I'm trying to deal with the fuses (OTP) and Shadows Registers of the i.MX6S processor.
I've already read a lot of documentation, but I'm not still an expert and it's the reason of this post ...
But if this discussion can help other one it a good thing and I'm happy .
So I ever read:
- The i.MX 6Solo/6DualLite Applications Processor Reference Manual: http://cache.nxp.com/files/32bit/doc/ref_manual/IMX6SDLRM.pdf?fpsp=1&WT_TYPE=Reference%20Manuals&WT_VENDOR=FREESCALE&WT_…
- Configuring Secure JTAG for the i.MX 6 Series Family of Applications Processors: http://cache.nxp.com/files/32bit/doc/app_note/AN4686.pdf?fsrch=1&sr=1&pageNum=1
I'm working on two development boards that embed the i.MX6 SoC:
- The RIoTboard which has an i.MX6 Solo core processor (RIoTBoard - Revolutionizing the Internet of Things)
- The SabreLite which has an i.MX6 Quad core processor(SABRE Lite i.MX6 Platform element14’s i.MX 6Quad Processor Evaluation Board | element14 Community)
The first manipulation I want to do is :
- Read a shadow register.
- override its value.
- Read its value again.
- Reload all Shadows registers.
- Check the value is reloaded (by reading it).
So I consider the following registers :
|0x21B_C000||OTP Controller Control Register (OCOTP_CTRL)|
Shadow Register for OTP Bank3 Word0 (SRK Hash)
I want to to this manipulation by two ways :
- A JTAG debugger
- The u-boot user interface with the command "fuse"
On the SabreLite I've no problem:
- I read the value of OCOTP_SRK0 register : 0x0000_0000
- I write a value on it : 0x0011_2233
- I read its value again : 0x0011_2233
- Write '1' in OCOTP_OCTRL in order to reload register
- And then when I read OCOTP_SRK0 I've the reinitialized value : 0x0000_0000
Everything are well, by the JTAG or by the u-boot. Even, I can mix the JTAG and u-boot manipulation, when I modify on one, the other stay coherent with the modification.
On the RIoTboard, and here is the problem, when I want to proceed the same manipulation I can't.
- I can read the value of OCOTP_SRK0 register : 0x0000_0000.
- But I can't write on it and so overwrite with the value 0x0011_2233
- It seems can't also write on the OCOTP_OCTRL. (I'm not sure because I can't change any value so I can't check if I can't reload it).
Because I'm like Mulder and wan't to believe , I compare all the shadows register of the 2 boards.
I think a security configuration lock me and the difference will highlight it :
|Address||SabreLite (hex)||RIoTboard (hex)||Register Name|
Firstly I thought I can't write the shadow fuses because the OCOTP_LOCK is not configured as on the SabreLite.
BUT, on the both board this register has the same value ... So I start to read in detail the features of each fuse in order to understand what stops me to write some shadow registers.
Because it's a long, complicated work and I'm not sure to succeed, I ask the question here.
Q: Does someone have an idea about why I can't proceed the the manipulation as the SabreLite on the RIoTboard ?? Does the problem come from the fuses ?
Don't hesitate to ask me more information,
Thank you for your help.