] lcd-controller@4ae30000, video
[1] dsi@4ae10000, video_bridge
[2] hdmi@3d, panel
adv7535_mipi2hdmi hdmi@3d: Can't find cec device id=0x3c
fail to probe panel device hdmi@3d
fail to get display timings
probe video device failed, ret -19
In: serial
Out: serial
Err: serial

BuildInfo:
- ELE firmware version 1.2.0-38f309fe

switch to partitions #0, OK
mmc1 is current device
UID: dc0f9a9a9ef24c7c85d3dc710b2772a7
flash target is MMC:1
Net:
Warning: ethernet@428a0000 (eth1) using random MAC address - 76:cf:21:69:dc:06

Warning: ethernet@42890000 (eth0) using random MAC address - 06:35:98:de:c3:db
eth0: ethernet@42890000, eth1: ethernet@428a0000 [PRIME]
Fastboot: Normal
Normal Boot
Hit any key to stop autoboot: 0
u-boot=>
u-boot=> fuse read 39 3 1
Reading bank 39:

Word 0x00000003: 00000000
u-boot=> fuse read 39 4 1
Reading bank 39:

Word 0x00000004: 00000000
u-boot=> fuse read 39 5 1
Reading bank 39:

Word 0x00000005: 00000000
u-boot=>

 

 

In linux user mode

 

 

 


root@imx93evk:~# ifconfig
eth0: flags=4099<UP,BROADCAST,MULTICAST> mtu 1500
ether 06:35:98:de:c3:db txqueuelen 1000 (Ethernet)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

eth1: flags=4099<UP,BROADCAST,MULTICAST> mtu 1500
ether 76:cf:21:69:dc:06 txqueuelen 1000 (Ethernet)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
device interrupt 104

lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10<host>
loop txqueuelen 1000 (Local Loopback)
RX packets 90 bytes 7662 (7.4 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 90 bytes 7662 (7.4 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

root@imx93evk:~#

 

root@imx93evk:~# hexdump /sys/devices/platform/soc@0/47510000.efuse/fsb_s400_fuse0/nvmem
0000000 26d8 0000 2493 0000 0490 0000 75c6 0000
0000010 009b 0000 7e00 0000 2692 0000 0002 0000
0000020 3600 0000 3493 0000 36db 0000 0000 0000
0000030 04b8 6e5f 0004 0000 83e8 7d62 0000 0000
0000040 0000 0000 0000 0000 0001 0000 01a0 0000
0000050 0000 0000 0000 0000 0000 0000 0000 0000
*
00000c0 0fdc 9a9a f29e 7c4c d385 71dc 270b a772
00000d0 0000 0000 0000 0000 0000 0000 0000 0000
*
00000f0 0000 0000 0000 0000 0000 0000 4000 0000
0000100 0000 0000 0000 0000 0000 0000 0000 0000
*
0000520 0001 0000 3f45 0799 6802 5500 ea3d 0000
0000530 f041 3001 2040 9001 b500 f000 f801 bd00
0000540 b500 f240 0084 f2c5 4021 6801 f011 0f01
0000550 d01f f240 0090 f2c5 4046 6801 f011 0f01
0000560 d117 f04f 0000 f2c5 7054 f44f 7183 f2c1
0000570 7104 f8c0 1200 f8d0 112c f011 0f03 d0fa
0000580 f8d0 1280 f8d0 1284 f640 30b8 f24f 73db
0000590 4798 bd00 0802 5500 5325 0000 f04d 3001
00005a0 0000 0000 0000 0000 0000 0000 0000 0000
*
0000640 0001 0000 6b7c edd6 1c02 5500 7ac8 0000
0000650 0040 2049 2d1b 3940 237f 7100 0049 5400
0000660 001b 5280 03c0 d65f 0000 0000 0000 0000
0000670 0000 0000 0000 0000 0000 0000 0000 0000
*
0000800
root@imx93evk:~#

 

We can't find any MAC address information in /sys/devices/platform/soc@0/47510000.efuse/fsb_s400_fuse0/nvmem

Does any kernel config setting to enable burn in / hexdump about ethernet mac address information ?

 

 

 

 

 

0 Kudos
Reply

1,507 Views
phil331
Contributor I

Hi,

I'm also looking how I can program the i.MX93 MAC addresses into eFUSE...

I notice the kernel "fsl,imx93-ocotp" (imx-ocotp-fsb-s400.c) driver only support reads and does so via the "fsl,imx93-ele" driver. It looks like only Edgelock Enclave can do the actual read/writes to eFUSE. Is there no way to do this from user space?

So, we can only program the MAC addresses using uboot, right?

Thanks

0 Kudos
Reply

1,434 Views
phil331
Contributor I

Some info I found out that may be useful...

The i.MX93 rev.0 silicon uses different byte layout for MAC2 in eFUSE than rev.1 and later. See https://github.com/nxp-imx/uboot-imx/blob/lf_v2023.04/arch/arm/mach-imx/imx9/native/soc.c#L537

With the lf-6.1 BSP, you can only program eFUSE from u-boot, but lf-6.6 BSP adds the ability to program them from Linux userspace.

1,961 Views
Jarbo
Contributor II

Hello again,

I still have doubts, I'm trying to write the fuses directly through the boot and write the MACs (from the image, extracted from the security manual) and I don't know where the lock fuse is to enable them, I can only read them, but I can't write.

Jarbo_1-1715585442342.png

Jarbo_2-1715586057934.png

Jarbo_3-1715586087556.png

 

 

 

1,293 Views
vikki
Contributor II
From which document you got this "fuse bank" mapping?

1,949 Views
JorgeCas
NXP TechSupport
NXP TechSupport

Hello,

The way you burned the fuse is correct.

Could you please try with the next?

fuse sense <bank> <word> [<cnt>] - sense 1 or 'cnt' fuse words, starting at 'word'

Also, did you check it on user space?

Best regards.

0 Kudos
Reply

1,943 Views
Jarbo
Contributor II

this?

Jarbo_0-1715612545506.png

 

0 Kudos
Reply

1,890 Views
JorgeCas
NXP TechSupport
NXP TechSupport

Yes, that command.

There is a lock bit field for MAC address fuses that is:

COM_DEVICE_ID1_LOCK in bank 0 word1 bit [6~8] and the behavior is as mentioned on the next image.

JorgeCas_0-1715695418810.png

Could you please confirm?

Best regards.

 

 

0 Kudos
Reply

1,886 Views
Jarbo
Contributor II

Thanks for the response again,

I have read the BANK 0 WORD 1 and I have 2493, I have been able to observe the bits that you indicate and I see that I have it protected, should I write 000 at this address? that is 2413?

Jarbo_0-1715697009227.png

Jarbo_1-1715697049881.png

 

0 Kudos
Reply

1,863 Views
JorgeCas
NXP TechSupport
NXP TechSupport

Hello,

That is correct, usually these lock bits are unprotected.

Best regards.

0 Kudos
Reply

1,851 Views
Jarbo
Contributor II

I can't write these fuses, any other solution please?

Jarbo_1-1715755020603.png

Jarbo_2-1715755063364.png

 

 

 

 

 

 

0 Kudos
Reply

944 Views
marekb
Contributor III

I have same issue. fuse 0 1 report 2493 and I cannot write MAC2 fuse (addr 5). I just flashed MAC1 which works fine but cannot set MAC2. I didn't do any other use changes. Ideas please? Thanks.

0 Kudos
Reply

1,838 Views
JorgeCas
NXP TechSupport
NXP TechSupport

Hello,

 

Have you blown those fuses before?

 

I read them from EVK boards (A0 and A1 silicon revision), and the default value is the next:

 

JorgeCas_1-1715804077290.png

 

Unfortunately, I cannot burn eFuses on our EVK boards, since we use them to test.

 

Best regards.

0 Kudos
Reply

2,096 Views
Jarbo
Contributor II

Hello, the steps are as follows:

nvmem_path = "/sys/devices/platform/soc@0/47510000.efuse/fsb_s400_fuse0/nvmem"
with open(nvmem_path, 'br+') as f:
    f.seek(seek_offset)
    f.write(pack('<L', value_to_write))

and it tells me that I don't have permissions

The offsets used are (0x4ec)

How should I do so that I could write the fuses of the Mac without it returning a permissions error?

0 Kudos
Reply

2,090 Views
JorgeCas
NXP TechSupport
NXP TechSupport

Hello,

 

I think that error is related to the offset.

 

On i.MX 93 one bank is equals to 8 words, so a bank cannot be more than 8 words, in the fuse map attached to the i.MX93 RM, “Bank 3 word 24” in reality is Bank 3 word 0, here a part of the correct order:

 

JorgeCas_0-1715004929212.png

Here a small table to understand the offsets:

 

JorgeCas_1-1715004929212.png

 

In the “i.MX Linux User's Guide”, section “13.2 NVMEM provider OCOTP”, says that “The 2nd parameter is from the first data in property reg of a NVMEM consumer, and this offset represents the OCOTP shadow register, to which a eFuse address is mapped.”, so the offset of the first word of each Bank is the number of the Bank times 0x20, for example if you want to kwon the offset of Bank 3 Word 0, the offset is 3 * 0x20 = 0x60, if you want to know the offset of Bank 1 Word 1, the offset is (1 * 0x20) + 4 = 0x24, offset of Bank 2 Word 3 = (2 * 0x20) + (0x4 * 0x3) = 0x4C.

 

Best regards.

0 Kudos
Reply

2,080 Views
Jarbo
Contributor II

Hello,

Thank you for the quick reply JorgeCas!

I understand what you are saying, but I am struggling to find the right offset value for the MAC addres 1 and 2. In the IMX93 fusemap document there is some flags with specific bank addres and word offset and other like the MAC are "Packed_FuseIndex":

 

Jarbo_1-1715008205775.png

 

Should I just divide the "Packed_FuseIndex" by 32 to get the offset?

Jarbo_2-1715008227186.png

Still getting the permissions problem with all the test done. I can read without any problem the fuses but can't write yet.

Jarbo_0-1715008935962.png

 

0 Kudos
Reply

2,077 Views
JorgeCas
NXP TechSupport
NXP TechSupport

Do you have access to the security reference manual?

Best regards.

0 Kudos
Reply

2,073 Views
Jarbo
Contributor II

No, I don't. I have requested it but I haven't been granted access. 

The formula for get the offset (Bank number * 8 + word) 39*8 + 317 = 629 that is very far away from 10144 :`)

Jarbo_0-1715009731829.png

 

I have attached in the DTS the following declarations:

Jarbo_1-1715009801635.png

 

0 Kudos
Reply

2,070 Views
JorgeCas
NXP TechSupport
NXP TechSupport

Hello,

The security reference manual word number is different compared to the Excel document.

Best regards.

0 Kudos
Reply

2,068 Views
Jarbo
Contributor II

Ok, i will wait for the access

And for the DTS? Do you think it is alright?

 

0 Kudos
Reply